xmrig | 7db2f1b8447c7724e0b312fb2a9cc177807d72d44cec68e12aef49b3990b1c29

Analysis

max time kernel
79s
max time network
75s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Vapev41.exe
Size

36.0MB
MD5

feb087808958828564c3f63115056652
SHA1

aa7da658d1720bb04c4f48bd48c96c2b203007b6
SHA256

7db2f1b8447c7724e0b312fb2a9cc177807d72d44cec68e12aef49b3990b1c29
SHA512

82e2ee2059895539b7407f5f16cd8dc278cfa334e7774e819544e0f5cd00002910a1dfd745a89c6a22dd683d04fe2ac45f82587fdb11d1efddb1c6bff2855ea5
SSDEEP

786432:s8AkL7W5cIaalagScIwxMSLu2gTLXVsSibQpOXD/4VxZrJczq:s8AkLA5xScILSLu2qVcbQpOXsnzc

Score

10^/10

xmrig xworm evasion miner persistence rat trojan upx

Malware Config

Extracted

Family

xworm

185.216.70.22:7000

127.0.0.1:7000

185.239.237.162:7000

Attributes

Install_directory
%AppData%
install_file
GoogleUpdateCore.exe

Signatures

Detect Xworm Payload 4 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe	family_xworm
behavioral1/memory/2976-7-0x0000000000AF0000-0x0000000000B08000-memory.dmp	family_xworm
C:\Users\Admin\AppData\Roaming\discord.exe	family_xworm
behavioral1/memory/1808-121-0x0000000000A20000-0x0000000000A3E000-memory.dmp	family_xworm

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

Processes:

WAlletsd.exeupdater.exe

description	pid	process	target process
PID 312 created 1204	312	WAlletsd.exe	Explorer.EXE
PID 312 created 1204	312	WAlletsd.exe	Explorer.EXE
PID 312 created 1204	312	WAlletsd.exe	Explorer.EXE
PID 312 created 1204	312	WAlletsd.exe	Explorer.EXE
PID 312 created 1204	312	WAlletsd.exe	Explorer.EXE
PID 312 created 1204	312	WAlletsd.exe	Explorer.EXE
PID 2720 created 1204	2720	updater.exe	Explorer.EXE
PID 2720 created 1204	2720	updater.exe	Explorer.EXE
PID 2720 created 1204	2720	updater.exe	Explorer.EXE
PID 2720 created 1204	2720	updater.exe	Explorer.EXE
PID 2720 created 1204	2720	updater.exe	Explorer.EXE
PID 2720 created 1204	2720	updater.exe	Explorer.EXE

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 3 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/2820-328-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2820-334-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig
behavioral1/memory/2820-336-0x0000000140000000-0x0000000140840000-memory.dmp	xmrig

Drops file in Drivers directory 2 IoCs

Processes:

WAlletsd.exeupdater.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts WAlletsd.exe
File created C:\Windows\System32\drivers\etc\hosts updater.exe
Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	WAlletsd.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Drops startup file 2 IoCs

Processes:

discord.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\discord.lnk	discord.exe

Executes dropped EXE 12 IoCs

Processes:

GoogleUpdateCore.exeVapeV4.exeGoogleUpdateCore.exeVape Updated.exeVape.exeVape.exeWAlletsd.exediscord.exeExplorer.EXEupdater.exeGoogleUpdateCore.exe

pid	process
2976	GoogleUpdateCore.exe
2564	VapeV4.exe
2980	GoogleUpdateCore.exe
2772	Vape Updated.exe
2456	Vape.exe
1664	Vape.exe
312	WAlletsd.exe
1808	discord.exe
1204	Explorer.EXE
480
2720	updater.exe
2124	GoogleUpdateCore.exe

Loads dropped DLL 10 IoCs

Processes:

