neshta | c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31

Analysis

max time kernel
91s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2022 11:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
Size

1.5MB
MD5

0a9b435e956bfdde213943ece43e96e0
SHA1

6103632e4984d40d37fb663fd813275afbd62871
SHA256

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31
SHA512

25a192a992b2d81f10ae8349dd6abd8fbc6ce88ef95f813fbb8309ef68e1a47412ac6f3b192a29f910756210358084e50dbebf0912c04b8eee2392c685ecd534
SSDEEP

24576:x0fTYgB8JTFhrylf/gv/iqWL6xTuH84z+i7vzCTogVbPmcC:x0fTxB8JTFhIgv/isxTuHJCTog1mcC

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 2 IoCs

Processes:

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exeGoogleToolbarNotifier.exe

pid process

2028 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
2232 GoogleToolbarNotifier.exe

pid	process
2028	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
2232	GoogleToolbarNotifier.exe

Registers COM server for autorun 1 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32\ = "C:\\Program Files\\Google\\GoogleToolbarNotifier\\5.12.11510.1228\\swg64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32	regsvr32.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

Loads dropped DLL 3 IoCs

Processes:

GoogleToolbarNotifier.exeregsvr32.exe

pid process

2232 GoogleToolbarNotifier.exe
2232 GoogleToolbarNotifier.exe
4540 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2232	GoogleToolbarNotifier.exe
2232	GoogleToolbarNotifier.exe
4540	regsvr32.exe

Drops file in Program Files directory 64 IoCs

Processes:

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exec30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\BHO\IE_TO_~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File created	C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\COOKIE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\ELEVAT~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File created	C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\Readme.url	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\Readme.url	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~2.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\INSTAL~1\setup.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File created	C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\IDENTI~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

Drops file in Windows directory 1 IoCs

Processes:

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

description ioc process

File opened for modification C:\Windows\svchost.com c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

GoogleToolbarNotifier.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppPath = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier"	GoogleToolbarNotifier.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\Policy = "3"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppName = "GoogleToolbarNotifier.exe"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppPath = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier"	GoogleToolbarNotifier.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\Policy = "3"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppName = "GoogleToolbarNotifier.exe"	GoogleToolbarNotifier.exe

Modifies registry class 64 IoCs

Processes:

GoogleToolbarNotifier.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ProtectorExe.ProtectorHost.1\CLSID\ = "{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID\ = "ProtectorExe.ProtectorHost"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ProtectorExe.EXE	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib\Version = "1a.0"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ = "IProtector8"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\TypeLib\Version = "1a.0"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib\Version = "1a.0"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ProtectorExe.ProtectorHost\CurVer\ = "ProtectorExe.ProtectorHost.1"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\ = "IProtector11"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\TypeLib\Version = "1a.0"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\ = "IProtectorLib7"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\protector_dll.DLL\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.Protector\CurVer\ = "protector_dll.Protector.1"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\""	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A97CA128-6998-4F8E-807E-8ED05FADAFB0}\RunAs = "Interactive User"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32\ThreadingModel = "Apartment"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.ProtectorLib\CurVer\ = "protector_dll.ProtectorLib.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ProgID	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\1a.0\HELPDIR\ = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\5.12.11510.1228"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\ = "IProtectorLib8"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}"	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\ = "IProtector"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\TypeLib	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\ProxyStubClsid32	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\ = "IProtectorLib4"	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}	GoogleToolbarNotifier.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9891812B-5820-4A77-827E-772B200239E1}\TypeLib	GoogleToolbarNotifier.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}"	GoogleToolbarNotifier.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exec30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exeGoogleToolbarNotifier.exe

description	pid	process	target process
PID 4788 wrote to memory of 2028	4788	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
PID 4788 wrote to memory of 2028	4788	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
PID 4788 wrote to memory of 2028	4788	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
PID 2028 wrote to memory of 2232	2028	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe	GoogleToolbarNotifier.exe
PID 2028 wrote to memory of 2232	2028	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe	GoogleToolbarNotifier.exe
PID 2028 wrote to memory of 2232	2028	c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe	GoogleToolbarNotifier.exe
PID 2232 wrote to memory of 4540	2232	GoogleToolbarNotifier.exe	regsvr32.exe
PID 2232 wrote to memory of 4540	2232	GoogleToolbarNotifier.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
"C:\Users\Admin\AppData\Local\Temp\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe"
1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2028

C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" /RegServer "/dll=C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll" "/swg64=C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\system32\regsvr32.exe
C:\Windows\system32\regsvr32.exe -s "C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll

Filesize
140KB

MD5
a2a751f1f440046769828c8f27f1885d

SHA1
c6594b688ea1cacf9ec867f5ad58c419e7440b9e

SHA256
91cb858f2a30cc23e25138d094a743206d765613c70b9a42e511caf32e8761a5

SHA512
1250e5d378f4766bf60463f81f7a732b66d94d45d613bac2825a985837a221fd54b6fe57344aeac74f4df9221c9f28a963d8d7c54e5442b3190841e1ff28523b

