amadey | f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620

Analysis

max time kernel
150s
max time network
152s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
27-03-2023 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
Size

251KB
MD5

9d29f5640c968ae41824e3999937b4ed
SHA1

31560a3776918e01b6cd2e9d87fbf2ad1028ec7f
SHA256

f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620
SHA512

6375856cfecc5eaff50c8534f51a2a762de1ed5b5dbcaa4882f5eef4a4f37537efb8bb89191c09cd03f00864482c31e10dc1dd0355d40051bf0093dc7bb61338
SSDEEP

6144:Ci3VWOkGLWA36gvapL8sl40HzdYl7qSGM6g:bkOkGKAqgvapL20TI7qS1J

Score

10^/10

amadey djvu redline smokeloader koreamon pub1 sprg backdoor discovery evasion infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

http://aapu.at/tmp/

http://poudineh.com/tmp/

http://firsttrusteedrx.ru/tmp/

http://kingpirate.ru/tmp/

http://hoh0aeghwugh2gie.com/

http://hie7doodohpae4na.com/

http://aek0aicifaloh1yo.com/

rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Botnet

sprg

Extracted

Family

amadey

Version

3.65

77.73.134.27/8bmdh3Slb2/index.php

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.jypo
offline_id
MEMHlobHgXqvmTWaMsLcwGZhDOd00bblO1yevst1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-fkW8qLaCVQ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0676JOsie

rsa_pubkey.plain

Extracted

Family

redline

Botnet

koreamon

koreamonitoring.com:80

Attributes

auth_value
1a0e1a9f491ef3df873a03577dfa10aa

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detected Djvu ransomware 16 IoCs

resource	yara_rule
behavioral1/memory/3896-196-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3896-199-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4776-200-0x0000000002460000-0x000000000257B000-memory.dmp	family_djvu
behavioral1/memory/3896-201-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3896-202-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3896-215-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-222-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-223-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-224-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-229-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-230-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-236-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-238-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-239-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-245-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/520-254-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies security service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

resource	yara_rule
behavioral1/memory/1296-271-0x00000000024F0000-0x000000000254A000-memory.dmp	family_redline
behavioral1/memory/1296-275-0x0000000004CE0000-0x0000000004D36000-memory.dmp	family_redline
behavioral1/memory/1296-276-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-277-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-279-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-281-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-283-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-288-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-291-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-294-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-296-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-298-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-300-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-302-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-304-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-306-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-308-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-310-0x0000000004CE0000-0x0000000004D32000-memory.dmp	family_redline
behavioral1/memory/1296-1111-0x0000000004DA0000-0x0000000004DB0000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Suspicious use of NtCreateUserProcessOtherParentProcess 12 IoCs

description	pid	Process	procid_target
PID 992 created 3208	992	XandETC.exe	51
PID 992 created 3208	992	XandETC.exe	51
PID 992 created 3208	992	XandETC.exe	51
PID 992 created 3208	992	XandETC.exe	51
PID 992 created 3208	992	XandETC.exe	51
PID 2188 created 3208	2188	updater.exe	51
PID 2188 created 3208	2188	updater.exe	51
PID 2188 created 3208	2188	updater.exe	51
PID 2188 created 3208	2188	updater.exe	51
PID 2188 created 3208	2188	updater.exe	51
PID 2188 created 3208	2188	updater.exe	51
PID 2188 created 3208	2188	updater.exe	51

Downloads MZ/PE file
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Deletes itself 1 IoCs

pid	Process
3208	Explorer.EXE

Executes dropped EXE 19 IoCs

pid	Process
3952	C6C0.exe
3916	C866.exe
4164	DF5A.exe
2252	E0E2.exe
4656	F67E.exe
3012	FDB3.exe
3540	Player3.exe
4776	16D.exe
4660	ss31.exe
3384	Player3.exe
992	XandETC.exe
3896	16D.exe
792	16D.exe
520	16D.exe
2420	build3.exe
1296	33F8.exe
3948	6E91.exe
2188	updater.exe
2152	mstsca.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2116	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a214f52c-cce7-46da-8cc1-9c6b92202632\\16D.exe\" --AutoStart"	16D.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	api.2ip.ua
22	api.2ip.ua
35	api.2ip.ua

