laplas | 7532b02e6159a99599dafed8f44f51f9a4e4a10ce4784311ffdd682053e29c12

Analysis

max time kernel
91s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-04-2023 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Setup.exe
Size

11.0MB
MD5

c0c44044d48102ffe57e0adc86b68a7e
SHA1

8d423d0ba235843be9671f08bfc6df032607f6c4
SHA256

7532b02e6159a99599dafed8f44f51f9a4e4a10ce4784311ffdd682053e29c12
SHA512

977a342eb1b5bc8a6d6f65e54bdf42f666cccc3467d04374e7493202c6160cb82df815c68642c0166ae82b69aac46cb94d75efa1e337e9ada727584c3ae9837e
SSDEEP

196608:4+hMmu0Vro/dFqg4cF3VjgY7lEGpDltGgC891SWAo0Gm:41m3OMEljl7lPftGgPuDrt

Score

10^/10

laplas vidar xmrig 49bd1304650cc9c7f3f131428d9e16c2 bootkit clipper discovery evasion miner persistence spyware stealer trojan

Malware Config

Extracted

Family

vidar

Version

3.3

Botnet

49bd1304650cc9c7f3f131428d9e16c2

https://steamcommunity.com/profiles/76561199492257783

https://t.me/justsometg

Attributes

profile_id_v2
49bd1304650cc9c7f3f131428d9e16c2
user_agent
Mozilla/5.0 (X11; Linux 3.5.4-1-ARCH i686; es) KHTML/4.9.1 (like Gecko) Konqueror/4.9

Extracted

Family

laplas

http://45.159.189.105

Attributes

api_key
6a2714906f1325d666e4cf9f6269c2352ccfb7e7f1a23c114287dc69ddf27cb0

Signatures

Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas

Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs

description	pid	Process	procid_target
PID 4416 created 2408	4416	23740942652137347770.exe	38
PID 4416 created 2408	4416	23740942652137347770.exe	38
PID 4416 created 2408	4416	23740942652137347770.exe	38
PID 4416 created 2408	4416	23740942652137347770.exe	38
PID 4416 created 2408	4416	23740942652137347770.exe	38

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Setup.exe

XMRig Miner payload 4 IoCs

miner

resource	yara_rule
behavioral2/memory/1684-482-0x00007FF7750D0000-0x00007FF775AB5000-memory.dmp	xmrig
behavioral2/memory/1144-486-0x00007FF7BC090000-0x00007FF7BC87F000-memory.dmp	xmrig
behavioral2/memory/1144-488-0x00007FF7BC090000-0x00007FF7BC87F000-memory.dmp	xmrig
behavioral2/memory/1144-490-0x00007FF7BC090000-0x00007FF7BC87F000-memory.dmp	xmrig

Downloads MZ/PE file

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	23740942652137347770.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Setup.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	06328958474430990439.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	06328958474430990439.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	svcservice.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	Setup.exe

Executes dropped EXE 6 IoCs

pid	Process
2692	48977722128863891795.exe
4500	06328958474430990439.exe
4416	23740942652137347770.exe
3404	06328958474430990439.exe
1684	updater.exe
1784	svcservice.exe

Loads dropped DLL 2 IoCs

pid	Process
1028	Setup.exe
1028	Setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telemetry = "C:\\Users\\Admin\\AppData\\Roaming\\telemetry\\svcservice.exe"	06328958474430990439.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Setup.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4104	Setup.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4104 set thread context of 1028	4104	Setup.exe	92
PID 4500 set thread context of 3404	4500	06328958474430990439.exe	106

