xmrig | deb7985a8f9a56f2dcbfdd4c5fa4732daad89ce82733818915f3a4e07c2d3b09

Analysis

max time kernel
76s
max time network
80s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Loader.exe
Size

26.4MB
MD5

aec49804a232eb45a7cf41e2dfef37fc
SHA1

5cedbd522c3c40305f6d656f57edf9b6a89d7e21
SHA256

deb7985a8f9a56f2dcbfdd4c5fa4732daad89ce82733818915f3a4e07c2d3b09
SHA512

ad9cf94db9a109e0f3a191169025c4f5ec86aca68937c373380dcb84c728b5817bf5e7bee8eea47b7cb82f5415234ab08a53f26030a5573d574477571f3a3d3d
SSDEEP

786432:pfjx8ZSLqcnnTNPefii+ydGI5mM3y9nEDQ:pfadJy9nQQ

Score

10^/10

xmrig discovery evasion execution miner persistence

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs

Processes:

aopgmSZGXsTIimKrjTMaIfatKbbgBE.exeChromeUpdater.exe

description	pid	process	target process
PID 4592 created 3560	4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe	Explorer.EXE
PID 4592 created 3560	4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe	Explorer.EXE
PID 4592 created 3560	4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe	Explorer.EXE
PID 4592 created 3560	4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe	Explorer.EXE
PID 1856 created 3560	1856	ChromeUpdater.exe	Explorer.EXE
PID 1856 created 3560	1856	ChromeUpdater.exe	Explorer.EXE
PID 1856 created 3560	1856	ChromeUpdater.exe	Explorer.EXE
PID 1856 created 3560	1856	ChromeUpdater.exe	Explorer.EXE

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Loader.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Loader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Loader.exe

XMRig Miner payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral1/memory/1856-176-0x00007FF733310000-0x00007FF733CDA000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4504 powershell.exe
1316 powershell.exe
3664 powershell.exe
972 powershell.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Loader.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Loader.exe

pid	process
4504	powershell.exe
1316	powershell.exe
3664	powershell.exe
972	powershell.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Loader.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\CceTvYrQni\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\CceTvYrQni"	mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Loader.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Loader.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Loader.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation Loader.exe
Executes dropped EXE 4 IoCs

Processes:

mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exeVpUVDJNswEnRmUvQWGMriKNspBFFvH.exeaopgmSZGXsTIimKrjTMaIfatKbbgBE.exeChromeUpdater.exe

pid process

764 mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe
4128 VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
4592 aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
1856 ChromeUpdater.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

18 pastebin.com
17 pastebin.com

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Loader.exe

pid	process
764	mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe
4128	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
1856	ChromeUpdater.exe

flow	ioc
18	pastebin.com
17	pastebin.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Loader.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Loader.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Loader.exe

Drops file in System32 directory 3 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

ChromeUpdater.exe

description	pid	process	target process
PID 1856 set thread context of 3556	1856	ChromeUpdater.exe	conhost.exe
PID 1856 set thread context of 116	1856	ChromeUpdater.exe	explorer.exe

Drops file in Program Files directory 2 IoCs

Processes:

aopgmSZGXsTIimKrjTMaIfatKbbgBE.exeChromeUpdater.exe

description	ioc	process
File created	C:\Program Files\Google\Chrome\ChromeUpdater.exe	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
File created	C:\Program Files\Google\Libs\WR64.sys	ChromeUpdater.exe

Drops file in Windows directory 7 IoCs

Processes:

Loader.exe

description	ioc	process
File opened for modification	C:\Windows\Cursors\xTwZJVruYVvrtpgihpKzqjKEwwiisU.exe	Loader.exe
File created	C:\Windows\SoftwareDistribution\Download\nAXnuxFHBpFEQyySSMkcUVFDOIrcNm.sys	Loader.exe
File opened for modification	C:\Windows\SoftwareDistribution\Download\nAXnuxFHBpFEQyySSMkcUVFDOIrcNm.sys	Loader.exe
File created	C:\Windows\SoftwareDistribution\Download\aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe	Loader.exe
File created	C:\Windows\Cursors\nIqbMeBTFSkOueRWgzcluqMHtTJKfF.sys	Loader.exe
File opened for modification	C:\Windows\Cursors\nIqbMeBTFSkOueRWgzcluqMHtTJKfF.sys	Loader.exe
File created	C:\Windows\Cursors\xTwZJVruYVvrtpgihpKzqjKEwwiisU.exe	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2868 4128 WerFault.exe VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe

pid	pid_target	process	target process
2868	4128	WerFault.exe	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe

Modifies registry class 1 IoCs

Processes:

taskmgr.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings taskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