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3948	6E91.exe
3948	6E91.exe
3948	6E91.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4776 set thread context of 3896	4776	16D.exe	81
PID 792 set thread context of 520	792	16D.exe	85
PID 2188 set thread context of 2772	2188	updater.exe	155
PID 2188 set thread context of 4328	2188	updater.exe	161

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\Notepad\Chrome\updater.exe	XandETC.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe
File created	C:\Program Files\Google\Libs\g.log	cmd.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4476	sc.exe
2176	sc.exe
2300	sc.exe
4028	sc.exe
3952	sc.exe
5024	sc.exe
4164	sc.exe
4388	sc.exe
3948	sc.exe
4352	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4664	3916	WerFault.exe	67
4940	2252	WerFault.exe	71
4140	4656	WerFault.exe	73
2588	3948	WerFault.exe	93

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C6C0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C6C0.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DF5A.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DF5A.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C6C0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	DF5A.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1792	schtasks.exe
4036	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WMIC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	conhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3628	f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
3628	f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3208	Explorer.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
3628	f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
3952	C6C0.exe
4164	DF5A.exe
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE
3208	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeShutdownPrivilege	3208	Explorer.EXE
Token: SeCreatePagefilePrivilege	3208	Explorer.EXE
Token: SeDebugPrivilege	1296	33F8.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeIncreaseQuotaPrivilege	4952	powershell.exe
Token: SeSecurityPrivilege	4952	powershell.exe
Token: SeTakeOwnershipPrivilege	4952	powershell.exe
Token: SeLoadDriverPrivilege	4952	powershell.exe
Token: SeSystemProfilePrivilege	4952	powershell.exe
Token: SeSystemtimePrivilege	4952	powershell.exe
Token: SeProfSingleProcessPrivilege	4952	powershell.exe
Token: SeIncBasePriorityPrivilege	4952	powershell.exe
Token: SeCreatePagefilePrivilege	4952	powershell.exe
Token: SeBackupPrivilege	4952	powershell.exe
Token: SeRestorePrivilege	4952	powershell.exe
Token: SeShutdownPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeSystemEnvironmentPrivilege	4952	powershell.exe
Token: SeRemoteShutdownPrivilege	4952	powershell.exe
Token: SeUndockPrivilege	4952	powershell.exe
Token: SeManageVolumePrivilege	4952	powershell.exe
Token: 33	4952	powershell.exe
Token: 34	4952	powershell.exe
Token: 35	4952	powershell.exe
Token: 36	4952	powershell.exe
Token: SeShutdownPrivilege	2772	powercfg.exe
Token: SeCreatePagefilePrivilege	2772	powercfg.exe
Token: SeShutdownPrivilege	1512	powercfg.exe
Token: SeCreatePagefilePrivilege	1512	powercfg.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2988	powercfg.exe
Token: SeCreatePagefilePrivilege	2988	powercfg.exe
Token: SeShutdownPrivilege	4956	powercfg.exe
Token: SeCreatePagefilePrivilege	4956	powercfg.exe
Token: SeIncreaseQuotaPrivilege	2052	powershell.exe
Token: SeSecurityPrivilege	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2052	powershell.exe
Token: SeLoadDriverPrivilege	2052	powershell.exe
Token: SeSystemProfilePrivilege	2052	powershell.exe
Token: SeSystemtimePrivilege	2052	powershell.exe
Token: SeProfSingleProcessPrivilege	2052	powershell.exe
Token: SeIncBasePriorityPrivilege	2052	powershell.exe
Token: SeCreatePagefilePrivilege	2052	powershell.exe
Token: SeBackupPrivilege	2052	powershell.exe
Token: SeRestorePrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	2052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 3952	3208	Explorer.EXE	66
PID 3208 wrote to memory of 3952	3208	Explorer.EXE	66
PID 3208 wrote to memory of 3952	3208	Explorer.EXE	66
PID 3208 wrote to memory of 3916	3208	Explorer.EXE	67
PID 3208 wrote to memory of 3916	3208	Explorer.EXE	67
PID 3208 wrote to memory of 3916	3208	Explorer.EXE	67
PID 3208 wrote to memory of 4164	3208	Explorer.EXE	70
PID 3208 wrote to memory of 4164	3208	Explorer.EXE	70