Vape Updated.exeVape.exeExplorer.EXE

pid	process
2772	Vape Updated.exe
1664	Vape.exe
1664	Vape.exe
2772	Vape Updated.exe
1664	Vape.exe
1664	Vape.exe
1664	Vape.exe
1664	Vape.exe
1664	Vape.exe
1204	Explorer.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\_MEI24562\python311.dll	upx
behavioral1/memory/1664-119-0x000007FEF2260000-0x000007FEF2849000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

GoogleUpdateCore.exediscord.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleUpdateCore = "C:\\Users\\Admin\\AppData\\Roaming\\GoogleUpdateCore.exe"	GoogleUpdateCore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\discord = "C:\\Users\\Admin\\AppData\\Roaming\\discord.exe"	discord.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 ip-api.com

flow	ioc
5	ip-api.com

Drops file in System32 directory 2 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

updater.exe

description	pid	process	target process
PID 2720 set thread context of 1396	2720	updater.exe	conhost.exe
PID 2720 set thread context of 2820	2720	updater.exe	explorer.exe

Drops file in Program Files directory 1 IoCs

Processes:

WAlletsd.exe

description ioc process

File created C:\Program Files\Google\Chrome\updater.exe WAlletsd.exe
Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1396 sc.exe
1216 sc.exe
3020 sc.exe
764 sc.exe
1512 sc.exe
2384 sc.exe
2032 sc.exe
2944 sc.exe
2348 sc.exe
892 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2008 schtasks.exe
2640 schtasks.exe
1788 schtasks.exe
2512 schtasks.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\updater.exe	WAlletsd.exe

pid	process
1396	sc.exe
1216	sc.exe
3020	sc.exe
764	sc.exe
1512	sc.exe
2384	sc.exe
2032	sc.exe
2944	sc.exe
2348	sc.exe
892	sc.exe

pid	process
2008	schtasks.exe
2640	schtasks.exe
1788	schtasks.exe
2512	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 80fca9311f93da01	powershell.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

GoogleUpdateCore.exe

pid process

2976 GoogleUpdateCore.exe

Suspicious behavior: EnumeratesProcesses 59 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exeWAlletsd.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exediscord.exeupdater.exepowershell.exeexplorer.exe

pid	process
2364	powershell.exe
864	powershell.exe
588	powershell.exe
1304	powershell.exe
312	WAlletsd.exe
312	WAlletsd.exe
2808	powershell.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
312	WAlletsd.exe
1552	powershell.exe
2620	powershell.exe
2676	powershell.exe
2388	powershell.exe
1808	discord.exe
2720	updater.exe
2720	updater.exe
1052	powershell.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2720	updater.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe
2820	explorer.exe

Suspicious use of AdjustPrivilegeToken 25 IoCs

Processes:

GoogleUpdateCore.exeGoogleUpdateCore.exediscord.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeGoogleUpdateCore.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exeupdater.exeexplorer.exe

description	pid	process
Token: SeDebugPrivilege	2976	GoogleUpdateCore.exe
Token: SeDebugPrivilege	2980	GoogleUpdateCore.exe
Token: SeDebugPrivilege	1808	discord.exe
Token: SeDebugPrivilege	2364	powershell.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	1304	powershell.exe
Token: SeDebugPrivilege	2808	powershell.exe
Token: SeShutdownPrivilege	3000	powercfg.exe
Token: SeShutdownPrivilege	2232	powercfg.exe
Token: SeShutdownPrivilege	2900	powercfg.exe
Token: SeShutdownPrivilege	1268	powercfg.exe
Token: SeDebugPrivilege	2124	GoogleUpdateCore.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	1808	discord.exe
Token: SeDebugPrivilege	1052	powershell.exe
Token: SeShutdownPrivilege	2688	powercfg.exe
Token: SeShutdownPrivilege	1384	powercfg.exe
Token: SeShutdownPrivilege	2200	powercfg.exe
Token: SeShutdownPrivilege	2384	powercfg.exe
Token: SeDebugPrivilege	2720	updater.exe
Token: SeLockMemoryPrivilege	2820	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

discord.exe

pid process

1808 discord.exe

pid	process
1808	discord.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Vapev41.exeVapeV4.exeVape Updated.exeVape.exeGoogleUpdateCore.execmd.execmd.exe