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	23740942652137347770.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5060	sc.exe
4760	sc.exe
4768	sc.exe
2236	sc.exe
2624	sc.exe
760	sc.exe
4544	sc.exe
3960	sc.exe
1564	sc.exe
3884	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Setup.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4612	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4104	Setup.exe
4104	Setup.exe
3764	powershell.exe
3764	powershell.exe
1028	Setup.exe
1028	Setup.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4832	powershell.exe
4832	powershell.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe
4500	06328958474430990439.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeDebugPrivilege	4104	Setup.exe
Token: SeDebugPrivilege	4500	06328958474430990439.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	1300	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	4616	powercfg.exe
Token: SeCreatePagefilePrivilege	4616	powercfg.exe
Token: SeShutdownPrivilege	780	powercfg.exe
Token: SeCreatePagefilePrivilege	780	powercfg.exe
Token: SeShutdownPrivilege	1620	powercfg.exe
Token: SeCreatePagefilePrivilege	1620	powercfg.exe
Token: SeShutdownPrivilege	2304	powercfg.exe
Token: SeCreatePagefilePrivilege	2304	powercfg.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe
Token: SeCreatePagefilePrivilege	3216	powershell.exe
Token: SeBackupPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeSystemEnvironmentPrivilege	3216	powershell.exe
Token: SeRemoteShutdownPrivilege	3216	powershell.exe
Token: SeUndockPrivilege	3216	powershell.exe
Token: SeManageVolumePrivilege	3216	powershell.exe
Token: 33	3216	powershell.exe
Token: 34	3216	powershell.exe
Token: 35	3216	powershell.exe
Token: 36	3216	powershell.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe
Token: SeCreatePagefilePrivilege	3216	powershell.exe
Token: SeBackupPrivilege	3216	powershell.exe
Token: SeRestorePrivilege	3216	powershell.exe
Token: SeShutdownPrivilege	3216	powershell.exe
Token: SeDebugPrivilege	3216	powershell.exe
Token: SeSystemEnvironmentPrivilege	3216	powershell.exe
Token: SeRemoteShutdownPrivilege	3216	powershell.exe
Token: SeUndockPrivilege	3216	powershell.exe
Token: SeManageVolumePrivilege	3216	powershell.exe
Token: 33	3216	powershell.exe
Token: 34	3216	powershell.exe
Token: 35	3216	powershell.exe
Token: 36	3216	powershell.exe
Token: SeIncreaseQuotaPrivilege	3216	powershell.exe
Token: SeSecurityPrivilege	3216	powershell.exe
Token: SeTakeOwnershipPrivilege	3216	powershell.exe
Token: SeLoadDriverPrivilege	3216	powershell.exe
Token: SeSystemProfilePrivilege	3216	powershell.exe
Token: SeSystemtimePrivilege	3216	powershell.exe
Token: SeProfSingleProcessPrivilege	3216	powershell.exe
Token: SeIncBasePriorityPrivilege	3216	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 3764	4104	Setup.exe	87
PID 4104 wrote to memory of 3764	4104	Setup.exe	87
PID 4104 wrote to memory of 3764	4104	Setup.exe	87
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 4104 wrote to memory of 1028	4104	Setup.exe	92
PID 1028 wrote to memory of 2692	1028	Setup.exe	94
PID 1028 wrote to memory of 2692	1028	Setup.exe	94
PID 2692 wrote to memory of 4124	2692	48977722128863891795.exe	97
PID 2692 wrote to memory of 4124	2692	48977722128863891795.exe	97
PID 4124 wrote to memory of 5108	4124	cmd.exe	98
PID 4124 wrote to memory of 5108	4124	cmd.exe	98
PID 1028 wrote to memory of 4500	1028	Setup.exe	99
PID 1028 wrote to memory of 4500	1028	Setup.exe	99
PID 1028 wrote to memory of 4500	1028	Setup.exe	99
PID 4500 wrote to memory of 4832	4500	06328958474430990439.exe	100
PID 4500 wrote to memory of 4832	4500	06328958474430990439.exe	100
PID 4500 wrote to memory of 4832	4500	06328958474430990439.exe	100
PID 1028 wrote to memory of 4416	1028	Setup.exe	102
PID 1028 wrote to memory of 4416	1028	Setup.exe	102
PID 1028 wrote to memory of 2036	1028	Setup.exe	103
PID 1028 wrote to memory of 2036	1028	Setup.exe	103
PID 1028 wrote to memory of 2036	1028	Setup.exe	103
PID 2036 wrote to memory of 4612	2036	cmd.exe	105
PID 2036 wrote to memory of 4612	2036	cmd.exe	105
PID 2036 wrote to memory of 4612	2036	cmd.exe	105
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4500 wrote to memory of 3404	4500	06328958474430990439.exe	106
PID 4380 wrote to memory of 760	4380	cmd.exe	112
PID 4380 wrote to memory of 760	4380	cmd.exe	112
PID 4380 wrote to memory of 5060	4380	cmd.exe	113
PID 4380 wrote to memory of 5060	4380	cmd.exe	113
PID 4380 wrote to memory of 4544	4380	cmd.exe	114
PID 4380 wrote to memory of 4544	4380	cmd.exe	114
PID 4380 wrote to memory of 4760	4380	cmd.exe	115
PID 4380 wrote to memory of 4760	4380	cmd.exe	115
PID 4380 wrote to memory of 3960	4380	cmd.exe	116
PID 4380 wrote to memory of 3960	4380	cmd.exe	116
PID 2944 wrote to memory of 4616	2944	cmd.exe	121
PID 2944 wrote to memory of 4616	2944	cmd.exe	121
PID 2944 wrote to memory of 780	2944	cmd.exe	122
PID 2944 wrote to memory of 780	2944	cmd.exe	122
PID 2944 wrote to memory of 1620	2944	cmd.exe	123
PID 2944 wrote to memory of 1620	2944	cmd.exe	123
PID 2944 wrote to memory of 2304	2944	cmd.exe	124
PID 2944 wrote to memory of 2304	2944	cmd.exe	124
PID 3404 wrote to memory of 1784	3404	06328958474430990439.exe	109
PID 3404 wrote to memory of 1784	3404	06328958474430990439.exe	109
PID 3404 wrote to memory of 1784	3404	06328958474430990439.exe	109
PID 1784 wrote to memory of 4360	1784	svcservice.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2408
- C:\Users\Admin\AppData\Local\Temp\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3764
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    C:\Users\Admin\AppData\Local\Temp\Setup.exe
    3⤵
    - Checks computer location settings
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1028
  - - C:\ProgramData\48977722128863891795.exe
      "C:\ProgramData\48977722128863891795.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\ProgramData\48977722128863891795.exe
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4124
      - C:\Windows\system32\choice.exe
        
