Analysis
-
max time kernel
37s -
max time network
43s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
24-04-2024 16:46
Behavioral task
behavioral1
Sample
Pinaldi Game Coppier.exe
Resource
win11-20240412-en
Errors
General
-
Target
Pinaldi Game Coppier.exe
-
Size
22.4MB
-
MD5
ff6173ab650aa487d4f7421743730fca
-
SHA1
c4f59628fc7eb993014ad6441ea515ddcc11afb3
-
SHA256
7d03f826ddf005766a813d62e291c5f82b40a266620c65d24cee1d47a0346a62
-
SHA512
3051b1c5ccb0e9c73b2bbd8002edbea8363420363a628e0d01a86d7b5107eee507166472d7a578afd9d2acc560b4c2707864433bf731058343e08f38f1dd53f6
-
SSDEEP
393216:CbYDFYxmEos+icVY+IqDx3KCCV53n+L/XwPUsptAeNJiaPLtqa94wCGlzQorKDpk:CbYfjiuF8MrwttA23PV5l88KN
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 6 IoCs
Processes:
setup.exedescription pid process target process PID 1020 created 3308 1020 setup.exe Explorer.EXE PID 1020 created 3308 1020 setup.exe Explorer.EXE PID 1020 created 3308 1020 setup.exe Explorer.EXE PID 1020 created 3308 1020 setup.exe Explorer.EXE PID 1020 created 3308 1020 setup.exe Explorer.EXE PID 1020 created 3308 1020 setup.exe Explorer.EXE -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 10 IoCs
Processes:
Build.exehacn.exebased.exebased.exehacn.exes.exemain.exesetup.exeUpdate.exeupdater.exepid process 436 Build.exe 3504 hacn.exe 1956 based.exe 1080 based.exe 3736 hacn.exe 920 s.exe 4896 main.exe 1020 setup.exe 1524 Update.exe 4588 updater.exe -
Loads dropped DLL 23 IoCs
Processes:
Pinaldi Game Coppier.exebased.exehacn.exemain.exeUpdate.exepid process 5032 Pinaldi Game Coppier.exe 5032 Pinaldi Game Coppier.exe 1080 based.exe 1080 based.exe 3736 hacn.exe 3736 hacn.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 1080 based.exe 4896 main.exe 1524 Update.exe 1524 Update.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI8362\python310.dll upx behavioral1/memory/5032-16-0x00007FFE8F680000-0x00007FFE8FAE6000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\_socket.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\_lzma.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\_hashlib.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\_decimal.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\_bz2.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\unicodedata.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\select.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI8362\libcrypto-1_1.dll upx behavioral1/memory/5032-28-0x00007FFE8F680000-0x00007FFE8FAE6000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\_ctypes.pyd upx behavioral1/memory/1080-125-0x00007FFE94490000-0x00007FFE944B4000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\_ssl.pyd upx behavioral1/memory/1080-126-0x00007FFE995E0000-0x00007FFE995EF000-memory.dmp upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\_sqlite3.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\_queue.pyd upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\sqlite3.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\libssl-1_1.dll upx C:\Users\Admin\AppData\Local\Temp\_MEI19562\libffi-7.dll upx behavioral1/memory/1080-88-0x00007FFE8F4C0000-0x00007FFE8F926000-memory.dmp upx behavioral1/memory/1080-137-0x00007FFE93390000-0x00007FFE933BC000-memory.dmp upx behavioral1/memory/1080-141-0x00007FFE95950000-0x00007FFE95968000-memory.dmp upx behavioral1/memory/1080-143-0x00007FFE99560000-0x00007FFE9956D000-memory.dmp upx behavioral1/memory/1080-144-0x00007FFE932A0000-0x00007FFE932CE000-memory.dmp upx behavioral1/memory/1080-142-0x00007FFE7E720000-0x00007FFE7E89A000-memory.dmp upx behavioral1/memory/1080-145-0x00007FFE7E3A0000-0x00007FFE7E719000-memory.dmp upx behavioral1/memory/1080-146-0x00007FFE932D0000-0x00007FFE932E9000-memory.dmp upx behavioral1/memory/1080-147-0x00007FFE7E2E0000-0x00007FFE7E398000-memory.dmp upx behavioral1/memory/1080-150-0x00007FFE93130000-0x00007FFE9313D000-memory.dmp upx behavioral1/memory/1080-151-0x00007FFE93280000-0x00007FFE93295000-memory.dmp upx behavioral1/memory/1080-152-0x00007FFE7E1C0000-0x00007FFE7E2D8000-memory.dmp upx