lumma | 4a0a4a787586fbc370a2721019013e158a88d5c5f78fd140c91b54af42103763

Resubmissions

27-11-2024 02:57

241127-df4b4atlgt 6

27-11-2024 02:53

241127-ddm74atkby 10

Analysis

max time kernel
155s
max time network
164s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
27-11-2024 02:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NovaLauncher_44dc2817f4e85757cc52784cd3521c67.msi
Size

7.1MB
MD5

44dc2817f4e85757cc52784cd3521c67
SHA1

41fc684fdb5331b3bc0a6a48f0903c530e3ff054
SHA256

4a0a4a787586fbc370a2721019013e158a88d5c5f78fd140c91b54af42103763
SHA512

66215cc9fb92c7ec5c9fdbe85df9a98bfb72cdfb48e8db51c4ea9bcbd22ff784d57313dea9a6a0a1ee98852d52bec455ad8983e15cab9cd163cbb136ed0f2d18
SSDEEP

196608:OdVx9BJKK09BYzW+ZUl4sK8bF/9NH5iPbPO:OdVx9s9BYzw4sK8bF/aTO

Score

10^/10

lumma defense_evasion discovery evasion execution persistence phishing privilege_escalation stealer

Malware Config

Extracted

Family

lumma

https://powerful-avoids.sbs

https://motion-treesz.sbs

https://disobey-curly.sbs

https://leg-sate-boat.sbs

https://story-tense-faz.sbs

https://blade-govern.sbs

https://occupy-blushi.sbs

https://frogs-severz.sbs

https://fumblingactor.cyou

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
5156	powershell.exe
5168	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in Drivers directory 1 IoCs

Processes:

Spoofer.exe

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	Spoofer.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

Processes:

svchost.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Setup.evtx	svchost.exe

Blocklisted process makes network request 4 IoCs

Processes:

msiexec.exe

flow	pid	Process
2	5856	msiexec.exe
3	5856	msiexec.exe
6	5856	msiexec.exe
7	5856	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

Processes:

flow	ioc
5	mediafire.com
15	mediafire.com
16	mediafire.com

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

Processes:

powercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exe

pid	Process
3848	powercfg.exe
4084	powercfg.exe
2468	powercfg.exe
2064	powercfg.exe
424	powercfg.exe
2708	powercfg.exe
1668	powercfg.exe
3436	powercfg.exe

Drops file in System32 directory 1 IoCs

Processes:

Spoofer.exe

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	Spoofer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

Spoofer.exeWindowsAutHost

pid	Process
2120	Spoofer.exe
2120	Spoofer.exe
3756	WindowsAutHost
3756	WindowsAutHost

Suspicious use of SetThreadContext 2 IoCs

Processes:

Vanta.exeSpoofer.exe

description	pid	Process	procid_target
PID 4572 set thread context of 5260	4572	Vanta.exe	105
PID 2120 set thread context of 4692	2120	Spoofer.exe	131

Drops file in Windows directory 1 IoCs

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Executes dropped EXE 1 IoCs

Processes:

WindowsAutHost

pid	Process
3756	WindowsAutHost

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid	Process
1868	sc.exe
2168	sc.exe
3128	sc.exe
4156	sc.exe
3960	sc.exe
4180	sc.exe
228	sc.exe
2304	sc.exe
1928	sc.exe
432	sc.exe
4960	sc.exe
1052	sc.exe
5256	sc.exe
5800	sc.exe

Loads dropped DLL 1 IoCs

Processes:

MsiExec.exe

pid	Process
2608	MsiExec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

Processes:

msiexec.exe

pid	Process
5856	msiexec.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
4280	5260	WerFault.exe	105

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MsiExec.exeVanta.exeVanta.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vanta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Vanta.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133771496466654110"	chrome.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3870231897-2573482396-1083937135-1000_Classes\Local Settings	chrome.exe

NTFS ADS 1 IoCs

Processes:

chrome.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Vanta.zip:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