Loader.exeVpUVDJNswEnRmUvQWGMriKNspBFFvH.exeaopgmSZGXsTIimKrjTMaIfatKbbgBE.exepowershell.exepowershell.exetaskmgr.exeChromeUpdater.exepowershell.exepowershell.exeexplorer.exe

pid	process
1752	Loader.exe
1752	Loader.exe
4128	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
4504	powershell.exe
4504	powershell.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
3664	powershell.exe
3664	powershell.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
4592	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1856	ChromeUpdater.exe
1856	ChromeUpdater.exe
1316	powershell.exe
1316	powershell.exe
1500	taskmgr.exe
1500	taskmgr.exe
1856	ChromeUpdater.exe
1856	ChromeUpdater.exe
972	powershell.exe
972	powershell.exe
1500	taskmgr.exe
1500	taskmgr.exe
1856	ChromeUpdater.exe
1856	ChromeUpdater.exe
1856	ChromeUpdater.exe
1856	ChromeUpdater.exe
1500	taskmgr.exe
116	explorer.exe
116	explorer.exe
1500	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe

pid process

764 mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe

pid	process
764	mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Loader.exemgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exeVpUVDJNswEnRmUvQWGMriKNspBFFvH.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1752	Loader.exe
Token: SeLoadDriverPrivilege	764	mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe
Token: SeDebugPrivilege	4128	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeIncreaseQuotaPrivilege	3664	powershell.exe
Token: SeSecurityPrivilege	3664	powershell.exe
Token: SeTakeOwnershipPrivilege	3664	powershell.exe
Token: SeLoadDriverPrivilege	3664	powershell.exe
Token: SeSystemProfilePrivilege	3664	powershell.exe
Token: SeSystemtimePrivilege	3664	powershell.exe
Token: SeProfSingleProcessPrivilege	3664	powershell.exe
Token: SeIncBasePriorityPrivilege	3664	powershell.exe
Token: SeCreatePagefilePrivilege	3664	powershell.exe
Token: SeBackupPrivilege	3664	powershell.exe
Token: SeRestorePrivilege	3664	powershell.exe
Token: SeShutdownPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeSystemEnvironmentPrivilege	3664	powershell.exe
Token: SeRemoteShutdownPrivilege	3664	powershell.exe
Token: SeUndockPrivilege	3664	powershell.exe
Token: SeManageVolumePrivilege	3664	powershell.exe
Token: 33	3664	powershell.exe
Token: 34	3664	powershell.exe
Token: 35	3664	powershell.exe
Token: 36	3664	powershell.exe
Token: SeIncreaseQuotaPrivilege	3664	powershell.exe
Token: SeSecurityPrivilege	3664	powershell.exe
Token: SeTakeOwnershipPrivilege	3664	powershell.exe
Token: SeLoadDriverPrivilege	3664	powershell.exe
Token: SeSystemProfilePrivilege	3664	powershell.exe
Token: SeSystemtimePrivilege	3664	powershell.exe
Token: SeProfSingleProcessPrivilege	3664	powershell.exe
Token: SeIncBasePriorityPrivilege	3664	powershell.exe
Token: SeCreatePagefilePrivilege	3664	powershell.exe
Token: SeBackupPrivilege	3664	powershell.exe
Token: SeRestorePrivilege	3664	powershell.exe
Token: SeShutdownPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeSystemEnvironmentPrivilege	3664	powershell.exe
Token: SeRemoteShutdownPrivilege	3664	powershell.exe
Token: SeUndockPrivilege	3664	powershell.exe
Token: SeManageVolumePrivilege	3664	powershell.exe
Token: 33	3664	powershell.exe
Token: 34	3664	powershell.exe
Token: 35	3664	powershell.exe
Token: 36	3664	powershell.exe
Token: SeIncreaseQuotaPrivilege	3664	powershell.exe
Token: SeSecurityPrivilege	3664	powershell.exe
Token: SeTakeOwnershipPrivilege	3664	powershell.exe
Token: SeLoadDriverPrivilege	3664	powershell.exe
Token: SeSystemProfilePrivilege	3664	powershell.exe
Token: SeSystemtimePrivilege	3664	powershell.exe
Token: SeProfSingleProcessPrivilege	3664	powershell.exe
Token: SeIncBasePriorityPrivilege	3664	powershell.exe
Token: SeCreatePagefilePrivilege	3664	powershell.exe
Token: SeBackupPrivilege	3664	powershell.exe
Token: SeRestorePrivilege	3664	powershell.exe
Token: SeShutdownPrivilege	3664	powershell.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeSystemEnvironmentPrivilege	3664	powershell.exe
Token: SeRemoteShutdownPrivilege	3664	powershell.exe
Token: SeUndockPrivilege	3664	powershell.exe
Token: SeManageVolumePrivilege	3664	powershell.exe