PID 3208 wrote to memory of 4164	3208	Explorer.EXE	70
PID 3208 wrote to memory of 2252	3208	Explorer.EXE	71
PID 3208 wrote to memory of 2252	3208	Explorer.EXE	71
PID 3208 wrote to memory of 2252	3208	Explorer.EXE	71
PID 3208 wrote to memory of 4656	3208	Explorer.EXE	73
PID 3208 wrote to memory of 4656	3208	Explorer.EXE	73
PID 3208 wrote to memory of 4656	3208	Explorer.EXE	73
PID 3208 wrote to memory of 3012	3208	Explorer.EXE	74
PID 3208 wrote to memory of 3012	3208	Explorer.EXE	74
PID 3208 wrote to memory of 3012	3208	Explorer.EXE	74
PID 3012 wrote to memory of 3540	3012	FDB3.exe	75
PID 3012 wrote to memory of 3540	3012	FDB3.exe	75
PID 3012 wrote to memory of 3540	3012	FDB3.exe	75
PID 3208 wrote to memory of 4776	3208	Explorer.EXE	76
PID 3208 wrote to memory of 4776	3208	Explorer.EXE	76
PID 3208 wrote to memory of 4776	3208	Explorer.EXE	76
PID 3012 wrote to memory of 4660	3012	FDB3.exe	77
PID 3012 wrote to memory of 4660	3012	FDB3.exe	77
PID 4656 wrote to memory of 3384	4656	F67E.exe	78
PID 4656 wrote to memory of 3384	4656	F67E.exe	78
PID 4656 wrote to memory of 3384	4656	F67E.exe	78
PID 3012 wrote to memory of 992	3012	FDB3.exe	80
PID 3012 wrote to memory of 992	3012	FDB3.exe	80
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 4776 wrote to memory of 3896	4776	16D.exe	81
PID 3896 wrote to memory of 2116	3896	16D.exe	82
PID 3896 wrote to memory of 2116	3896	16D.exe	82
PID 3896 wrote to memory of 2116	3896	16D.exe	82
PID 3896 wrote to memory of 792	3896	16D.exe	83
PID 3896 wrote to memory of 792	3896	16D.exe	83
PID 3896 wrote to memory of 792	3896	16D.exe	83
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 792 wrote to memory of 520	792	16D.exe	85
PID 520 wrote to memory of 2420	520	16D.exe	86
PID 520 wrote to memory of 2420	520	16D.exe	86
PID 520 wrote to memory of 2420	520	16D.exe	86
PID 2420 wrote to memory of 1792	2420	build3.exe	87
PID 2420 wrote to memory of 1792	2420	build3.exe	87
PID 2420 wrote to memory of 1792	2420	build3.exe	87
PID 3208 wrote to memory of 1296	3208	Explorer.EXE	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Users\Admin\AppData\Local\Temp\f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe
  "C:\Users\Admin\AppData\Local\Temp\f59fb2d910aa61f674ce5c52eeab1bc7abdcdbe9861f44454866156575a1a620.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3628
- C:\Users\Admin\AppData\Local\Temp\C6C0.exe
  C:\Users\Admin\AppData\Local\Temp\C6C0.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\C866.exe
  C:\Users\Admin\AppData\Local\Temp\C866.exe
  2⤵
  - Executes dropped EXE
  PID:3916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 480
    3⤵
    - Program crash
    PID:4664
- C:\Users\Admin\AppData\Local\Temp\DF5A.exe
  C:\Users\Admin\AppData\Local\Temp\DF5A.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4164
- C:\Users\Admin\AppData\Local\Temp\E0E2.exe
  C:\Users\Admin\AppData\Local\Temp\E0E2.exe
  2⤵
  - Executes dropped EXE
  PID:2252
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 476
    3⤵
    - Program crash
    PID:4940
- C:\Users\Admin\AppData\Local\Temp\F67E.exe
  C:\Users\Admin\AppData\Local\Temp\F67E.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Executes dropped EXE
    PID:3384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4656 -s 1440
    3⤵
    - Program crash
    PID:4140
- C:\Users\Admin\AppData\Local\Temp\FDB3.exe
  C:\Users\Admin\AppData\Local\Temp\FDB3.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Player3.exe
    "C:\Users\Admin\AppData\Local\Temp\Player3.exe"
    3⤵
    - Executes dropped EXE
    PID:3540
- - C:\Users\Admin\AppData\Local\Temp\ss31.exe
    "C:\Users\Admin\AppData\Local\Temp\ss31.exe"
    3⤵
    - Executes dropped EXE
    PID:4660
- - C:\Users\Admin\AppData\Local\Temp\XandETC.exe
    "C:\Users\Admin\AppData\Local\Temp\XandETC.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:992
- C:\Users\Admin\AppData\Local\Temp\16D.exe
  C:\Users\Admin\AppData\Local\Temp\16D.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\16D.exe
    C:\Users\Admin\AppData\Local\Temp\16D.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\a214f52c-cce7-46da-8cc1-9c6b92202632" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      4⤵
      Modifies file permissions
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\16D.exe
      "C:\Users\Admin\AppData\Local\Temp\16D.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:792
    - - C:\Users\Admin\AppData\Local\Temp\16D.exe
        