Processes:

chrome.exechrome.exeSpoofer.exepowershell.exedialer.exe

pid	Process
5204	chrome.exe
5204	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
3472	chrome.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
5156	powershell.exe
5156	powershell.exe
5156	powershell.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
4692	dialer.exe
4692	dialer.exe
2120	Spoofer.exe
2120	Spoofer.exe
2120	Spoofer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe
4692	dialer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

chrome.exe

pid	Process
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	Process
Token: SeShutdownPrivilege	5856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5856	msiexec.exe
Token: SeSecurityPrivilege	1100	msiexec.exe
Token: SeCreateTokenPrivilege	5856	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5856	msiexec.exe
Token: SeLockMemoryPrivilege	5856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5856	msiexec.exe
Token: SeMachineAccountPrivilege	5856	msiexec.exe
Token: SeTcbPrivilege	5856	msiexec.exe
Token: SeSecurityPrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeLoadDriverPrivilege	5856	msiexec.exe
Token: SeSystemProfilePrivilege	5856	msiexec.exe
Token: SeSystemtimePrivilege	5856	msiexec.exe
Token: SeProfSingleProcessPrivilege	5856	msiexec.exe
Token: SeIncBasePriorityPrivilege	5856	msiexec.exe
Token: SeCreatePagefilePrivilege	5856	msiexec.exe
Token: SeCreatePermanentPrivilege	5856	msiexec.exe
Token: SeBackupPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeShutdownPrivilege	5856	msiexec.exe
Token: SeDebugPrivilege	5856	msiexec.exe
Token: SeAuditPrivilege	5856	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5856	msiexec.exe
Token: SeChangeNotifyPrivilege	5856	msiexec.exe
Token: SeRemoteShutdownPrivilege	5856	msiexec.exe
Token: SeUndockPrivilege	5856	msiexec.exe
Token: SeSyncAgentPrivilege	5856	msiexec.exe
Token: SeEnableDelegationPrivilege	5856	msiexec.exe
Token: SeManageVolumePrivilege	5856	msiexec.exe
Token: SeImpersonatePrivilege	5856	msiexec.exe
Token: SeCreateGlobalPrivilege	5856	msiexec.exe
Token: SeCreateTokenPrivilege	5856	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5856	msiexec.exe
Token: SeLockMemoryPrivilege	5856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5856	msiexec.exe
Token: SeMachineAccountPrivilege	5856	msiexec.exe
Token: SeTcbPrivilege	5856	msiexec.exe
Token: SeSecurityPrivilege	5856	msiexec.exe
Token: SeTakeOwnershipPrivilege	5856	msiexec.exe
Token: SeLoadDriverPrivilege	5856	msiexec.exe
Token: SeSystemProfilePrivilege	5856	msiexec.exe
Token: SeSystemtimePrivilege	5856	msiexec.exe
Token: SeProfSingleProcessPrivilege	5856	msiexec.exe
Token: SeIncBasePriorityPrivilege	5856	msiexec.exe
Token: SeCreatePagefilePrivilege	5856	msiexec.exe
Token: SeCreatePermanentPrivilege	5856	msiexec.exe
Token: SeBackupPrivilege	5856	msiexec.exe
Token: SeRestorePrivilege	5856	msiexec.exe
Token: SeShutdownPrivilege	5856	msiexec.exe
Token: SeDebugPrivilege	5856	msiexec.exe
Token: SeAuditPrivilege	5856	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5856	msiexec.exe
Token: SeChangeNotifyPrivilege	5856	msiexec.exe
Token: SeRemoteShutdownPrivilege	5856	msiexec.exe
Token: SeUndockPrivilege	5856	msiexec.exe
Token: SeSyncAgentPrivilege	5856	msiexec.exe
Token: SeEnableDelegationPrivilege	5856	msiexec.exe
Token: SeManageVolumePrivilege	5856	msiexec.exe
Token: SeImpersonatePrivilege	5856	msiexec.exe
Token: SeCreateGlobalPrivilege	5856	msiexec.exe
Token: SeCreateTokenPrivilege	5856	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5856	msiexec.exe
Token: SeLockMemoryPrivilege	5856	msiexec.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

msiexec.exechrome.exe

pid	Process
5856	msiexec.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

chrome.exe

pid	Process
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe
5204	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msiexec.exechrome.exe

description	pid	Process	procid_target
PID 1100 wrote to memory of 2608	1100	msiexec.exe	81
PID 1100 wrote to memory of 2608	1100	msiexec.exe	81
PID 1100 wrote to memory of 2608	1100	msiexec.exe	81
PID 5204 wrote to memory of 1252	5204	chrome.exe	83
PID 5204 wrote to memory of 1252	5204	chrome.exe	83
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 3060	5204	chrome.exe	84
PID 5204 wrote to memory of 244	5204	chrome.exe	85
PID 5204 wrote to memory of 244	5204	chrome.exe	85
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86
PID 5204 wrote to memory of 4832	5204	chrome.exe	86