Suspicious use of FindShellTrayWindow 43 IoCs

Processes:

taskmgr.exe

pid	process
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe

Suspicious use of SendNotifyMessage 43 IoCs

Processes:

taskmgr.exe

pid	process
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe
1500	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Loader.exe

pid process

1752 Loader.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

Loader.execmd.exeChromeUpdater.exe

description	pid	process	target process
PID 1752 wrote to memory of 764	1752	Loader.exe	mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe
PID 1752 wrote to memory of 764	1752	Loader.exe	mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe
PID 1752 wrote to memory of 4128	1752	Loader.exe	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
PID 1752 wrote to memory of 4128	1752	Loader.exe	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
PID 1752 wrote to memory of 4128	1752	Loader.exe	VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
PID 1752 wrote to memory of 4592	1752	Loader.exe	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
PID 1752 wrote to memory of 4592	1752	Loader.exe	aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
PID 4188 wrote to memory of 4420	4188	cmd.exe	choice.exe
PID 4188 wrote to memory of 4420	4188	cmd.exe	choice.exe
PID 1856 wrote to memory of 3556	1856	ChromeUpdater.exe	conhost.exe
PID 1856 wrote to memory of 116	1856	ChromeUpdater.exe	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3560
- C:\Users\Admin\AppData\Local\Temp\Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\Loader.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Checks computer location settings
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Users\Admin\AppData\Local\Microsoft\mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe
    "C:\Users\Admin\AppData\Local\Microsoft\mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe" C:\Windows\temp\RgJUYFHSFSBcmvKhGMFnZceDOdxOrR.sys
    3⤵
    - Sets service image path in registry
    - Executes dropped EXE
    - Suspicious behavior: LoadsDriver
    - Suspicious use of AdjustPrivilegeToken
    PID:764
- - C:\Users\Admin\AppData\LocalLow\Microsoft\VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe
    "C:\Users\Admin\AppData\LocalLow\Microsoft\VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4128
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 1084
      4⤵
      Program crash
      PID:2868
- - C:\Windows\SoftwareDistribution\Download\aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe
    "C:\Windows\SoftwareDistribution\Download\aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gdqir#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'ChromeUpdater' /tr '''C:\Program Files\Google\Chrome\ChromeUpdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ChromeUpdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ChromeUpdater' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3664
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "ChromeUpdater"
  2⤵
  PID:2824
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Windows\SoftwareDistribution\Download\aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\System32\choice.exe
    choice /C Y /N /D Y /T 3
    3⤵
    PID:4420
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#gdqir#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'ChromeUpdater' /tr '''C:\Program Files\Google\Chrome\ChromeUpdater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\ChromeUpdater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'ChromeUpdater' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:3556
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4128 -ip 4128
1⤵
PID:1224

C:\Program Files\Google\Chrome\ChromeUpdater.exe
"C:\Program Files\Google\Chrome\ChromeUpdater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\VpUVDJNswEnRmUvQWGMriKNspBFFvH.exe

Filesize
595KB

MD5
69b8138d0e9dd6b169043520330bceac

SHA1
aabe9458e1751623e727fb775e923103a02afe7a

SHA256
01825f4cb340163af8d9f803a31dc20c1e33404ced73e17dbf74896d7ec1c34b

SHA512
fa135dfec349bc9a3fd8348b2a60352a01ef27d73505550291953b2274994aff88a614fd225b97c2824fa05e91580ac7dd2292065a99514d17f731c0711574d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
62623d22bd9e037191765d5083ce16a3

SHA1
4a07da6872672f715a4780513d95ed8ddeefd259

SHA256
95d79fd575bbd21540e378fcbc1cd00d16f51af62ce15bae7080bb72c24e2010

SHA512
9a448b7a0d867466c2ea04ab84d2a9485d5fd20ab53b2b854f491831ee3f1d781b94d2635f7b0b35cb9f2d373cd52c67570879a56a42ed66bc9db06962ed4992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\mgPflPXkqmnkSiRBMFXEWXDRQuxvPB.exe

Filesize
133KB

MD5
b789be46d520694943db87140ba6edb6

SHA1
3cc6c4ac64112a771ccd3235e313dcfcdc7a78d9

SHA256
a6195edcc520035e9baf76f120fa62909ccea148a3a4596d81cda06e08fef962

SHA512
648d70c844d4425c5a83882836ea65067e54eed181d355e950a267da5ad92343ef08a4cb4eccfe45aa8561be94ac686807c867d0e0cb438ddf5988e502923d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hncxwnxl.x0k.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Cursors\xTwZJVruYVvrtpgihpKzqjKEwwiisU.exe

Filesize
201KB

MD5
d4f11c9a6a07f2a9ec69bc367b9243be

SHA1
63a5efac9bee6e1fd7de45fe10b5768c8fd9e382

SHA256
0dcf580f5f74465642419ae9f8c56ea2cb4116d8d2c37f4ee4e3dcd45c50f1f0

SHA512
14d061b2b6b486f0294c2228dd5badfbcd3296be59777449239201bcf3095b0c89eafe9e88683b1c924022ee795aee8e5b6483046a08d824f74d1061aa7846e0