        choice /C Y /N /D Y /T 0
        6⤵
        
        PID:5108
  - - C:\ProgramData\06328958474430990439.exe
      "C:\ProgramData\06328958474430990439.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4500
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
    - - C:\ProgramData\06328958474430990439.exe
        
        C:\ProgramData\06328958474430990439.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3404
      - C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        "C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1784
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMQA1AA==
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        7⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        
        C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe
        7⤵
        
        PID:1196
  - - C:\ProgramData\23740942652137347770.exe
      "C:\ProgramData\23740942652137347770.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in Drivers directory
      Executes dropped EXE
      Drops file in Program Files directory
      PID:4416
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Setup.exe" & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 6
        5⤵
        Delays execution with timeout.exe
        
        PID:4612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:760
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5060
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4544
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4760
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rxejhfcm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3216
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4616
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:780
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1620
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2304
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  PID:4748
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:1484
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1564
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:3884
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2236
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2624
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#rxejhfcm#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  PID:1476
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:4236
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:4572
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2420
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:5028
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4144
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:396
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:1144

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Executes dropped EXE
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\06328958474430990439.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\06328958474430990439.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\06328958474430990439.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\06328958474430990439.exe

Filesize
5.9MB

MD5
aa57f0d7a099773175006624cc891b29

SHA1
44598d94dac6e9c72ffe65f9e17cf77c2c73e6fe

SHA256
6227df9ce53429b024cb2fa118a7a735ec1c048117cb1a46247e92f1b839814f

SHA512
e0fff8e7d8de1dc5b3d84bdea90828f9739499183aabb11eb5b7600af132f8fa0569bc49d4ca21ec5df925482ec2149d0134a88a4e8a632cb0326444a6bc31b0

Download Submit
C:\ProgramData\23740942652137347770.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\23740942652137347770.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\23740942652137347770.exe

Filesize
9.9MB

MD5
6fa2a8de3fc30b9c80d12c2ac4ad2e3f

SHA1
32fd7a00979b4ec01c031fdfbf12677529e6c4fa

SHA256
a2c59381ca2fdba45f345eec78681fc417271e2f3fb65ff9ec06998d90abc9fd

SHA512
9c51ac0abcab4b8e40b476dbb8e7aaff7a6057caf07756a1a846193bf9d4924fbe0f3f0847237029ecb6f840f658eb41fe43bb89dc7c74be6727c3ee12fe953e

Download Submit
C:\ProgramData\48977722128863891795.exe

Filesize
13.9MB

MD5
0abca5a76379dc774f4c133a177cde59

SHA1
5c7c48d7f3fea2c5e5f950cf83492cda82fda838

SHA256
59a16f9faf29768ed027a33dced3dc1cd61c4be814b59070b3ce79e34bb6b963

SHA512
dd3176ce1e26992be85022a0a9825520496d20a3a7d09b44a4ddedc05511668411f16733efcb82f80f105fef94c2bfa59f9fe908ef281de65f585a1448b668c7