        "C:\Users\Admin\AppData\Local\Temp\16D.exe" --Admin IsNotAutoStart IsNotTask
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:520
      - C:\Users\Admin\AppData\Local\34bc4d2d-d68a-48d5-bc23-c2804220304c\build3.exe
        
        "C:\Users\Admin\AppData\Local\34bc4d2d-d68a-48d5-bc23-c2804220304c\build3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2420
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1792
- C:\Users\Admin\AppData\Local\Temp\33F8.exe
  C:\Users\Admin\AppData\Local\Temp\33F8.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1296
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4040
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\6E91.exe
  C:\Users\Admin\AppData\Local\Temp\6E91.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:3948
- - C:\Windows\system32\dllhost.exe
    "C:\Windows\system32\dllhost.exe"
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3948 -s 700
    3⤵
    - Program crash
    PID:2588
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:1652
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4188
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:600
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:884
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2000
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:2396
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:5096
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3952
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:5024
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4164
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4476
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4388
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4888
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:3380
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    - Modifies security service
    PID:3508
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:2212
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:5092
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2772
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1512
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2988
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }
  2⤵
  PID:1988
- - C:\Windows\system32\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC
    3⤵
    PID:3328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:1520
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
  2⤵
  PID:1492
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:3948
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:2176
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:2300
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4028
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:4352
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
    3⤵
    PID:4080
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
    3⤵
    PID:2148
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
    3⤵
    PID:2164
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
    3⤵
    PID:1096
- - C:\Windows\System32\reg.exe
    reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
    3⤵
    PID:4556
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:1412
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3332
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:4256
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:4444
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2480
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe zuhwtyqtfkk
  2⤵
  PID:2772
- - C:\Windows\System32\cmd.exe
    C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
    3⤵
    - Drops file in Program Files directory
    PID:2484
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic PATH Win32_VideoController GET Name, VideoProcessor
      4⤵
      Modifies data under HKEY_USERS
      PID:4476
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Program Files\Google\Libs\g.log"
  2⤵
  - Drops file in Program Files directory
  PID:2580
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe ozascextlcafxrlv 6E3sjfZq2rJQaxvLPmXgsH8HqLgRgcx0/LVDxBdghhCp2+hEkY7tykSHwITYgOlci3ytMC8bvXFdgLfubt31d00EGUNZvUBUebLdyQcn06lc9XyK+SQQg4bEvwPCdT2KYoSnyaznjkuq+t/WEmnCxetIZsxpO3p/zzwJI2q0v1rwbWjqgzbDndc3ETa3aKYf8EOpU9uqIUcKKIP5glSGIF5NNBIQIOxiwAszeRmTD+ssM2JwNB+ZJXRJvy123U7UEXSTx71FLoxpDYVaIMhOE++Mr3hazCz1q4t4s5o8+wL0kdpUV5VnrG7JmlnWotU5n89qBghGm+y6SMYnw4GovlYYIKPio/EJCBO4ISkMSM9oXvdK2xwDd7nOPHNI0ub2+9+yDpmbkJhXPRjLmh8EzH9no+cA8XXsDqc7l4Il6Q8HZCkxxQKp3X7QrvGtORgpsiUFRUsjuuqKF8OZDBQ643uz5XTg02QKOJfFPdU0JLRX+q6NZJdak+3EYZdI36Zgtv5L8IJAttmNYCJqIJTseVMH04bRJ5WBnXqRYehi2MM0O1YRQDI8kKVhBta2xSurnVpcEWelFYwmZuF8Vd3YhHb8yAOoY//KgjosTtbU5Co=
  2⤵
  - Modifies data under HKEY_USERS
  PID:4328