Download Submit
C:\Windows\SoftwareDistribution\Download\aopgmSZGXsTIimKrjTMaIfatKbbgBE.exe

Filesize
9.8MB

MD5
f0d66591cc208003b04be406c2ea8420

SHA1
06458ca23059df3117666cb4a64dc2e26f9daf97

SHA256
927f00ec370ff3aa74cb58bcd118e6198f1945fe7691f8f73f3feaa046dcfb5d

SHA512
cf67d6eaac9bc848297df4b4f67ff6ef606161b1e9198af6a7f5430a240ca261503c23bb2c15b386a1b421181a399531a3735739a2b860beb18f5e8ea5c01c6a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
bdb25c22d14ec917e30faf353826c5de

SHA1
6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

SHA256
e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

SHA512
b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b42c70c1dbf0d1d477ec86902db9e986

SHA1
1d1c0a670748b3d10bee8272e5d67a4fabefd31f

SHA256
8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

SHA512
57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

Download Submit
memory/116-177-0x00000000014B0000-0x00000000014D0000-memory.dmp

Filesize
128KB

Download
memory/1316-145-0x000001F09E5F0000-0x000001F09E5FA000-memory.dmp

Filesize
40KB

Download
memory/1316-142-0x000001F09E3F0000-0x000001F09E4A5000-memory.dmp

Filesize
724KB

Download
memory/1316-141-0x000001F09E3D0000-0x000001F09E3EC000-memory.dmp

Filesize
112KB

Download
memory/1316-143-0x000001F0853C0000-0x000001F0853CA000-memory.dmp

Filesize
40KB

Download
memory/1316-144-0x000001F09E610000-0x000001F09E62C000-memory.dmp

Filesize
112KB

Download
memory/1316-146-0x000001F09E650000-0x000001F09E66A000-memory.dmp

Filesize
104KB

Download
memory/1316-147-0x000001F09E600000-0x000001F09E608000-memory.dmp

Filesize
32KB

Download
memory/1316-148-0x000001F09E630000-0x000001F09E636000-memory.dmp

Filesize
24KB

Download
memory/1316-149-0x000001F09E640000-0x000001F09E64A000-memory.dmp

Filesize
40KB

Download
memory/1500-117-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-109-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-115-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-116-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-118-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-119-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-120-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-121-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-110-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1500-111-0x000001119EFF0000-0x000001119EFF1000-memory.dmp

Filesize
4KB

Download
memory/1752-15-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-7-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-14-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-13-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-1-0x000002BFA5DE0000-0x000002BFA784A000-memory.dmp

Filesize
26.4MB

Download
memory/1752-107-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-46-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-2-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-16-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-3-0x000002BFC29F0000-0x000002BFC2B3E000-memory.dmp

Filesize
1.3MB

Download
memory/1752-4-0x000002BFC2BE0000-0x000002BFC2FB6000-memory.dmp

Filesize
3.8MB

Download
memory/1752-5-0x000002BFA7CA0000-0x000002BFA7CB4000-memory.dmp

Filesize
80KB

Download
memory/1752-6-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-0-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/1752-8-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-9-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-10-0x00007FFC53833000-0x00007FFC53835000-memory.dmp

Filesize
8KB

Download
memory/1752-12-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1752-11-0x00007FFC53830000-0x00007FFC542F1000-memory.dmp

Filesize
10.8MB

Download
memory/1856-122-0x00007FF733310000-0x00007FF733CDA000-memory.dmp

Filesize
9.8MB

Download
memory/1856-176-0x00007FF733310000-0x00007FF733CDA000-memory.dmp

Filesize
9.8MB

Download
memory/4128-48-0x00000000750AE000-0x00000000750AF000-memory.dmp

Filesize
4KB

Download
memory/4128-49-0x00000000003E0000-0x0000000000482000-memory.dmp

Filesize
648KB

Download
memory/4128-50-0x0000000004D90000-0x0000000004D9C000-memory.dmp

Filesize
48KB

Download
memory/4128-51-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/4128-52-0x0000000005590000-0x0000000005B34000-memory.dmp

Filesize
5.6MB

Download
memory/4128-53-0x00000000750A0000-0x0000000075850000-memory.dmp

Filesize
7.7MB

Download
memory/4504-83-0x00000133791A0000-0x00000133791C2000-memory.dmp

Filesize
136KB

Download
memory/4592-77-0x00007FF78BCA0000-0x00007FF78C66A000-memory.dmp

Filesize
9.8MB

Download
memory/4592-104-0x00007FF78BCA0000-0x00007FF78C66A000-memory.dmp

Filesize
9.8MB

Download