description	pid	process	target process
PID 1396 wrote to memory of 2976	1396	Vapev41.exe	GoogleUpdateCore.exe
PID 1396 wrote to memory of 2976	1396	Vapev41.exe	GoogleUpdateCore.exe
PID 1396 wrote to memory of 2976	1396	Vapev41.exe	GoogleUpdateCore.exe
PID 1396 wrote to memory of 2564	1396	Vapev41.exe	VapeV4.exe
PID 1396 wrote to memory of 2564	1396	Vapev41.exe	VapeV4.exe
PID 1396 wrote to memory of 2564	1396	Vapev41.exe	VapeV4.exe
PID 2564 wrote to memory of 2980	2564	VapeV4.exe	GoogleUpdateCore.exe
PID 2564 wrote to memory of 2980	2564	VapeV4.exe	GoogleUpdateCore.exe
PID 2564 wrote to memory of 2980	2564	VapeV4.exe	GoogleUpdateCore.exe
PID 2564 wrote to memory of 2772	2564	VapeV4.exe	Vape Updated.exe
PID 2564 wrote to memory of 2772	2564	VapeV4.exe	Vape Updated.exe
PID 2564 wrote to memory of 2772	2564	VapeV4.exe	Vape Updated.exe
PID 2772 wrote to memory of 2456	2772	Vape Updated.exe	Vape.exe
PID 2772 wrote to memory of 2456	2772	Vape Updated.exe	Vape.exe
PID 2772 wrote to memory of 2456	2772	Vape Updated.exe	Vape.exe
PID 2456 wrote to memory of 1664	2456	Vape.exe	Vape.exe
PID 2456 wrote to memory of 1664	2456	Vape.exe	Vape.exe
PID 2456 wrote to memory of 1664	2456	Vape.exe	Vape.exe
PID 2772 wrote to memory of 312	2772	Vape Updated.exe	WAlletsd.exe
PID 2772 wrote to memory of 312	2772	Vape Updated.exe	WAlletsd.exe
PID 2772 wrote to memory of 312	2772	Vape Updated.exe	WAlletsd.exe
PID 2772 wrote to memory of 1808	2772	Vape Updated.exe	discord.exe
PID 2772 wrote to memory of 1808	2772	Vape Updated.exe	discord.exe
PID 2772 wrote to memory of 1808	2772	Vape Updated.exe	discord.exe
PID 2976 wrote to memory of 2364	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 2364	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 2364	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 864	2976	GoogleUpdateCore.exe	conhost.exe
PID 2976 wrote to memory of 864	2976	GoogleUpdateCore.exe	conhost.exe
PID 2976 wrote to memory of 864	2976	GoogleUpdateCore.exe	conhost.exe
PID 2976 wrote to memory of 588	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 588	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 588	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 1304	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 1304	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 1304	2976	GoogleUpdateCore.exe	powershell.exe
PID 2976 wrote to memory of 1788	2976	GoogleUpdateCore.exe	schtasks.exe
PID 2976 wrote to memory of 1788	2976	GoogleUpdateCore.exe	schtasks.exe
PID 2976 wrote to memory of 1788	2976	GoogleUpdateCore.exe	schtasks.exe
PID 1724 wrote to memory of 2944	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2944	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2944	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 1216	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 1216	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 1216	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2032	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2032	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2032	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2384	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2384	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 2384	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 1396	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 1396	1724	cmd.exe	sc.exe
PID 1724 wrote to memory of 1396	1724	cmd.exe	sc.exe
PID 2788 wrote to memory of 3000	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 3000	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 3000	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 2232	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 2232	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 2232	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 2900	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 2900	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 2900	2788	cmd.exe	powercfg.exe
PID 2788 wrote to memory of 1268	2788	cmd.exe	powercfg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1204
- C:\Users\Admin\AppData\Local\Temp\Vapev41.exe
  "C:\Users\Admin\AppData\Local\Temp\Vapev41.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe
    "C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2976
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2364
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'GoogleUpdateCore.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:588
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'GoogleUpdateCore.exe'
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1304
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "GoogleUpdateCore" /tr "C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe"
      4⤵
      Creates scheduled task(s)
      PID:1788
- - C:\Users\Admin\AppData\Roaming\VapeV4.exe
    "C:\Users\Admin\AppData\Roaming\VapeV4.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe
      "C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Users\Admin\AppData\Roaming\Vape Updated.exe
      "C:\Users\Admin\AppData\Roaming\Vape Updated.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2772
    - - C:\Users\Admin\AppData\Roaming\Vape.exe
        