Download Submit
C:\ProgramData\48977722128863891795.exe

Filesize
13.9MB

MD5
0abca5a76379dc774f4c133a177cde59

SHA1
5c7c48d7f3fea2c5e5f950cf83492cda82fda838

SHA256
59a16f9faf29768ed027a33dced3dc1cd61c4be814b59070b3ce79e34bb6b963

SHA512
dd3176ce1e26992be85022a0a9825520496d20a3a7d09b44a4ddedc05511668411f16733efcb82f80f105fef94c2bfa59f9fe908ef281de65f585a1448b668c7

Download Submit
C:\ProgramData\48977722128863891795.exe

Filesize
13.9MB

MD5
0abca5a76379dc774f4c133a177cde59

SHA1
5c7c48d7f3fea2c5e5f950cf83492cda82fda838

SHA256
59a16f9faf29768ed027a33dced3dc1cd61c4be814b59070b3ce79e34bb6b963

SHA512
dd3176ce1e26992be85022a0a9825520496d20a3a7d09b44a4ddedc05511668411f16733efcb82f80f105fef94c2bfa59f9fe908ef281de65f585a1448b668c7

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
622bf737a997b9a257f15dc3b9ee9da5

SHA1
6beba023f9c081393b64de079969e948a47be8be

SHA256
bcefb9a5dbc47579f8b52cc37fd7591a0e20f00f0a7867df0232088db90273d7

SHA512
c1833c09ef0b3e643b8657874e8a99d7d154ac255c326d85fccba53aa57679e7dad93e61b3b8419937cb7ad936eab727c5edd6c4be6b988982c1d61505305e77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
4280e36a29fa31c01e4d8b2ba726a0d8

SHA1
c485c2c9ce0a99747b18d899b71dfa9a64dabe32

SHA256
e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359

SHA512
494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
53KB

MD5
06ad34f9739c5159b4d92d702545bd49

SHA1
9152a0d4f153f3f40f7e606be75f81b582ee0c17

SHA256
474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba

SHA512
c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
cf856e499985d5787ff0988596be8158

SHA1
978f99e85f755d17ede8c697f9d99978b76a9845

SHA256
cb521d23029367c9a53f0f76b00f4d301e52f5554f4f9c345d2d9836b4698737

SHA512
9dfdbfe3db8647eea79d1f7d902cf79f7ebbdf95990b913ca8194d5af8006fc35bfd235378c27404843e9a1fec811d1027710bd97b8d34fb6c5aee6580778d56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
e7c451ac7fb383b19aea15dd206d0364

SHA1
1a02c63b3ed078272c61d9c4a7b9073c3f40f6c7

SHA256
79aee857b2e6b968a4f15e67e33344fac9b45d50d0d037548a14f7652e029502

SHA512
4186daf3052c9e49cd55f779f92c533dc2ef070b169e28647e3b44a9a3eee17efab56c51a9bc52954898f2a315330a7774c461395bcc0b7359267831f4bd9d6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8194a130e5ff6cb4f8e284ee00b9a785

SHA1
3a3f13ce9e964fe430848dc25a92d8722b98b3da

SHA256
eec4a72baf7dbfcfcb138ed75f14f8f515f2a5c152a526d876c9743754d65bb9

SHA512
231db1424283328b7feaa807d1db3106d615d33a682dd6186346b9256079a651d935b032441b0bdda5a44f0f599f6fd557887d1c8ff29c62888f995f79c8fa7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vr5zdt3y.5gl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
268.9MB

MD5
343045b8afde11bf8c9024eb53b0844b

SHA1
f58615967ebb0c941d453b03e143b81e4cd53c1c

SHA256
9a35f0e76f44193e52b2200bf4bec1d92fd6aec2a6bf2f54c02812b16de5c3df

SHA512
cb407c9e16a6c3b09f926622437beb6803b9f3468fedf9c1a03895bda782247ba690c0a3b46dbe313c7a224893ff12b5d62f3ba254e12b0f0ab2538f9292e766

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
266.8MB

MD5
992b519004a8e54669bc18d2ad16220e

SHA1
68b23da9008c576bdbfebf2b5d701d1dc63ab4c4

SHA256
66f85d5f66d311b9de76ab807a1ba855b74c3572de32a4e8ce0c29719bafcd97

SHA512
3a385eb7a59c07205fdec7c40019fad46d84e9886d0ff5ed340f0d86ddf8bf40d19f850caad9e55798db2fb9976f809c93a9181632116953d614ffae6ec825f6