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:428

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:996

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:724

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1188

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1408
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2072

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2484

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2540

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2948

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3092

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3332
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\NovaLauncher_44dc2817f4e85757cc52784cd3521c67.msi
  2⤵
  - Blocklisted process makes network request
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:5856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc612cc40,0x7fffc612cc4c,0x7fffc612cc58
    3⤵
    PID:1252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1768,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1760 /prefetch:2
    3⤵
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2132 /prefetch:3
    3⤵
    PID:244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2192 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3112,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
    3⤵
    PID:2772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3192,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:1580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4420,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:1
    3⤵
    PID:4988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4360,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4876 /prefetch:8
    3⤵
    PID:5512
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4416,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4292,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:3852
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4708,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:5968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5240,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:3408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=3748,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:1
    3⤵
    PID:580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5484,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4380 /prefetch:1
    3⤵
    PID:3636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4332,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3364 /prefetch:8
    3⤵
    - NTFS ADS
    PID:5468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4676,i,12368335318510783579,11344784215532549248,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3472
- C:\Users\Admin\Downloads\Vanta\Vanta.exe
  "C:\Users\Admin\Downloads\Vanta\Vanta.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  PID:4572
- - C:\Users\Admin\Downloads\Vanta\Vanta.exe
    "C:\Users\Admin\Downloads\Vanta\Vanta.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5260
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 1476
      4⤵
      Program crash
      PID:4280
- C:\Users\Admin\Downloads\Vanta\Spoofer.exe
  "C:\Users\Admin\Downloads\Vanta\Spoofer.exe"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  PID:2120
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:4668
  - - C:\Windows\system32\wusa.exe
      wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:3816
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:1868
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2168
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4180
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop bits
    3⤵
    - Launches sc.exe
    PID:1928
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop dosvc
    3⤵
    - Launches sc.exe
    PID:228
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
    3⤵
    - Power Settings
    PID:3436
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
    3⤵
    - Power Settings
    PID:2468
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
    3⤵
    - Power Settings
    PID:4084
- - C:\Windows\system32\powercfg.exe
    C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
    3⤵
    - Power Settings
    PID:3848
- - C:\Windows\system32\dialer.exe
    C:\Windows\system32\dialer.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4692
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe delete "WindowsAutHost"
    3⤵
    - Launches sc.exe
    PID:432
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe create "WindowsAutHost" binpath= "C:\ProgramData\WindowsServices\WindowsAutHost" start= "auto"
    3⤵
    - Launches sc.exe
    PID:3128
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe stop eventlog
    3⤵
    - Launches sc.exe
    PID:4960
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5700
- - C:\Windows\system32\sc.exe
    C:\Windows\system32\sc.exe start "WindowsAutHost"
    3⤵
    - Launches sc.exe
    PID:5800
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3484

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3940

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4044

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5688

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4952

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3600

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:3124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 19C7A9917AE38FFCB90E34BD07549A65 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:5112

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:6036

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5312

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:5480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5260 -ip 5260
  2⤵
  PID:3988

C:\ProgramData\WindowsServices\WindowsAutHost
C:\ProgramData\WindowsServices\WindowsAutHost
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Executes dropped EXE
PID:3756
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:1072
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5368
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:4156
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1052
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2304
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:3960
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:5256
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:424
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:2064
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:1668
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:2708
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5580
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:5624
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Impair Defenses

T1562

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\WindowsServices\WindowsAutHost

Filesize
16.4MB

MD5
3d72cccda140b72e690d89e56ec63dad

SHA1
989e41a07021b5dd2f7350d3338513f31c83473f

SHA256
3a435badc9097d180656f2d32c117e144a2b22e55da240416059795aa5241fe5

SHA512
875b6bff1fab59d826530a9e0e6c107197847f49f9509a4c130c6d229f9de0b41e4a1f08fb7327102c08184e6f31c506c4ce22296a13643b10f72dc97a4c306d