        "C:\Users\Admin\AppData\Roaming\Vape.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2456
      - C:\Users\Admin\AppData\Roaming\Vape.exe
        
        "C:\Users\Admin\AppData\Roaming\Vape.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1664
    - - C:\Users\Admin\AppData\Roaming\WAlletsd.exe
        
        "C:\Users\Admin\AppData\Roaming\WAlletsd.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:312
    - - C:\Users\Admin\AppData\Roaming\discord.exe
        
        "C:\Users\Admin\AppData\Roaming\discord.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1808
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\discord.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2676
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'discord.exe'
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
      - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "discord" /tr "C:\Users\Admin\AppData\Roaming\discord.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:2008
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2808
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:2944
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1216
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2032
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2384
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:1396
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2232
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2900
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1268
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /delete /f /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2652
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Users\Admin\AppData\Local\Temp\aocmbbfhjple.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2512
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1596
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3020
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:764
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:892
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:1512
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2348
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1580
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2688
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1384
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2384
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /create /f /ru "System" /tn "GoogleUpdateTaskMachineQC" /xml "C:\Windows\TEMP\aocmbbfhjple.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2640
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1396
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2820

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Windows\system32\taskeng.exe
taskeng.exe {A2DBB6A2-4C48-481E-810E-086816A605BB} S-1-5-21-3452737119-3959686427-228443150-1000:QGTQZTRE\Admin:Interactive:[1]
1⤵
PID:560
- C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe
  C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2124

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "648893526183853635-1372143411-810111606321519331-11386485561466702283695127162"
1⤵
PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_MEI24562\api-ms-win-core-file-l1-2-0.dll

Filesize
13KB

MD5
91b877c23410ec502370a01c2eb8fc2d

SHA1
3c1010bb30a44d6d90b48e805fa9d262276f2a0f

SHA256
781fb13ae016dd617a31b1708ab64dd752cc6f2932b704edd3c7d018793b3488

SHA512
4bca29792dec27d58405d843ed5317e2c5ac99dac3609b81c22ea440bc439bdac6890516240289b76388019016720eecda25d2d67252bdf258591698e582202e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24562\api-ms-win-core-file-l2-1-0.dll

Filesize
13KB

MD5
6a7b2af696d0667b300e845c5f8098bf

SHA1
e2ec9288876b84e718779d56f333e62d4f56e88f

SHA256
652c0ed643003e4e490ec4006bb5a48bfea524284e0612f96bb89798be2beea0

SHA512
eb4be12d3220145b8baafaa8e0440d0445cf84836663e44d25c7e1f2b9586ba4b3ed22adcd3e112084d755bfd735a67a4adf24952dfe0729cc2a6ee80b70ac64

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24562\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
13KB

MD5
1da02ca8bba888b9b7794ff1ac23feae

SHA1
dc2ed63c40154479110a2369fd3bcaf800ed6bcc

SHA256
1bfc0b612e1077378642a5ef77b3f7542cbfc0fd1ac71deee490b1a8743df342

SHA512
1618781b50766c088b6f6c6eec7fa07df4825ef27489df27c6b53454fb64414aae4bb43469f7a7f5e42ec436ce374b81e4355d0ee8bdc655ebf4b162f05a2df9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24562\api-ms-win-core-timezone-l1-1-0.dll