C:\Program Files\Notepad\Chrome\updater.exe
"C:\Program Files\Notepad\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
PID:2188

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:2152
- C:\Windows\SysWOW64\schtasks.exe
  /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Modify Registry

Web Service

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Libs\g.log

Filesize
226B

MD5
fdba80d4081c28c65e32fff246dc46cb

SHA1
74f809dedd1fc46a3a63ac9904c80f0b817b3686

SHA256
b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398

SHA512
b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Program Files\Notepad\Chrome\updater.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
e5b1cc0ae5af6a8277d75cff4af2c5e8

SHA1
4768fff3d4bbe02f89683b4a0e7b15b24b54eb9f

SHA256
d950c0d748aae641d71b11cd1c519b289917c23bee1a2b6bc5c496fd8e5d4655

SHA512
57a4737deeefac0124d73b52525993fecbbebd21a556ece87f8e79e845e07f037abb5e49f7458e8a010935c6691f18fbb913d77ecfb2ba902067788c483ec3d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
3adac03b181d7980568dda0da0efc9de

SHA1
a283c4c9bd26a65b8240d21708e57f5946778341

SHA256
24c4973ced938b77d9670ac79eb76cd52411b17ab59ec78ba14c1b433f342933

SHA512
6fbd2a32fc18606628ea56311764cd879a1196405dddd4d269ad6163b2ffdcf916786f1c0328f27ec089be5cb9b4ecb3542363f4dfb3df1c1b91a0e038b67241

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
52fbab3850d8d6bd7cf4710ff8841392

SHA1
cb96b99b35fad9861e3d5c5cec13d1d0323d8ec2

SHA256
b7c507b953b089cc6107ff3d68561865668b25eee0c57f51605a99c346e20a40

SHA512
8cbeac92dd677b35688ffb02a947077beff98abb94ef364cd5026a464fd100f1afe480f8958cbab4a357c6459776fafe1c954ca14bc1b49e80bd293c5a7228c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
e2b3bd2b0e24235931ed03abf9a10aed

SHA1
d8fdaa3f28e5cd9eb2598fc088a6a3fadb728245

SHA256
08eb6a6d4f9567a27ee4ad2133a4f88946ab46eb4f83e0e7963c571f66d21c72

SHA512
fd4bab10e87b2b2df1cc0525001ff675f8b0dd6bde46469beeec8b37be13a32d950fb000d9034341d8f46a2c6133bff1af6eb0a906e5274a85dc9c3274a13573