behavioral1/memory/1080-140-0x00007FFE932F0000-0x00007FFE9330F000-memory.dmp upx behavioral1/memory/1080-207-0x00007FFE8F4C0000-0x00007FFE8F926000-memory.dmp upx behavioral1/memory/1080-209-0x00007FFE94490000-0x00007FFE944B4000-memory.dmp upx behavioral1/memory/1080-210-0x00007FFE932F0000-0x00007FFE9330F000-memory.dmp upx behavioral1/memory/1080-213-0x00007FFE7E3A0000-0x00007FFE7E719000-memory.dmp upx behavioral1/memory/1080-214-0x00007FFE932A0000-0x00007FFE932CE000-memory.dmp upx behavioral1/memory/1080-215-0x00007FFE932D0000-0x00007FFE932E9000-memory.dmp upx behavioral1/memory/3580-216-0x000002433CD30000-0x000002433CD40000-memory.dmp upx behavioral1/memory/1080-273-0x00007FFE8F4C0000-0x00007FFE8F926000-memory.dmp upx -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 ip-api.com -
Drops file in System32 directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
setup.exedescription pid process target process PID 1020 set thread context of 948 1020 setup.exe dialer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files\Google\Chrome\updater.exe setup.exe -
Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exesc.exepid process 400 sc.exe 916 sc.exe 2064 sc.exe 3548 sc.exe 884 sc.exe -
Detects Pyinstaller 1 IoCs
Processes:
resource yara_rule C:\ProgramData\Microsoft\hacn.exe pyinstaller -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1944 timeout.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
powershell.exepowershell.exepowershell.exemain.exeUpdate.exesetup.exepowershell.exedialer.exepid process 3580 powershell.exe 3968 powershell.exe 716 powershell.exe 3968 powershell.exe 3580 powershell.exe 716 powershell.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 4896 main.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1524 Update.exe 1020 setup.exe 1020 setup.exe 2720 powershell.exe 2720 powershell.exe 1020 setup.exe 1020 setup.exe 1020 setup.exe 1020 setup.exe 1020 setup.exe 1020 setup.exe 948 dialer.exe 948 dialer.exe 1020 setup.exe 1020 setup.exe 1020 setup.exe 1020 setup.exe 948 dialer.exe 948 dialer.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exemain.exepowershell.exepowershell.exetasklist.exeUpdate.exepowershell.exedialer.exedescription pid process Token: SeDebugPrivilege 3580 powershell.exe Token: SeDebugPrivilege 4896 main.exe Token: SeDebugPrivilege 3968 powershell.exe Token: SeDebugPrivilege 716 powershell.exe Token: SeDebugPrivilege 1464 tasklist.exe Token: SeDebugPrivilege 1524 Update.exe Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 948 dialer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Pinaldi Game Coppier.exePinaldi Game Coppier.execmd.exeBuild.exebased.exehacn.exehacn.execmd.exebased.execmd.exes.execmd.execmd.exemain.execmd.execmd.exesetup.exedialer.exelsass.exedescription pid process target process PID 836 wrote to memory of 5032 836 Pinaldi Game Coppier.exe Pinaldi Game Coppier.exe PID 836 wrote to memory of 5032 836 Pinaldi Game Coppier.exe Pinaldi Game Coppier.exe PID 5032 wrote to memory of 4564 5032 Pinaldi Game Coppier.exe cmd.exe PID 5032 wrote to memory of 4564 5032 Pinaldi Game Coppier.exe cmd.exe PID 4564 wrote to memory of 436 4564 cmd.exe Build.exe PID 4564 wrote to memory of 436 4564 cmd.exe Build.exe PID 4564 wrote to memory of 436 4564 cmd.exe Build.exe PID 436 wrote to memory of 3504 436 Build.exe hacn.exe PID 436 wrote to memory of 3504 436 Build.exe hacn.exe PID 436 wrote to memory of 1956 436 Build.exe based.exe PID 436 wrote to memory of 1956 436 Build.exe based.exe PID 1956 wrote to memory of 1080 1956 based.exe based.exe PID 1956 wrote to memory of 1080 1956 based.exe based.exe PID 3504 wrote to memory of 3736 3504 hacn.exe hacn.exe PID 3504 wrote to memory of 3736 3504 hacn.exe hacn.exe PID 3736 wrote to memory of 2236 3736 hacn.exe cmd.exe PID 3736 wrote to memory of 2236 3736 hacn.exe cmd.exe PID 2236 wrote to memory of 920 2236 cmd.exe s.exe PID 2236 wrote to memory of 920 2236 cmd.exe s.exe PID 2236 wrote to memory of 920 2236 cmd.exe s.exe PID 1080 wrote to memory of 1164 1080 based.exe cmd.exe PID 1080 wrote to memory