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Filesize
64KB

MD5
b5ad5caaaee00cb8cf445427975ae66c

SHA1
dcde6527290a326e048f9c3a85280d3fa71e1e22

SHA256
b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

SHA512
92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Filesize
1008B

MD5
d222b77a61527f2c177b0869e7babc24

SHA1
3f23acb984307a4aeba41ebbb70439c97ad1f268

SHA256
80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

SHA512
d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2cab8d3f-429f-46c0-899b-1aa896c8d65d.tmp

Filesize
9KB

MD5
22418136b0e57e78fb1f3f5cc73de4e7

SHA1
04b387ddf6ff2eef9b8ee378246cd9be2bd9e75d

SHA256
8c86a797d98e46e2bc5d62748c41cbe5a401693ea5ee7c58860457ace40b50e0

SHA512
ad5b398df574bfd9945610e6a4c4e3cd0cb200d635a2be5652054c3548280d54dafff99d00e6f4572451efaf3966ecb5e64e91fea68bfe5e075b62075271ba2d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
2da253dac984a29cfcc90e462f1937aa

SHA1
b527f7ea6d1b9fcf043581648394055a63990b79

SHA256
95fdc3be1f985051d57d818c6cecb453048ee7d26f724c89e68037e8c461f3a9

SHA512
da23fde7cd87cd7efcc78da0848e373247ab168a1ddcc81230f4f62190d9fcb806be412105d3c39b1b05b2efc4e910fda271ff9829ebd343f029113dd0ad7fbd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

Filesize
20KB

MD5
87e8230a9ca3f0c5ccfa56f70276e2f2

SHA1
eb116c8fd20cb2f85b7a942c7dae3b0ed6d27fe7

SHA256
e18d7214e7d3d47d913c0436f5308b9296ca3c6cd34059bf9cbf03126bafafe9

SHA512
37690a81a9e48b157298080746aa94289a4c721c762b826329e70b41ba475bb0261d048f9ab8e7301e43305c5ebf53246c20da8cd001130bf156e8b3bd38b9b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
84aaf426c3367d74f2cdb0021d0d0462

SHA1
c1110e741e38d44b4f20b76c4a66d5cec6ed7443

SHA256
bbd73513022ac063d5a6eb8cfc5c69285218c68f7af381b941c7a90c08a69287

SHA512
a8f01295a1e45e678a72a582d27a772803c8ed0d94b45149084d993b3f0a177b7090a08eacff4aedfcbd2960d63ac08969b9a92638ed9286239a13e313ee670c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
bee17b96f9c1e6b90b88e73c2131854f

SHA1
c6970e307c0e80f427b3cf821aa245a3a03a7c6b

SHA256
906fa37e11b2f408012ba324a5d908e1378789c21e4950118b4825edcca1bb2c

SHA512
ce6c4f0983faee25dd40a7dd5b953d2c0baf3ba1afc8368982776577e1aba98b40ff00e328fc0f8bfeeef6f64ba80152f1f5e9da5ad60381ee2d3ffc4877ffcc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
11KB

MD5
5cf1862f565d1fee8c6d8f97680222a2

SHA1
01ee1072d1d585828c936bcad1897acd36ae5b7b

SHA256
d8ce3719bb2781cd10fd0d4fd2c5cc77ce49975529264ede98d9b2a9f778aaea

SHA512
4bf0473eb58e35c89c1be32d090c4449848ba8e1f3d421e72160810acefc9b897f84b90833fcfab0d4873c3684f7139cb7d6f90933ed4c790ca98fc554f1d132

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
cd6e2a081d0c68569ff8cbb2272b6b50

SHA1
707efcc3de794c36074412cff5ac132a2b30a1c9

SHA256
598e0a222f99b547e12504a3c5d13537b5f8c71e6ff3315072f46c2f981bc6c1

SHA512
cac983144c305bf5bebc2035b2a184cf7dd7a86281b63bfa7a06208f4b9819c7cb002be89bcfea1bdda8bdedb83e903c914dc10ecf664c9230562cf29de8f65d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
354B