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
125.4MB

MD5
633bc87c9b95840948d99b6ffdd1c9c2

SHA1
45f89dc054a1b26a8b2507b1846526c729881d47

SHA256
695add714f7f5f11757540ec9f3ce84628ad7543407ff60ca5fc38467f0c502e

SHA512
3517724608112d4c58a5a29234ad29c3402ddd42612011dbae8a52b2b3b7957b6bd8667943ba3a6f22e61505fbc65b43cd6e120c3d400c25bf9f6269c60a40ef

Download Submit
C:\Users\Admin\AppData\Roaming\telemetry\svcservice.exe

Filesize
136.5MB

MD5
da4216d2cafa04042f083970165848ae

SHA1
774fb4ef56c798bbb4e4897221712768be34feae

SHA256
dfad536ff13429623bdcf72c06e515d8cd1140dd8d0de665987ea05cd3ee72a5

SHA512
7fe143b578bc44046e39a8e052301780a37f642108fad140b821a86c004d2f55c79bf9ce1daca80702cb2cddc18654449e52508b7a0b13174ce4b013aa261283

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
4KB

MD5
a50c29de640e5957ed3802b419ae72c7

SHA1
c891a511854fa10544aaf44da98dc97780d54aa3

SHA256
df11e0cdaf259ac83da3b3f21fe0fde6f12d39b89f1d6ba9ba085b689b936f87

SHA512
b6ea40e1850843aa3ba7194ec0b683c6b15478c39266e6e445ee1be8f2c4d4ffc74274110fe5ca41859e9f8b746ade84577b705c9655e9f9b2d7a4bdd91e9153

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f78c1239f2684799917efb4bd4ec1db0

SHA1
4da5f2b120b406263b4e24ccb31815e5ba69e717

SHA256
eeee8ea682c3128e5cfc265b9cd10622326150030c108f2dfb8ce3d14fb66f5b

SHA512
89d65238ed7794ec3ac78a4f694ab9630bb62512d9f955b501a354f86364b203bd0c748ad6a8893ce0429dc5d6931e2b0b7da46f9764b0e8fca8b6c3be53b376

Download Submit
memory/396-485-0x00007FF682880000-0x00007FF6828AA000-memory.dmp

Filesize
168KB

Download
memory/396-489-0x00007FF682880000-0x00007FF6828AA000-memory.dmp

Filesize
168KB

Download
memory/1028-310-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/1028-263-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/1028-175-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/1028-262-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-309-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-174-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-172-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-171-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-255-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-168-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-306-0x0000000000400000-0x000000000046C000-memory.dmp

Filesize
432KB

Download
memory/1028-185-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1144-483-0x000001C3A81F0000-0x000001C3A8210000-memory.dmp

Filesize
128KB

Download
memory/1144-490-0x00007FF7BC090000-0x00007FF7BC87F000-memory.dmp

Filesize
7.9MB

Download
memory/1144-488-0x00007FF7BC090000-0x00007FF7BC87F000-memory.dmp

Filesize
7.9MB

Download
memory/1144-486-0x00007FF7BC090000-0x00007FF7BC87F000-memory.dmp

Filesize
7.9MB

Download
memory/1196-446-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1196-441-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1196-440-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1300-352-0x0000021C66700000-0x0000021C66710000-memory.dmp

Filesize
64KB

Download
memory/1300-355-0x0000021C00DA0000-0x0000021C00DA8000-memory.dmp

Filesize
32KB

Download
memory/1300-356-0x0000021C66710000-0x0000021C6671A000-memory.dmp

Filesize
40KB

Download
memory/1300-354-0x0000021C666D0000-0x0000021C666DA000-memory.dmp

Filesize
40KB

Download
memory/1300-353-0x0000021C66700000-0x0000021C66710000-memory.dmp

Filesize
64KB

Download
memory/1300-351-0x0000021C66700000-0x0000021C66710000-memory.dmp

Filesize
64KB

Download
memory/1300-350-0x0000021C666E0000-0x0000021C666FC000-memory.dmp

Filesize
112KB

Download
memory/1300-330-0x0000021C7F990000-0x0000021C7F9B2000-memory.dmp

Filesize
136KB

Download
memory/1684-406-0x00007FF7750D0000-0x00007FF775AB5000-memory.dmp

Filesize
9.9MB

Download
memory/1684-482-0x00007FF7750D0000-0x00007FF775AB5000-memory.dmp

Filesize
9.9MB

Download
memory/1684-411-0x00007FF7750D0000-0x00007FF775AB5000-memory.dmp

Filesize
9.9MB

Download
memory/1784-407-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/1784-393-0x0000000004C80000-0x0000000004C90000-memory.dmp