of 1164 1080 based.exe cmd.exe PID 1080 wrote to memory of 5068 1080 based.exe cmd.exe PID 1080 wrote to memory of 5068 1080 based.exe cmd.exe PID 1080 wrote to memory of 2088 1080 based.exe cmd.exe PID 1080 wrote to memory of 2088 1080 based.exe cmd.exe PID 1164 wrote to memory of 3580 1164 cmd.exe powershell.exe PID 1164 wrote to memory of 3580 1164 cmd.exe powershell.exe PID 920 wrote to memory of 4896 920 s.exe main.exe PID 920 wrote to memory of 4896 920 s.exe main.exe PID 920 wrote to memory of 1020 920 s.exe setup.exe PID 920 wrote to memory of 1020 920 s.exe setup.exe PID 5068 wrote to memory of 716 5068 cmd.exe powershell.exe PID 5068 wrote to memory of 716 5068 cmd.exe powershell.exe PID 2088 wrote to memory of 3968 2088 cmd.exe powershell.exe PID 2088 wrote to memory of 3968 2088 cmd.exe powershell.exe PID 4896 wrote to memory of 1756 4896 main.exe cmd.exe PID 4896 wrote to memory of 1756 4896 main.exe cmd.exe PID 1756 wrote to memory of 1464 1756 cmd.exe tasklist.exe PID 1756 wrote to memory of 1464 1756 cmd.exe tasklist.exe PID 1756 wrote to memory of 748 1756 cmd.exe find.exe PID 1756 wrote to memory of 748 1756 cmd.exe find.exe PID 1756 wrote to memory of 1944 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 1944 1756 cmd.exe timeout.exe PID 1756 wrote to memory of 1524 1756 cmd.exe Update.exe PID 1756 wrote to memory of 1524 1756 cmd.exe Update.exe PID 700 wrote to memory of 400 700 cmd.exe sc.exe PID 700 wrote to memory of 400 700 cmd.exe sc.exe PID 700 wrote to memory of 916 700 cmd.exe sc.exe PID 700 wrote to memory of 916 700 cmd.exe sc.exe PID 700 wrote to memory of 2064 700 cmd.exe sc.exe PID 700 wrote to memory of 2064 700 cmd.exe sc.exe PID 700 wrote to memory of 3548 700 cmd.exe sc.exe PID 700 wrote to memory of 3548 700 cmd.exe sc.exe PID 700 wrote to memory of 884 700 cmd.exe sc.exe PID 700 wrote to memory of 884 700 cmd.exe sc.exe PID 1020 wrote to memory of 948 1020 setup.exe dialer.exe PID 948 wrote to memory of 632 948 dialer.exe winlogon.exe PID 948 wrote to memory of 692 948 dialer.exe lsass.exe PID 948 wrote to memory of 996 948 dialer.exe svchost.exe PID 692 wrote to memory of 2568 692 lsass.exe sysmon.exe PID 948 wrote to memory of 460 948 dialer.exe dwm.exe PID 948 wrote to memory of 1028 948 dialer.exe svchost.exe PID 692 wrote to memory of 2568 692 lsass.exe sysmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Pinaldi Game Coppier.exe"C:\Users\Admin\AppData\Local\Temp\Pinaldi Game Coppier.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Pinaldi Game Coppier.exe"C:\Users\Admin\AppData\Local\Temp\Pinaldi Game Coppier.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI8362\Build.exe -pbeznogym4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\Build.exeC:\Users\Admin\AppData\Local\Temp\_MEI8362\Build.exe -pbeznogym5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\hacn.exe"C:\ProgramData\Microsoft\hacn.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\hacn.exe"C:\ProgramData\Microsoft\hacn.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Local\Temp\_MEI35042\s.exe -pbeznogym8⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\s.exeC:\Users\Admin\AppData\Local\Temp\_MEI35042\s.exe -pbeznogym9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\main.exe"C:\ProgramData\main.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp81E2.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp81E2.tmp.bat11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exeTasklist /fi "PID eq 4896"12⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\find.exefind ":"12⤵
-
C:\Windows\system32\timeout.exeTimeout /T 1 /Nobreak12⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\setup.exe"C:\ProgramData\setup.exe"10⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\based.exe"C:\ProgramData\Microsoft\based.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\based.exe"C:\ProgramData\Microsoft\based.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\based.exe'9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'"8⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ .scr'9⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc stop UsoSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop wuauserv3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop bits3⤵