MD5
2d4265fb825ae8d54c79c8c5e36bda06

SHA1
037254101e68d0ac3ad747cc36bc7398ecd4cbfd

SHA256
4d5667c7f109714789798bd123f8f0f51a6fa303100994e53fde3eff87bf4c34

SHA512
8db24746e13eacfb68c3da289bb2933f346e7c539f577be24cd0c8f0ba8ee151f30ff5b87547389df1e0ff21607c7702ef70344e3d0087898800d36fbb30e255

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
1d3b23a42b570a3c0081a001c3ff0774

SHA1
a401395189ba01ef414c9f21788e929eb3f3639f

SHA256
82f1263ffc22e484ed2d1839b949eb03e97473a6762a82a432d2232c6d73d3c1

SHA512
dc8f68e01e7e133dceabbcb9ac7d447e64f123b181742626903286375ea3d7a6064289ed30b10b1437b8a9072d198182d20c0591ddf7bd8a364011d5965a82e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
41bd3f098cd9a7ea893175cce25c57dd

SHA1
262ac52609eaae98a30b8500a6b8646393e53f37

SHA256
87f7e29fc3e15b2ada1efc1e3192ab393581df26e584463bb8b1d37d76f1c8e8

SHA512
5eefaa7f1aabd6764692c71dec3f5003fa85c56b97f1859b90d234d294433b3da25f292b34bb230316b6c71414f3a2ff7addb53842e8f458e78b689309b01eb0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
754bae5373bb76930accd2a040e6eb16

SHA1
790d36b4477a8067fe4d2dcc9bbd0569cc1db22b

SHA256
0bd925b440037de8d63a9b0eb14e297b21581abeae2e50603f73659d4ff34e9a

SHA512
285776b1536e1435a150d96ed30f8a29d2f210f38ce007090d776043a8ef01d6d97e5b0fca1763f7323148b658aeb4c1155e21ab1db6651090a9fb3c4db3de97

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
9a30b3703ff1000d959ccdb94af31e80

SHA1
10806b39011ea4903bd40680e2aee51a92d6a4fb

SHA256
85d568417ae4cd6b0a0b0e5e41b1ac2b612f9429adcc3fb7e65480b9712b67ef

SHA512
b7dd709e40e5013b8cca7a27be0d173af684aa7d5fd52f1f679890722666b22c46af0c849af0fbce78f8f14b1ece45091dbb21466e3ca0b7cb78f686dbde1ece

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
c78a979b900cfc1d5cd858a21cb5d9cf

SHA1
43d2884f390798062d66cda4c845c8511e9ed8d4

SHA256
aaf34d320946de9f3a5d1983cfae3ee04f1c3d63c3ac238a6577a337514139ba

SHA512
6ca4c12f61fee1ccdcf07dc9619b0988b4aa0c24dce23d82726be3b464da257fe78aacbca382a9c96b888e584015f5748bd59305342f9b29c38d1c0fd1823352

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
9KB

MD5
e056a2246f4785bfb125ba75ea7e5d3a

SHA1
a11f9946ea6ccef7c4e0a7fd14c914fe15b2ff52

SHA256
4a77ae5e7d038a9b065d539ca076ff28a54f958619d8e2e82faa808a4e44d034

SHA512
c5f1d37d045a9733e37a3502478495dfafd34ac2f7b53e382cd5a6b3f1a21b311392601c062bad781269503dda0bf47bf072b428b07ebaf6c29a6385eda557f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
b4c0cfc66ab2183efc6436eeb9d21c63

SHA1
76daab3eecfe98202174be7a1b53196fd01f2814

SHA256
7895632ffa256a171b61f0abe8d811ee71b268566079d6918110fb1ea2926163

SHA512
84ce78d72fa62d71b35abcda7895ac68b405717645525b749e2b22197039ea5774f61ca7e6f7f5e8dc7af8c62b8fbad27a25c3ffd191adba38ffcd213b7674ab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
eff47c05bec85424645eab117fc80044

SHA1
e869d71a3565fb12a56e97627142bea55fcc16f4

SHA256
d2759675db63b96541544ee6dfe49ff5fd93cc05218da2fe9226d1feab3311fc

SHA512
79dafaf897b2fdab15b7e63d241b3b3ba4a83cfa3e89c4981024da7f6cdeac57a1fb24eea9af24862f5e289b76dc3670d5d0aa2d488b2a7599ef8425e1474aca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
f7b13708453596ed4384d4202a6c773a