Filesize
13KB

MD5
1061d9cde3bf86524e8663279fe8e839

SHA1
a7ab3c602ecf3ca5380773c3b6e40d8089f64704

SHA256
4b6b0101347a394d25dba3bcb17a704e27034071276de69ae6de8238d7bb5d76

SHA512
5a610cfd1ec9ce69684840c56531b5b4714e65c6d744222a38e169c3ef336564ef35d66288dc922681430e1ce22c39aca51f6cecb850c16a7cecb24809c41dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24562\python311.dll

Filesize
1.6MB

MD5
5f6fd64ec2d7d73ae49c34dd12cedb23

SHA1
c6e0385a868f3153a6e8879527749db52dce4125

SHA256
ff9f102264d1944fbfae2ba70e7a71435f51a3e8c677fd970b621c4c9ea71967

SHA512
c4be2d042c6e4d22e46eacfd550f61b8f55814bfe41d216a4df48382247df70bc63151068513855aa78f9b3d2f10ba6a824312948324c92de6dd0f6af414e8ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI24562\ucrtbase.dll

Filesize
987KB

MD5
7dbabe7756944f6c3d402e97ff900499

SHA1
a562a5c60bf39cad84f11cafec0c5c3b09c56689

SHA256
616d70b2d1518408eb17c610e459ff75d4738ade33a5879667463f08677c1d55

SHA512
a65c555fe917cf91f69781ec89269a35ae9d3b406cebdf207e27e353b5246c3d9bd25d1a8b1664140e61bd4e2aa882d196fd2a6f9073f9b7ac3a8246a953eca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\aocmbbfhjple.xml

Filesize
1KB

MD5
546d67a48ff2bf7682cea9fac07b942e

SHA1
a2cb3a9a97fd935b5e62d4c29b3e2c5ab7d5fc90

SHA256
eff7edc19e6c430aaeca7ea8a77251c74d1e9abb79b183a9ee1f58c2934b4b6a

SHA512
10d90edf31c0955bcec52219d854952fd38768bd97e8e50d32a1237bccaf1a5eb9f824da0f81a7812e0ce62c0464168dd0201d1c0eb61b9fe253fe7c89de05fe

Download Submit
C:\Users\Admin\AppData\Roaming\GoogleUpdateCore.exe

Filesize
73KB

MD5
2a03cc379e8f31e0fb2f4669c1b9c2c0

SHA1
59b8d7736a84ff2a185483d9c75f8dd1d6b4ed2e

SHA256
d21522ca5d8dec817094e7d60e8dc56c7906a3d79dba9fefd2473921900536f0

SHA512
f2a35d353a323dac337fd6da744c8e3468af1c24c03dd61cfdd9f51e63c95d352005532093ae99bea4effb677bd9028bf779ed6f86219de372f4d342f68fd0ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\BZZMFLGQZN7WCMD578QR.temp

Filesize
7KB

MD5
f19894a20521d62a7714c539a0dcad7f

SHA1
fc91ab7cc508f028d3dca3e5ea52f057e672c73e

SHA256
bf4e8ee8187e5dbd15518263013dc16c9f5856eccc57e81507aa66fea8e64191

SHA512
472ae773e08c34fc2c237bf90a7a75ec000030f22883cb98d657aade0140e250ac2926bbff3ddcadaaeb1aa937f48330f15bd6f9fa89c030e5762e1f70266885

Download Submit
C:\Users\Admin\AppData\Roaming\Vape Updated.exe

Filesize
35.8MB

MD5
e322dbd089090cad02ad4906ba8a5356

SHA1
d92efd01d71fa0cf9a8686a73451f9daff27c501

SHA256
e663841436f17e129953713cb424ab81aa938fe665918447d36238ff343ed589

SHA512
1b09c2c65c7d84669d464e8c6036f29cee23c47b8f1371ce449277f21f27c751dcd34ac94f64f58d9e4e59fa37e276b8c41e7d827b421ef9ea4536bb8cbce66f