- Launches sc.exe
-
C:\Windows\System32\sc.exesc stop dosvc3⤵
- Launches sc.exe
-
C:\Windows\System32\dialer.exeC:\Windows\System32\dialer.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\yntnomxcupkb.xml"2⤵
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"2⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\Google\Chrome\updater.exe"C:\Program Files\Google\Chrome\updater.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\based.exeFilesize
5.9MB
MD5f46b59fe72bff8755bc751ce5d796031
SHA17123fff95f65bc71bd509939d097bf4ba7194b10
SHA2567538e0c594b91e820d8a14cff1586eb384734274d4bbd917c497fd42436bdada
SHA51221d702f0b48c7ec927ce9e57dc81bb5c76ef465defb6f2914482931ae4302d968e2241b96bdedeb14af4c5cce4508ede7a3b5e41fb7033eda401d22c59770a22
-
C:\ProgramData\Microsoft\hacn.exeFilesize
12.3MB
MD50b6cd2cf55fadd40218d09b5617022f3
SHA1f33ce545bf7d07c84755cea6151b44ca17889a70
SHA256edc2569ca00fba2e64ff7727b64b3cdf7182f9a37226f190aeb57a755f225ede
SHA512d45ee80d7d17c62257a117de22b647317a728ac716d3193af539944e985055735ce5a6444f08f49a15a0dd397d1557e830129b810b703dc508d3a7ed9a7e6d96
-
C:\ProgramData\main.exeFilesize
5.6MB
MD55df3e2c717f267899f37ec6e8fc7f47a
SHA15e980079f67215bf69b8c1c16b56f40bf4a29958
SHA256e3f5c557ece7ec27cb7e4a26482eadf0d9065065d94b2919f9b881bc74800e6e
SHA5128cef1184120e010421d69fcf271822b3f0b45e34a1565152a3f2decb8f500d0e69de9816d9075683fcfb0f431713f3fbc42ac2d87503cdcdde125aba3fa1635d
-
C:\ProgramData\setup.exeFilesize
5.4MB
MD51274cbcd6329098f79a3be6d76ab8b97
SHA153c870d62dcd6154052445dc03888cdc6cffd370
SHA256bbe5544c408a6eb95dd9980c61a63c4ebc8ccbeecade4de4fae8332361e27278
SHA512a0febbd4915791d3c32531fb3cf177ee288dd80ce1c8a1e71fa9ad59a4ebddeef69b6be7f3d19e687b96dc59c8a8fa80afff8378a71431c3133f361b28e0d967
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\_ctypes.pydFilesize
58KB
MD531859b9a99a29127c4236968b87dbcbb
SHA129b4ee82aa026c10fe8a4f43b40cbd8ec7ea71e5
SHA256644712c3475be7f02c2493d75e6a831372d01243aca61aa8a1418f57e6d0b713
SHA512fec3ab9ce032e02c432d714de0d764aab83917129a5e6eeca21526b03176da68da08024d676bc0032200b2d2652e6d442ca2f1ef710a7408bd198995883a943a
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\_queue.pydFilesize
25KB
MD5bebc7743e8af7a812908fcb4cdd39168
SHA100e9056e76c3f9b2a9baba683eaa52ecfa367edb
SHA256cc275b2b053410c6391339149baf5b58df121a915d18b889f184be02bedaf9bc
SHA512c56496c6396b8c3ec5ec52542061b2146ea80d986dfe13b0d4feb7b5953c80663e34ccd7b7ee99c4344352492be93f7d31f7830ec9ec2ca8a0c2055cb18fa8db
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\_sqlite3.pydFilesize
50KB
MD570a7050387359a0fab75b042256b371f
SHA15ffc6dfbaddb6829b1bfd478effb4917d42dff85
SHA256e168a1e229f57248253ead19f60802b25dc0dbc717c9776e157b8878d2ca4f3d
SHA512154fd26d4ca1e6a85e3b84ce9794a9d1ef6957c3bba280d666686a0f14aa571aaec20baa0e869a78d4669f1f28ea333c0e9e4d3ecd51b25d34e46a0ef74ee735
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\_ssl.pydFilesize
62KB
MD59a7ab96204e505c760921b98e259a572
SHA139226c222d3c439a03eac8f72b527a7704124a87
SHA256cae09bbbb12aa339fd9226698e7c7f003a26a95390c7dc3a2d71a1e540508644
SHA5120f5f58fb47379b829ee70c631b3e107cde6a69dc64e4c993fb281f2d5ada926405ce29ea8b1f4f87ed14610e18133932c7273a1aa209a0394cc6332f2aba7e58
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\blank.aesFilesize
76KB
MD50fa3e9bc517c9ba7c4b328a37742c176
SHA1cce84c47c8ae456da414d674c8046bc9756f9aae
SHA2569081435d1d5870f3b69f5c295b08d1cb655882289be9fd03081858a2c0dc0a4e
SHA512b626e5b244099eeaa29d15fec40caba071118f56b2a0df7e8a7ca76fe248a07557e502348b4dd3810e0a61ce2943dc3ed55107459a0db9cd4c68dc697f430b59
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\libffi-7.dllFilesize
23KB
MD56f818913fafe8e4df7fedc46131f201f
SHA1bbb7ba3edbd4783f7f973d97b0b568cc69cadac5
SHA2563f94ee4f23f6c7702ab0cc12995a6457bf22183fa828c30cc12288adf153ae56