Download Submit
C:\Users\Admin\AppData\Local\34bc4d2d-d68a-48d5-bc23-c2804220304c\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\34bc4d2d-d68a-48d5-bc23-c2804220304c\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
8592ba100a78835a6b94d5949e13dfc1

SHA1
63e901200ab9a57c7dd4c078d7f75dcd3b357020

SHA256
fdd7d9def6f9f0c0f2e60dbc8a2d1999071cd7d3095e9e087bb1cda7a614ac3c

SHA512
87f98e6cb61b2a2a7d65710c4d33881d89715eb7a06e00d492259f35c3902498baabffc5886be0ec5a14312ad4c262e3fc40cd3a5cb91701af0fb229726b88c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\KIQVE9IA\bimage[5].jpg

Filesize
1.4MB

MD5
d8b9bca48844ba0a0a2f3a32fd6647d5

SHA1
7f07c0b0ac19ee637a01919da3f33cb34ed6fc97

SHA256
e3e8f6043e3937fb97fa76e1dedd22a29770d2f89173840d73f43a7b3657640a

SHA512
609ccd1a39477e0baaaedff6693952b18136e8adf31cf10975ab35c898ece870d1a3ee000d7d09d577ebbfb8243a404aa7e6bc81cdf947e6738f7626813a4ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ab8b6ea5fcfd10f997a3abd78fcdf447

SHA1
05c012c26309be98323dc10543370179e0a25e8f

SHA256
4bb2f6cbd033d8916b9d068af07228e56aa27e94e59d9da4747c4de0074056ef

SHA512
08cc4f222c954c0ad0970faee94552f58e92a52471bccd88fa882d40f27a50e58130e9ef581495461977313bb292766857a3fb70db14960e53c05bfed0769c4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4489cf1bff76d7b905f4a77597d71bcc

SHA1
6884e0128809ae5c785aff24dda600921fd1887a

SHA256
6945744166e8bcbe4ef7e6f37915986582f7872548b0c8af0ac80d53f203a648

SHA512
6ea2dd6c27ac00c68d60ffd2074317de7fe2ed8fa36d4e0e7d932ffc08f7bab778696486e286d408cd0919fe1243ffa7d4ca52219aa03cf49186f97783c1fc70

Download Submit
C:\Users\Admin\AppData\Local\Temp\16D.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\16D.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\16D.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\16D.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\16D.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\16de06bfb4\nbveek.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\33F8.exe

Filesize
346KB

MD5
6093557e3e84e5ed1b2835e84941df6b

SHA1
24db3355c0ff0e30def3e3a99498d2f30cc66cf2

SHA256
34fbd6db5481ec0b9e6adb9ed999af2f93b59b834f9cefc76c8eacfaedeb79db

SHA512
ecefc5eccc7c88a537681a33267598da43c32dbe2961a0fe09e4f4369a280b3cdefb1cc15810e9bcaf55ecd810511c50faf5cda32b0f08adf9a68023a276da8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\33F8.exe

Filesize
346KB

MD5
6093557e3e84e5ed1b2835e84941df6b

SHA1
24db3355c0ff0e30def3e3a99498d2f30cc66cf2

SHA256
34fbd6db5481ec0b9e6adb9ed999af2f93b59b834f9cefc76c8eacfaedeb79db

SHA512
ecefc5eccc7c88a537681a33267598da43c32dbe2961a0fe09e4f4369a280b3cdefb1cc15810e9bcaf55ecd810511c50faf5cda32b0f08adf9a68023a276da8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E91.exe

Filesize
312KB

MD5
e6064fdee64cf67d083a2f1d16e6ad5b

SHA1
281160e46c60f4f57c12facc0b2575571d7220fa

SHA256
0048ab300c6ed6ac61084c54c9d1dfab5338e54b9cfb5fb6a2a765bde03b2191

SHA512
e9c85a7276b2242d79fe5b48fe4bfc63bb02a189d1f5860aa18361359b577e594e91d70070c9ca89b0876462fa8574d8ddb5f3d74b3f32f4fb9a000127e4ac56