Download Submit
C:\Users\Admin\AppData\Roaming\VapeV4.exe

Filesize
35.9MB

MD5
ba485001338d6de9fa22f48b35d5ae3f

SHA1
463827aa0747220e3580aa7253188ab5c820e2c2

SHA256
b544f8c440fdec72dee17093cb1bba576ca9508928e807017cbba30a14c54722

SHA512
29675e1b5084fbce792d20260121e6d9284c0cc5005f83b111fb9104f050a86d274c215fdeb9cfd928464c3949b3842741c8ff7831970749fb03ef9591e084aa

Download Submit
C:\Users\Admin\AppData\Roaming\WAlletsd.exe

Filesize
9.6MB

MD5
8d36f5e077cdae092a45078d84897031

SHA1
32b94790f988c031ac06db18fd9bf9e90c6d9a2e

SHA256
164bff0c7dfda91f8fb38b8d77e90de002678adaeb17419f48366097fcd8d54e

SHA512
83b0f60134b6598e52ecad8540f0d316d3a2b300b3ade0968c5bdef782ed134300bec991e4280692cf7c89e40ac93a802b234113bc5c991dd8436c1caa1d0545

Download Submit
C:\Users\Admin\AppData\Roaming\discord.exe

Filesize
90KB

MD5
4aac4a3a51dc946c49fe38f142539308

SHA1
4e7e7e993e092d8ad0fbe4852ccb116abda8b3a0

SHA256
a69841a608fc2a280d501c4e42ae6c6ce7a2cd5bd0db480dcce9df89a78f739e

SHA512
80b72a86aea8e0583d336cdbf50ce883053b624d8bb7ee4db2224625ebddd9a5acc32ac03976891eff56dd1e62151d41fbfe7b594110b0601f2db05c2f8a1d59

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
3e9af076957c5b2f9c9ce5ec994bea05

SHA1
a8c7326f6bceffaeed1c2bb8d7165e56497965fe

SHA256
e332ebfed27e0bb08b84dfda05acc7f0fa1b6281678e0120c5b7c893a75df47e

SHA512
933ba0d69e7b78537348c0dc1bf83fb069f98bb93d31c638dc79c4a48d12d879c474bd61e3cbde44622baef5e20fb92ebf16c66128672e4a6d4ee20afbf9d01f

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\_MEI24562\api-ms-win-core-localization-l1-2-0.dll

Filesize
15KB

MD5
ece78df965683c25525b14090de0a817

SHA1
4a112e96ecedaf54acceda967ab251ce2600253c

SHA256
61e8ec2f0bbf78a20aab1b335d20950ad0cc26b614ae0b1b6d0042da60e457cc

SHA512
f1f5b174d1beca816b3dafae9dc9605d869d6a826441802cef876f74043371a6af42590f3ec21058276ac745eb3652712eda74089cc4a04fecb3a3043cb30cbb

Download Submit
\Users\Admin\AppData\Roaming\Vape.exe

Filesize
26.2MB

MD5
791c3bf66c8a105074b9fc0661900fae

SHA1
4f14127b9b75eedff2ca01a6802cdab0135f6824

SHA256
d106a7d59ca96b1ab6453779b4c776a8a1eb50c18301cfea74d8dffc58918ce4

SHA512
b20b2960249c9e0104156daaa214ca2455bff03106081d85eee6f98962ce1e08d80198174ac8ca4e5afa1260b1cacdb7f895f453af20b9b4fd7230f91bcacb51

Download Submit
memory/312-181-0x000000013FDF0000-0x0000000140786000-memory.dmp

Filesize
9.6MB

Download
memory/312-200-0x000000013FDF0000-0x0000000140786000-memory.dmp

Filesize
9.6MB

Download
memory/588-159-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/588-163-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/588-162-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/588-161-0x0000000002BC0000-0x0000000002C40000-memory.dmp

Filesize
512KB

Download
memory/588-160-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/588-164-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/588-157-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/864-148-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Filesize
512KB

Download
memory/864-141-0x000000001B760000-0x000000001BA42000-memory.dmp

Filesize
2.9MB

Download
memory/864-150-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/864-146-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/864-149-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Filesize
512KB

Download
memory/864-147-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Filesize
512KB