SHA5125473fe57dc40af44edb4f8a7efd68c512784649d51b2045d570c7e49399990285b59cfa6bcd25ef1316e0a073ea2a89fe46be3bfc33f05e3333037a1fd3a6639
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\libssl-1_1.dllFilesize
204KB
MD5ad0a2b4286a43a0ef05f452667e656db
SHA1a8835ca75768b5756aa2445ca33b16e18ceacb77
SHA2562af3d965863018c66c2a9a2d66072fe3657bbd0b900473b9bbdcac8091686ae1
SHA512cceb5ec1dd6d2801abbacd6112393fecbf5d88fe52db86cfc98f13326c3d3e31c042b0cc180b640d0f33681bdd9e6a355dc0fbfde597a323c8d9e88de40b37c4
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\rar.exeFilesize
615KB
MD59c223575ae5b9544bc3d69ac6364f75e
SHA18a1cb5ee02c742e937febc57609ac312247ba386
SHA25690341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA51257663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\rarreg.keyFilesize
456B
MD54531984cad7dacf24c086830068c4abe
SHA1fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA25658209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA51200056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122
-
C:\Users\Admin\AppData\Local\Temp\_MEI19562\sqlite3.dllFilesize
622KB
MD50c4996047b6efda770b03f8f231e39b8
SHA1dffcabcd4e950cc8ee94c313f1a59e3021a0ad48
SHA256983f31bc687e0537d6028a9a65f4825cc560bbf3cb3eb0d3c0fcc2238219b5ed
SHA512112773b83b5b4b71007f2668b0344bf45db03bbe1f97ae738615f3c4e2f8afb54b3ae095ea1131bf858ddfb1e585389658af5db56561609a154ae6bb80dc79ba
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\_bz2.pydFilesize
81KB
MD586d1b2a9070cd7d52124126a357ff067
SHA118e30446fe51ced706f62c3544a8c8fdc08de503
SHA25662173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
SHA5127db4b7e0c518a02ae901f4b24e3860122acc67e38e73f98f993fe99eb20bb3aa539db1ed40e63d6021861b54f34a5f5a364907ffd7da182adea68bbdd5c2b535
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\_decimal.pydFilesize
248KB
MD520c77203ddf9ff2ff96d6d11dea2edcf
SHA10d660b8d1161e72c993c6e2ab0292a409f6379a5
SHA2569aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
SHA5122b24346ece2cbd1e9472a0e70768a8b4a5d2c12b3d83934f22ebdc9392d9023dcb44d2322ada9edbe2eb0e2c01b5742d2a83fa57ca23054080909ec6eb7cf3ca
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\_hashlib.pydFilesize
63KB
MD5d4674750c732f0db4c4dd6a83a9124fe
SHA1fd8d76817abc847bb8359a7c268acada9d26bfd5
SHA256caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
SHA51297d57cfb80dd9dd822f2f30f836e13a52f771ee8485bc0fd29236882970f6bfbdfaac3f2e333bba5c25c20255e8c0f5ad82d8bc8a6b6e2f7a07ea94a9149c81e
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\_lzma.pydFilesize
154KB
MD57447efd8d71e8a1929be0fac722b42dc
SHA16080c1b84c2dcbf03dcc2d95306615ff5fce49a6
SHA25660793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
SHA512c6295d45ed6c4f7534c1a38d47ddc55fea8b9f62bbdc0743e4d22e8ad0484984f8ab077b73e683d0a92d11bf6588a1ae395456cfa57da94bb2a6c4a1b07984de
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\_socket.pydFilesize
77KB
MD5819166054fec07efcd1062f13c2147ee
SHA193868ebcd6e013fda9cd96d8065a1d70a66a2a26
SHA256e6deb751039cd5424a139708475ce83f9c042d43e650765a716cb4a924b07e4f
SHA512da3a440c94cb99b8af7d2bc8f8f0631ae9c112bd04badf200edbf7ea0c48d012843b4a9fb9f1e6d3a9674fd3d4eb6f0fa78fd1121fad1f01f3b981028538b666
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\libcrypto-1_1.dllFilesize
3.3MB
MD59d7a0c99256c50afd5b0560ba2548930
SHA176bd9f13597a46f5283aa35c30b53c21976d0824
SHA2569b7b4a0ad212095a8c2e35c71694d8a1764cd72a829e8e17c8afe3a55f147939
SHA512cb39aa99b9d98c735fdacf1c5ed68a4d09d11f30262b91f6aa48c3f8520eff95e499400d0ce7e280ca7a90ff6d7141d2d893ef0b33a8803a1cadb28ba9a9e3e2
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\python310.dllFilesize
4.3MB
MD563a1fa9259a35eaeac04174cecb90048
SHA10dc0c91bcd6f69b80dcdd7e4020365dd7853885a
SHA25614b06796f288bc6599e458fb23a944ab0c843e9868058f02a91d4606533505ed
SHA512896caa053f48b1e4102e0f41a7d13d932a746eea69a894ae564ef5a84ef50890514deca6496e915aae40a500955220dbc1b1016fe0b8bcdde0ad81b2917dea8b
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\s.exeFilesize
7.3MB
MD569844fa00a57dfbedf6ad10016734a5a
SHA11e3d266530daf49ee01a9026ab518b11af8ef1ae