SHA1
d0f346b5252494f2cebc6f6e953ba9026c021cdb

SHA256
0406ce85f9fb58c04cf3a5682afdeda45268a4ddf3c8312e39f552b3557cba44

SHA512
935df35410acff7d8d5d6e37e0928a0f67f6f624520c0897f6c5271c36147ef5f4127cf032439b80efdc672fb586e4738680804997d4287bfab19ad5dff24fe0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
d07152e1711803bf3acf93b38b1afbc8

SHA1
249efdc8c3f86f8c6bdb3a9c48a1e31c3d197cb1

SHA256
c4cc80f6666d30d7e1cbb5bc56ed603d2e1c98672eae9f7b82873e466f87fd49

SHA512
1e34aba4158a46bf1cc18650a9d4030c801af8d1d545870f12e336312b3bce0e5355cd64c44781a5bb51b1a895820f2d4a7e2f811b270ea8cface40722cae1ba

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
6f36cf6e6930d639a08aab4fd10d2996

SHA1
3aa2bb421792130292b35f2c542e52371a85f8d7

SHA256
0c449f20b520f86a76c589a1aebf60e9967b9ef798fb4c8c1494d0bdca462145

SHA512
c6bf51ab112ee4143fff1bba438842d2c5e3f5cc6f5812beb9d28b9219143ea953be6a3bd276664d3d416abce6ba51449585830a74d43cb67c056838230fd839

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
4b7af415f70c0c14b26556e586cc594e

SHA1
890370dcec6b4f8818b38308efffc0780bacf6d5

SHA256
2b5436b2b691cc28c74c609cca62be7ece3ad86923d4005a8251366db9c6e175

SHA512
ac065f9df5c13d62b8d2300703f2d2f869fa4e3d5fb4980b7ca89e3fb5c9debcbcd28f6786a1aa17eea22fd1e02fca854e9b0baf2e1e65719a134f3cf8406e3b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
c8d4a3f4f67bc672c7e528308daa5d3d

SHA1
f01ab013eed6e52cbca4a8a6754126dab872dc58

SHA256
f79c01fe5150ce7835bf7e304238b15f5888d75530092eff63aa916bbfefdcb9

SHA512
a853ea3f9aa551fa13f3c8f6956d420551eb05dc0f807d7464e959fba14082ef0435088d151326284f11580922598060dd772124e3e3aab2e1520138eeea776c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
efc0d19daa4ff152c820a8da9fed5a83

SHA1
2a57e6aebb03d0ca97bb863ea9d24bb3abdadfae

SHA256
7d440ff4c2a43cdf84b2fe1550305eb615a3cd5b1f89210a9dd27f6a062758f2

SHA512
6709c1dfea7a3fcd1b2b651ed2f116e62ff567fac7079df5559e0a565df48bd36dbef126f0f88948090267ccdc1c3c2106d68cb20477a74c8cf76d1e9987b833

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
151393bab63a0c54f501cfb83b28930f

SHA1
3c2a53e468d037432add5cd426c6dfc03d43b58e

SHA256
ccd93cd614d5d88bd20e92482c5c1c91769f4ea18b44ee531674cdeb03e1dd77

SHA512
eff7bc35d23f1af399a9904d3d0b2276e4ed9d64cc8008204508c9c78a5cddd2d79b03cbd1eee6f91df83207f9cbed29eff230e9507ad06ffcc7446a2e3c408b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
234KB

MD5
45f74eb8ba9ace52f5cb3ef2617f5965

SHA1
b12c2fdcdc0488cc6a527196e4e63a032acc1e6d

SHA256
41c1902bcd31cc17e4bdcbfade7ea363934f3b118475360fec3208ab1050fa30

SHA512
8e28e8107b2be628a36033d986a74bff93992c384c685582b2b3ca138e420403d5a26389e744f689c56aa258c9734ad9c9985439417350f226e837e3f8f8d511

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9CDC.tmp

Filesize
285KB

MD5
b77a2a2768b9cc78a71bbffb9812b978

SHA1
b70e27eb446fe1c3bc8ea03dabbee2739a782e04

SHA256
f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0

SHA512
a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zmlfmkki.lxg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Downloads\Vanta.zip