Filesize
64KB

Download
memory/2692-272-0x0000000000B50000-0x00000000019A0000-memory.dmp

Filesize
14.3MB

Download
memory/3216-384-0x00000184CB240000-0x00000184CB250000-memory.dmp

Filesize
64KB

Download
memory/3216-372-0x00000184CB240000-0x00000184CB250000-memory.dmp

Filesize
64KB

Download
memory/3216-371-0x00000184CB240000-0x00000184CB250000-memory.dmp

Filesize
64KB

Download
memory/3216-383-0x00007FF412820000-0x00007FF412830000-memory.dmp

Filesize
64KB

Download
memory/3404-316-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3404-392-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3404-319-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3404-321-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3404-320-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/3764-155-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3764-157-0x0000000006D20000-0x0000000006D3A000-memory.dmp

Filesize
104KB

Download
memory/3764-144-0x00000000061F0000-0x0000000006256000-memory.dmp

Filesize
408KB

Download
memory/3764-143-0x0000000005A10000-0x0000000005A76000-memory.dmp

Filesize
408KB

Download
memory/3764-142-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3764-156-0x00000000080A0000-0x000000000871A000-memory.dmp

Filesize
6.5MB

Download
memory/3764-164-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3764-162-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3764-141-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3764-161-0x00000000033D0000-0x00000000033E0000-memory.dmp

Filesize
64KB

Download
memory/3764-140-0x0000000005A90000-0x00000000060B8000-memory.dmp

Filesize
6.2MB

Download
memory/3764-154-0x0000000006830000-0x000000000684E000-memory.dmp

Filesize
120KB

Download
memory/3764-139-0x0000000002EE0000-0x0000000002F16000-memory.dmp

Filesize
216KB

Download
memory/4104-160-0x0000000005C90000-0x0000000005CA0000-memory.dmp

Filesize
64KB

Download
memory/4104-133-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/4104-159-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/4104-137-0x0000000005C30000-0x0000000005C52000-memory.dmp

Filesize
136KB

Download
memory/4104-138-0x0000000005C90000-0x0000000005CA0000-memory.dmp

Filesize
64KB

Download
memory/4104-173-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/4104-136-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/4104-135-0x0000000000CF0000-0x00000000017F8000-memory.dmp

Filesize
11.0MB

Download
memory/4360-408-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/4360-409-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/4360-395-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/4360-394-0x0000000002C20000-0x0000000002C30000-memory.dmp

Filesize
64KB

Download
memory/4416-314-0x00007FF7A2DB0000-0x00007FF7A3795000-memory.dmp

Filesize
9.9MB

Download
memory/4416-387-0x00007FF7A2DB0000-0x00007FF7A3795000-memory.dmp

Filesize
9.9MB

Download
memory/4416-382-0x00007FF7A2DB0000-0x00007FF7A3795000-memory.dmp

Filesize
9.9MB

Download
memory/4500-311-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/4500-285-0x0000000002C50000-0x0000000002C60000-memory.dmp

Filesize
64KB

Download
memory/4500-284-0x0000000000630000-0x0000000000878000-memory.dmp

Filesize
2.3MB

Download
memory/4748-431-0x000001E4C6C70000-0x000001E4C6C8C000-memory.dmp

Filesize
112KB

Download
memory/4748-447-0x000001E4C5360000-0x000001E4C5370000-memory.dmp

Filesize
64KB

Download
memory/4748-445-0x000001E4C6EE0000-0x000001E4C6EE6000-memory.dmp

Filesize
24KB

Download
memory/4748-444-0x000001E4C6F00000-0x000001E4C6F1A000-memory.dmp

Filesize
104KB

Download
memory/4748-434-0x000001E4C6D50000-0x000001E4C6D5A000-memory.dmp

Filesize
40KB

Download
memory/4748-433-0x00007FF452050000-0x00007FF452060000-memory.dmp

Filesize
64KB

Download
memory/4748-432-0x000001E4C5360000-0x000001E4C5370000-memory.dmp

Filesize
64KB

Download
memory/4748-412-0x000001E4C5360000-0x000001E4C5370000-memory.dmp

Filesize
64KB

Download
memory/4748-410-0x000001E4C5360000-0x000001E4C5370000-memory.dmp

Filesize
64KB

Download
memory/4832-313-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download
memory/4832-312-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download
memory/4832-297-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download
memory/4832-298-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download