SHA256067d544437c847ada035f5cadbe8b75554aaa7dad6cbfdfbfa83a302b63a647e
SHA512fde734bb418552fcc8e318fa5ff4156d233fb43bfd2997c2f1eb9b9f4f109a3824f992dbff107765f4eec780008884de26b04e8e02a08dad337ace9aa230fc81
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\select.pydFilesize
29KB
MD5a653f35d05d2f6debc5d34daddd3dfa1
SHA11a2ceec28ea44388f412420425665c3781af2435
SHA256db85f2f94d4994283e1055057372594538ae11020389d966e45607413851d9e9
SHA5125aede99c3be25b1a962261b183ae7a7fb92cb0cb866065dc9cd7bb5ff6f41cc8813d2cc9de54670a27b3ad07a33b833eaa95a5b46dad7763ca97dfa0c1ce54c9
-
C:\Users\Admin\AppData\Local\Temp\_MEI35042\unicodedata.pydFilesize
1.1MB
MD581d62ad36cbddb4e57a91018f3c0816e
SHA1fe4a4fc35df240b50db22b35824e4826059a807b
SHA2561fb2d66c056f69e8bbdd8c6c910e72697874dae680264f8fb4b4df19af98aa2e
SHA5127d15d741378e671591356dfaad4e1e03d3f5456cbdf87579b61d02a4a52ab9b6ecbffad3274cede8c876ea19eaeb8ba4372ad5986744d430a29f50b9caffb75d
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\Build.exeFilesize
18.3MB
MD56f0622ea2e0bdc5e289d6775414dfa08
SHA1743d3f73cd323e6b83d56273693f68b786b9c0b7
SHA256c3ea70089b9e68730eef4d29dbbc390c0e4bbc6c07cc6196be65ddb8b0a4b412
SHA5120682ebfdccdaa942214ca82855dfa10ddb9e3133b7b3cc2b8bb5c272cbb8082db6d7b402c8e2bdb754ff084823a96ad534b2a7f21db08d773492a179f9582c2a
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\VCRUNTIME140.dllFilesize
95KB
MD5f34eb034aa4a9735218686590cba2e8b
SHA12bc20acdcb201676b77a66fa7ec6b53fa2644713
SHA2569d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
SHA512d27d5e65e8206bd7923cf2a3c4384fec0fc59e8bc29e25f8c03d039f3741c01d1a8c82979d7b88c10b209db31fbbec23909e976b3ee593dc33481f0050a445af
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\_bz2.pydFilesize
47KB
MD5fba120a94a072459011133da3a989db2
SHA16568b3e9e993c7e993a699505339bbebb5db6fb0
SHA256055a93c8b127dc840ac40ca70d4b0246ac88c9cde1ef99267bbe904086e0b7d3
SHA512221b5a2a9de1133e2866b39f493a822060d3fb85f8c844c116f64878b9b112e8085e61d450053d859a63450d1292c13bd7ec38b89fe2dfa6684ac94e090ec3aa
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\_decimal.pydFilesize
106KB
MD57cdc590ac9b4ffa52c8223823b648e5c
SHA1c8d9233acbff981d96c27f188fcde0e98cdcb27c
SHA256f281bd8219b4b0655e9c3a5516fe0b36e44c28b0ac9170028dd052ca234c357c
SHA512919c36be05f5f94ec84e68ecca43c7d43acb8137a043cf429a9e995643ca69c4c101775955e36c15f844f64fc303999da0cbfe5e121eb5b3ffb7d70e3cd08e0b
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\_hashlib.pydFilesize
35KB
MD5659a5efa39a45c204ada71e1660a7226
SHA11a347593fca4f914cfc4231dc5f163ae6f6e9ce0
SHA256b16c0cc3baa67246d8f44138c6105d66538e54d0afb999f446cae58ac83ef078
SHA512386626b3bad58b450b8b97c6ba51ce87378cddf7f574326625a03c239aa83c33f4d824d3b8856715f413cfb9238d23f802f598084dbd8c73c8f6c61275fdecb5
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\_lzma.pydFilesize
85KB
MD5864b22495372fa4d8b18e1c535962ae2
SHA18cfaee73b7690b9731303199e3ed187b1c046a85
SHA256fc57bd20b6b128afa5faaac1fd0ce783031faaf39f71b58c9cacf87a16f3325f
SHA5129f26fe88aca42c80eb39153708b2315a4154204fc423ca474860072dd68ccc00b7081e8adb87ef9a26b9f64cd2f4334f64bc2f732cd47e3f44f6cf9cc16fa187
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\_socket.pydFilesize
42KB
MD549f87aec74fea76792972022f6715c4d
SHA1ed1402bb0c80b36956ec9baf750b96c7593911bd
SHA2565d8c8186df42633679d6236c1febf93db26405c1706f9b5d767feab440ea38b0
SHA512de58d69228395827547e07695f70ef98cdaf041ebaae0c3686246209254f0336a589b58d44b7776ccae24a5bc03b9dc8354c768170b1771855f342eecc5fead4
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\base_library.zipFilesize
859KB
MD5483d9675ef53a13327e7dfc7d09f23fe
SHA12378f1db6292cd8dc4ad95763a42ad49aeb11337
SHA25670c28ec0770edefcef46fa27aaa08ba8dc22a31acd6f84cb0b99257dca1b629e
SHA512f905eb1817d7d4cc1f65e3a5a01bade761bca15c4a24af7097bc8f3f2b43b00e000d6ea23cd054c391d3fdc2f1114f2af43c8bb6d97c1a0ce747763260a864f5
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\libcrypto-1_1.dllFilesize
1.1MB
MD5bbc1fcb5792f226c82e3e958948cb3c3
SHA14d25857bcf0651d90725d4fb8db03ccada6540c3
SHA2569a36e09f111687e6b450937bb9c8aede7c37d598b1cccc1293eed2342d11cf47