Filesize
18.4MB

MD5
3c528cdbef7555576f78740a7a65c26c

SHA1
0293b662c5f40a8c2d3d8650fc65d26d0fe434cb

SHA256
c8a6fe9304daaad33ab3fff22a337d25ba9cf7e913814d1fd116f807cfee227c

SHA512
fea55cae4156110b8b85263f10472e62c0fb5c45150cb00f6fa7daa9bef318949652f1b0427c8b4e54c38e98f78b4f52af21f2004dffcca4f1c4b1ce0b0a57ea

Download Submit
C:\Users\Admin\Downloads\Vanta.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
8ec9b858770ae71075f06a8ebc30210f

SHA1
e54f2d1bb0b25b5c59c2eb26a55ac9a1d09a1d08

SHA256
7c5a5eb9142e4cd3bbfbd9b9ed482c5a2471c3014f2449138783fe2b92f62339

SHA512
abef1fb612996bb1c5d59f55b6163cc481c3f0cdb260946762d6829ee3ab4b4ee8829b511e0462b168ebac039d055440547804e560aec8699820a85cdadff553

Download Submit
\??\pipe\crashpad_5204_GESUYZYTAIWQTUTC

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/428-477-0x00007FFF95710000-0x00007FFF95720000-memory.dmp

Filesize
64KB

Download
memory/428-476-0x000002CE8D720000-0x000002CE8D74B000-memory.dmp

Filesize
172KB

Download
memory/640-468-0x000001C426060000-0x000001C426084000-memory.dmp

Filesize
144KB

Download
memory/640-472-0x000001C426090000-0x000001C4260BB000-memory.dmp

Filesize
172KB

Download
memory/640-473-0x00007FFF95710000-0x00007FFF95720000-memory.dmp

Filesize
64KB

Download
memory/688-487-0x00007FFF95710000-0x00007FFF95720000-memory.dmp

Filesize
64KB

Download
memory/688-485-0x00000177446D0000-0x00000177446FB000-memory.dmp

Filesize
172KB

Download
memory/2120-439-0x00007FFFD58A0000-0x00007FFFD58A2000-memory.dmp

Filesize
8KB

Download
memory/2120-438-0x00007FFFD5890000-0x00007FFFD5892000-memory.dmp

Filesize
8KB

Download
memory/2120-440-0x00007FF7D8090000-0x00007FF7D9D67000-memory.dmp

Filesize
28.8MB

Download
memory/4692-465-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4692-456-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4692-459-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4692-463-0x00007FFFD4610000-0x00007FFFD46CD000-memory.dmp

Filesize
756KB

Download
memory/4692-462-0x00007FFFD5680000-0x00007FFFD5889000-memory.dmp

Filesize
2.0MB

Download
memory/4692-461-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4692-457-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/4692-458-0x0000000140000000-0x000000014002B000-memory.dmp

Filesize
172KB

Download
memory/5156-448-0x00000225ECF30000-0x00000225ECF52000-memory.dmp

Filesize
136KB

Download
memory/5168-777-0x000001E8BD380000-0x000001E8BD38A000-memory.dmp

Filesize
40KB

Download
memory/5168-775-0x000001E8BD2A0000-0x000001E8BD2BC000-memory.dmp

Filesize
112KB

Download
memory/5168-776-0x000001E8BD2C0000-0x000001E8BD373000-memory.dmp

Filesize
716KB

Download
memory/5168-778-0x000001E8BD3B0000-0x000001E8BD3CC000-memory.dmp

Filesize
112KB

Download
memory/5168-779-0x000001E8BD390000-0x000001E8BD39A000-memory.dmp

Filesize
40KB

Download
memory/5168-780-0x000001E8BD3F0000-0x000001E8BD40A000-memory.dmp

Filesize
104KB

Download
memory/5168-781-0x000001E8BD3A0000-0x000001E8BD3A8000-memory.dmp

Filesize
32KB

Download
memory/5168-782-0x000001E8BD3D0000-0x000001E8BD3D6000-memory.dmp

Filesize
24KB

Download
memory/5168-783-0x000001E8BD3E0000-0x000001E8BD3EA000-memory.dmp

Filesize
40KB

Download
memory/5260-376-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/5260-375-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download