Download
memory/864-144-0x0000000002C40000-0x0000000002CC0000-memory.dmp

Filesize
512KB

Download
memory/864-142-0x0000000001E80000-0x0000000001E88000-memory.dmp

Filesize
32KB

Download
memory/864-143-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1304-171-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1304-173-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1304-170-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1304-174-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1304-175-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1304-176-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1304-172-0x000007FEED900000-0x000007FEEE29D000-memory.dmp

Filesize
9.6MB

Download
memory/1396-0-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1396-1-0x00000000008E0000-0x0000000002CE6000-memory.dmp

Filesize
36.0MB

Download
memory/1396-327-0x0000000140000000-0x0000000140013000-memory.dmp

Filesize
76KB

Download
memory/1396-15-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1552-266-0x000000001B750000-0x000000001BA32000-memory.dmp

Filesize
2.9MB

Download
memory/1552-267-0x000007FEEC120000-0x000007FEECABD000-memory.dmp

Filesize
9.6MB

Download
memory/1664-119-0x000007FEF2260000-0x000007FEF2849000-memory.dmp

Filesize
5.9MB

Download
memory/1808-121-0x0000000000A20000-0x0000000000A3E000-memory.dmp

Filesize
120KB

Download
memory/1808-120-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/1808-194-0x000000001B2B0000-0x000000001B330000-memory.dmp

Filesize
512KB

Download
memory/1808-178-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-260-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2124-258-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2364-132-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2364-134-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2364-127-0x000000001B5C0000-0x000000001B8A2000-memory.dmp

Filesize
2.9MB

Download
memory/2364-135-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2364-129-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2364-128-0x00000000026E0000-0x00000000026E8000-memory.dmp

Filesize
32KB

Download
memory/2364-130-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2364-133-0x000007FEEE2A0000-0x000007FEEEC3D000-memory.dmp

Filesize
9.6MB

Download
memory/2364-131-0x00000000029A0000-0x0000000002A20000-memory.dmp

Filesize
512KB

Download
memory/2564-14-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2564-16-0x0000000000850000-0x0000000002C40000-memory.dmp

Filesize
35.9MB

Download
memory/2564-25-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2720-325-0x000000013FC70000-0x0000000140606000-memory.dmp

Filesize
9.6MB

Download
memory/2720-309-0x000000013FC70000-0x0000000140606000-memory.dmp

Filesize
9.6MB

Download
memory/2772-122-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2772-26-0x0000000000D80000-0x000000000315A000-memory.dmp

Filesize
35.9MB

Download
memory/2772-24-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2808-191-0x00000000021E0000-0x0000000002260000-memory.dmp

Filesize
512KB

Download
memory/2808-188-0x000007FEECAC0000-0x000007FEED45D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-193-0x000007FEECAC0000-0x000007FEED45D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-187-0x000000001B420000-0x000000001B702000-memory.dmp

Filesize
2.9MB

Download
memory/2808-190-0x000007FEECAC0000-0x000007FEED45D000-memory.dmp

Filesize
9.6MB

Download
memory/2808-192-0x00000000021E0000-0x0000000002260000-memory.dmp

Filesize
512KB

Download
memory/2808-189-0x00000000021E0000-0x0000000002260000-memory.dmp

Filesize
512KB

Download
memory/2820-326-0x0000000000140000-0x0000000000160000-memory.dmp

Filesize
128KB

Download
memory/2820-328-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2820-334-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2820-336-0x0000000140000000-0x0000000140840000-memory.dmp

Filesize
8.2MB

Download
memory/2976-158-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2976-259-0x0000000000490000-0x0000000000510000-memory.dmp

Filesize
512KB

Download
memory/2976-7-0x0000000000AF0000-0x0000000000B08000-memory.dmp

Filesize
96KB

Download
memory/2976-8-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2976-177-0x0000000000490000-0x0000000000510000-memory.dmp

Filesize
512KB

Download
memory/2980-18-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download
memory/2980-145-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

Filesize
9.9MB

Download