SHA5123137be91f3393df2d56a3255281db7d4a4dccd6850eeb4f0df69d4c8dda625b85d5634fce49b195f3cc431e2245b8e9ba401baaa08778a467639ee4c1cc23d8d
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\python310.dllFilesize
1.4MB
MD54a6afa2200b1918c413d511c5a3c041c
SHA139ca3c2b669adac07d4a5eb1b3b79256cfe0c3b3
SHA256bec187f608507b57cf0475971ba646b8ab42288af8fdcf78bce25f1d8c84b1da
SHA512dbffb06ffff0542200344ea9863a44a6f1e1b783379e53df18580e697e8204d3911e091deb32a9c94b5599cdd54301b705b74e1f51104151cf13b89d57280a20
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\select.pydFilesize
25KB
MD5b6de7c98e66bde6ecffbf0a1397a6b90
SHA163823ef106e8fd9ea69af01d8fe474230596c882
SHA25684b2119ed6c33dfbdf29785292a529aabbf75139d163cfbcc99805623bb3863c
SHA5121fc26e8edc447d87a4213cb5df5d18f990bba80e5635e83193f2ae5368dd88a81fddfb4575ef4475e9bf2a6d75c5c66c8ed772496ffa761c0d8644fcf40517ca
-
C:\Users\Admin\AppData\Local\Temp\_MEI8362\unicodedata.pydFilesize
289KB
MD5c697dc94bdf07a57d84c7c3aa96a2991
SHA1641106acd3f51e6db1d51aa2e4d4e79cf71dc1ab
SHA25658605600fdaafbc0052a4c1eb92f68005307554cf5ad04c226c320a1c14f789e
SHA5124f735678b7e38c8e8b693593696f9483cf21f00aea2a6027e908515aa047ec873578c5068354973786e9cfd0d25b7ab1dd6cbb1b97654f202cbb17e233247a61
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxdnd5s2.msx.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/460-281-0x0000020E59AB0000-0x0000020E59ADB000-memory.dmpFilesize
172KB
-
memory/460-327-0x00007FFE9ECC6000-0x00007FFE9ECC7000-memory.dmpFilesize
4KB
-
memory/460-325-0x0000020E59AB0000-0x0000020E59ADB000-memory.dmpFilesize
172KB
-
memory/460-326-0x00007FFE9ECC3000-0x00007FFE9ECC4000-memory.dmpFilesize
4KB
-
memory/460-286-0x00007FFE5ECB0000-0x00007FFE5ECC0000-memory.dmpFilesize
64KB
-
memory/632-272-0x0000022671D50000-0x0000022671D7B000-memory.dmpFilesize
172KB
-
memory/632-316-0x0000022671D50000-0x0000022671D7B000-memory.dmpFilesize
172KB
-
memory/632-270-0x0000022671D20000-0x0000022671D44000-memory.dmpFilesize
144KB
-
memory/632-319-0x00007FFE9ECC4000-0x00007FFE9ECC5000-memory.dmpFilesize
4KB
-
memory/692-279-0x00007FFE5ECB0000-0x00007FFE5ECC0000-memory.dmpFilesize
64KB
-
memory/692-274-0x000002D7212D0000-0x000002D7212FB000-memory.dmpFilesize
172KB
-
memory/692-322-0x000002D7212D0000-0x000002D7212FB000-memory.dmpFilesize
172KB
-
memory/692-323-0x00007FFE9ECC4000-0x00007FFE9ECC5000-memory.dmpFilesize
4KB
-
memory/716-192-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/716-211-0x0000015FF50E0000-0x0000015FF50F0000-memory.dmpFilesize
64KB
-
memory/716-218-0x0000015FF50E0000-0x0000015FF50F0000-memory.dmpFilesize
64KB
-
memory/716-225-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/716-203-0x0000015FF50E0000-0x0000015FF50F0000-memory.dmpFilesize
64KB
-
memory/716-201-0x0000015FF50E0000-0x0000015FF50F0000-memory.dmpFilesize
64KB
-
memory/948-264-0x00007FFE9EC20000-0x00007FFE9EE29000-memory.dmpFilesize
2.0MB
-
memory/948-266-0x00007FFE9E1A0000-0x00007FFE9E25D000-memory.dmpFilesize
756KB
-
memory/996-285-0x00007FFE5ECB0000-0x00007FFE5ECC0000-memory.dmpFilesize
64KB
-
memory/996-280-0x000001E84D340000-0x000001E84D36B000-memory.dmpFilesize
172KB
-
memory/996-324-0x000001E84D340000-0x000001E84D36B000-memory.dmpFilesize
172KB
-
memory/1020-269-0x00007FF60DC00000-0x00007FF60E165000-memory.dmpFilesize
5.4MB
-
memory/1020-248-0x00007FF60DC00000-0x00007FF60E165000-memory.dmpFilesize
5.4MB
-
memory/1028-296-0x00007FFE5ECB0000-0x00007FFE5ECC0000-memory.dmpFilesize
64KB
-
memory/1028-293-0x000001B358B70000-0x000001B358B9B000-memory.dmpFilesize
172KB
-
memory/1028-329-0x000001B358B70000-0x000001B358B9B000-memory.dmpFilesize
172KB
-
memory/1044-295-0x000002BD8FD40000-0x000002BD8FD6B000-memory.dmpFilesize
172KB
-
memory/1044-298-0x00007FFE5ECB0000-0x00007FFE5ECC0000-memory.dmpFilesize
64KB
-
memory/1044-331-0x000002BD8FD40000-0x000002BD8FD6B000-memory.dmpFilesize
172KB
-
memory/1052-308-0x000001DD191D0000-0x000001DD191FB000-memory.dmpFilesize
172KB
-
memory/1052-311-0x00007FFE5ECB0000-0x00007FFE5ECC0000-memory.dmpFilesize
64KB
-