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll

Filesize
140KB

MD5
a2a751f1f440046769828c8f27f1885d

SHA1
c6594b688ea1cacf9ec867f5ad58c419e7440b9e

SHA256
91cb858f2a30cc23e25138d094a743206d765613c70b9a42e511caf32e8761a5

SHA512
1250e5d378f4766bf60463f81f7a732b66d94d45d613bac2825a985837a221fd54b6fe57344aeac74f4df9221c9f28a963d8d7c54e5442b3190841e1ff28523b

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll

Filesize
914KB

MD5
d0c4c5ba3a95ee1a03ab1584d3bd4583

SHA1
a5864868ecb704a1202454dd9d2421a31a891fa1

SHA256
c7f7d193f353462e4a544538591d9c41bc9262e57d6a77d4b2c134fac8134614

SHA512
f28189950afc12e60b526ff4b1528d3ab7a190564fea350e69475dd08114aabe38abc580568a26c867328c274fd3974a3b280a9b38067457bdb69f0e1fde973e

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll

Filesize
914KB

MD5
d0c4c5ba3a95ee1a03ab1584d3bd4583

SHA1
a5864868ecb704a1202454dd9d2421a31a891fa1

SHA256
c7f7d193f353462e4a544538591d9c41bc9262e57d6a77d4b2c134fac8134614

SHA512
f28189950afc12e60b526ff4b1528d3ab7a190564fea350e69475dd08114aabe38abc580568a26c867328c274fd3974a3b280a9b38067457bdb69f0e1fde973e

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Filesize
38KB

MD5
5d61be7db55b026a5d61a3eed09d0ead

SHA1
215950ce5d40907b041346f22b4e404ee591581d

SHA256
d32cc7b31a6f98c60abc313abc7d1143681f72de2bb2604711a0ba20710caaae

SHA512
b1dbb67867cbb36c322bd774bf01267f56e398e364ebce4bd6f67c225c330b0b1843b06397e55f7f04dcc8d75b039083ccf08313b0ed03ecff7eb00033b0a598

Download Submit
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

Filesize
38KB

MD5
5d61be7db55b026a5d61a3eed09d0ead

SHA1
215950ce5d40907b041346f22b4e404ee591581d

SHA256
d32cc7b31a6f98c60abc313abc7d1143681f72de2bb2604711a0ba20710caaae

SHA512
b1dbb67867cbb36c322bd774bf01267f56e398e364ebce4bd6f67c225c330b0b1843b06397e55f7f04dcc8d75b039083ccf08313b0ed03ecff7eb00033b0a598

Download Submit
C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll

Filesize
245KB

MD5
8790afb502a5638af9769ebc0f93868a

SHA1
465bacf4cfff60bd5de57743ce3c106716d45b04

SHA256
40ec2b0fe7b98182d572fb5a031a1c77f5620e269fbab86d2a5afcb4499915f7

SHA512
80ca30c91d0d4a93830881623d72c24908551457551be9d5782ed8f6624e54d71eaa61de8dae23c627dd361eb3d038c0258bbd739b5be70bc026f27ac380ee9d

Download Submit
C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll

Filesize
245KB

MD5
8790afb502a5638af9769ebc0f93868a

SHA1
465bacf4cfff60bd5de57743ce3c106716d45b04

SHA256
40ec2b0fe7b98182d572fb5a031a1c77f5620e269fbab86d2a5afcb4499915f7

SHA512
80ca30c91d0d4a93830881623d72c24908551457551be9d5782ed8f6624e54d71eaa61de8dae23c627dd361eb3d038c0258bbd739b5be70bc026f27ac380ee9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

Filesize
1.5MB

MD5
0ceed1d533cae0741d56d83ab5cb004f

SHA1
f3a812a68f40a7c4d0b2135c011f86126d337d4e

SHA256
99f24e71da17715d2d9aefec8f3a35b545918bc483c3a1e998940c562f53c830

SHA512
a63e3f837dd57d7cf40cf3dd54b5ecccd27624052d3e0850110dff01d22b649a7d475d651e6501bb83043370d349defabc9f28694e41b4ab19a741a995103149

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe

Filesize
1.5MB

MD5
0ceed1d533cae0741d56d83ab5cb004f

SHA1
f3a812a68f40a7c4d0b2135c011f86126d337d4e

SHA256
99f24e71da17715d2d9aefec8f3a35b545918bc483c3a1e998940c562f53c830

SHA512
a63e3f837dd57d7cf40cf3dd54b5ecccd27624052d3e0850110dff01d22b649a7d475d651e6501bb83043370d349defabc9f28694e41b4ab19a741a995103149

Download Submit
memory/2028-132-0x0000000000000000-mapping.dmp

Download
memory/2232-135-0x0000000000000000-mapping.dmp

Download
memory/4540-142-0x0000000000000000-mapping.dmp

Download