memory/1080-209-0x00007FFE94490000-0x00007FFE944B4000-memory.dmpFilesize
144KB
-
memory/1080-150-0x00007FFE93130000-0x00007FFE9313D000-memory.dmpFilesize
52KB
-
memory/1080-152-0x00007FFE7E1C0000-0x00007FFE7E2D8000-memory.dmpFilesize
1.1MB
-
memory/1080-213-0x00007FFE7E3A0000-0x00007FFE7E719000-memory.dmpFilesize
3.5MB
-
memory/1080-214-0x00007FFE932A0000-0x00007FFE932CE000-memory.dmpFilesize
184KB
-
memory/1080-215-0x00007FFE932D0000-0x00007FFE932E9000-memory.dmpFilesize
100KB
-
memory/1080-125-0x00007FFE94490000-0x00007FFE944B4000-memory.dmpFilesize
144KB
-
memory/1080-126-0x00007FFE995E0000-0x00007FFE995EF000-memory.dmpFilesize
60KB
-
memory/1080-140-0x00007FFE932F0000-0x00007FFE9330F000-memory.dmpFilesize
124KB
-
memory/1080-88-0x00007FFE8F4C0000-0x00007FFE8F926000-memory.dmpFilesize
4.4MB
-
memory/1080-137-0x00007FFE93390000-0x00007FFE933BC000-memory.dmpFilesize
176KB
-
memory/1080-147-0x00007FFE7E2E0000-0x00007FFE7E398000-memory.dmpFilesize
736KB
-
memory/1080-141-0x00007FFE95950000-0x00007FFE95968000-memory.dmpFilesize
96KB
-
memory/1080-151-0x00007FFE93280000-0x00007FFE93295000-memory.dmpFilesize
84KB
-
memory/1080-210-0x00007FFE932F0000-0x00007FFE9330F000-memory.dmpFilesize
124KB
-
memory/1080-207-0x00007FFE8F4C0000-0x00007FFE8F926000-memory.dmpFilesize
4.4MB
-
memory/1080-273-0x00007FFE8F4C0000-0x00007FFE8F926000-memory.dmpFilesize
4.4MB
-
memory/1080-143-0x00007FFE99560000-0x00007FFE9956D000-memory.dmpFilesize
52KB
-
memory/1080-144-0x00007FFE932A0000-0x00007FFE932CE000-memory.dmpFilesize
184KB
-
memory/1080-142-0x00007FFE7E720000-0x00007FFE7E89A000-memory.dmpFilesize
1.5MB
-
memory/1080-145-0x00007FFE7E3A0000-0x00007FFE7E719000-memory.dmpFilesize
3.5MB
-
memory/1080-146-0x00007FFE932D0000-0x00007FFE932E9000-memory.dmpFilesize
100KB
-
memory/1168-312-0x00000295A1530000-0x00000295A155B000-memory.dmpFilesize
172KB
-
memory/1524-232-0x000002071CAE0000-0x000002071CAF0000-memory.dmpFilesize
64KB
-
memory/1524-313-0x00007FFE7D1C0000-0x00007FFE7DC82000-memory.dmpFilesize
10.8MB
-
memory/1524-265-0x0000020735500000-0x00000207356BF000-memory.dmpFilesize
1.7MB
-
memory/1524-231-0x00007FFE7D1C0000-0x00007FFE7DC82000-memory.dmpFilesize
10.8MB
-
memory/2720-250-0x000001FC449B0000-0x000001FC449C0000-memory.dmpFilesize
64KB
-
memory/2720-262-0x00007FFE7D1C0000-0x00007FFE7DC82000-memory.dmpFilesize
10.8MB
-
memory/2720-260-0x000001FC449B0000-0x000001FC449C0000-memory.dmpFilesize
64KB
-
memory/2720-249-0x00007FFE7D1C0000-0x00007FFE7DC82000-memory.dmpFilesize
10.8MB
-
memory/2720-251-0x000001FC449B0000-0x000001FC449C0000-memory.dmpFilesize
64KB
-
memory/3580-217-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/3580-223-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/3580-167-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/3580-182-0x000002433CCE0000-0x000002433CD02000-memory.dmpFilesize
136KB
-
memory/3580-216-0x000002433CD30000-0x000002433CD40000-memory.dmpFilesize
64KB
-
memory/3580-170-0x000002433CD30000-0x000002433CD40000-memory.dmpFilesize
64KB
-
memory/3580-168-0x000002433CD30000-0x000002433CD40000-memory.dmpFilesize
64KB
-
memory/3968-205-0x00000271B31F0000-0x00000271B3200000-memory.dmpFilesize
64KB
-
memory/3968-222-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/3968-204-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/3968-206-0x00000271B31F0000-0x00000271B3200000-memory.dmpFilesize
64KB
-
memory/3968-212-0x00000271B31F0000-0x00000271B3200000-memory.dmpFilesize
64KB
-
memory/4896-229-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/4896-202-0x000001C8D71C0000-0x000001C8D71D0000-memory.dmpFilesize
64KB
-
memory/4896-208-0x000001C8EF920000-0x000001C8EF93E000-memory.dmpFilesize
120KB
-
memory/4896-166-0x000001C8D4F30000-0x000001C8D54D0000-memory.dmpFilesize
5.6MB
-
memory/4896-173-0x000001C8EF960000-0x000001C8EF9D6000-memory.dmpFilesize
472KB
-
memory/4896-183-0x00007FFE7D230000-0x00007FFE7DCF2000-memory.dmpFilesize
10.8MB
-
memory/5032-28-0x00007FFE8F680000-0x00007FFE8FAE6000-memory.dmpFilesize
4.4MB
-
memory/5032-16-0x00007FFE8F680000-0x00007FFE8FAE6000-memory.dmpFilesize
4.4MB