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E91.exe

Filesize
312KB

MD5
e6064fdee64cf67d083a2f1d16e6ad5b

SHA1
281160e46c60f4f57c12facc0b2575571d7220fa

SHA256
0048ab300c6ed6ac61084c54c9d1dfab5338e54b9cfb5fb6a2a765bde03b2191

SHA512
e9c85a7276b2242d79fe5b48fe4bfc63bb02a189d1f5860aa18361359b577e594e91d70070c9ca89b0876462fa8574d8ddb5f3d74b3f32f4fb9a000127e4ac56

Download Submit
C:\Users\Admin\AppData\Local\Temp\C6C0.exe

Filesize
250KB

MD5
4ad7575406e8edd4e420fe106f7f0535

SHA1
4ca22b00893215644ac15ee6275339620cbcd4f9

SHA256
f1c6f74454ef5498046786e089c3fda9e44ec54045314878b8544ffbc9530a44

SHA512
7386ccd0ccc11abe0eeaf523c3c98060f292eabd04d64329000cb950dea4453dcec6c16d71d5d7a5b2fbd9990bcc815a4b5b7ebf5c3deefd2433b8b98459b471

Download Submit
C:\Users\Admin\AppData\Local\Temp\C6C0.exe

Filesize
250KB

MD5
4ad7575406e8edd4e420fe106f7f0535

SHA1
4ca22b00893215644ac15ee6275339620cbcd4f9

SHA256
f1c6f74454ef5498046786e089c3fda9e44ec54045314878b8544ffbc9530a44

SHA512
7386ccd0ccc11abe0eeaf523c3c98060f292eabd04d64329000cb950dea4453dcec6c16d71d5d7a5b2fbd9990bcc815a4b5b7ebf5c3deefd2433b8b98459b471

Download Submit
C:\Users\Admin\AppData\Local\Temp\C866.exe

Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\C866.exe

Filesize
259KB

MD5
dab7f5c16d3e413a803bf720f9d51cbb

SHA1
dd1a42dc9d8da48627914baf08deab51f5c44687

SHA256
d3c2e2eb1751e0017a6bcbdb81494f52c80a675d3d4d3d7dfce16be57d776b80

SHA512
02e27f601a531d6543b6f16be776bbf08714218ed599ae9fd5e04d87acf176da74fc8cf075d796fc36f240ce677c43b68a3a6e0d3ac1fb788c98c825885c8d7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF5A.exe

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\DF5A.exe

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Users\Admin\AppData\Local\Temp\E0E2.exe

Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E0E2.exe

Filesize
259KB

MD5
207c334a91a12299e376c22995479de3

SHA1
51936c1ecf3525c88e924656d2e83c3cee3b0e42

SHA256
6812deb6d1f5c8a6c4ffffdadf4372cc78626fdddda416084f82ddd167a6ff1d

SHA512
133d8affbe0dd0661c9f48692fa38c951d21a4327eda0db474cdf6014943bfa0b605a458a33191e821c3e15150c986975e53cbd7a25633f9d7b3f7f8cfec096f

Download Submit
C:\Users\Admin\AppData\Local\Temp\F67E.exe

Filesize
4.3MB

MD5
2546be1f997c39b02143a5908ac7bec9

SHA1
7b6c80b8b0288ec37430a8c5662c1f92dd46f11d

SHA256
24e2f026cb22f7dd672b369b91c75847d66976c787142599a2ed8669f1666ed2

SHA512
016a5fc1a01b4e35cbf7873d2aba6e8801551ed1d9764b35ea383def83e60b50ae779814c51981d55c9b098c5d33933e360a0752e3855ed9c64e790ba388d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\F67E.exe

Filesize
4.3MB

MD5
2546be1f997c39b02143a5908ac7bec9

SHA1
7b6c80b8b0288ec37430a8c5662c1f92dd46f11d

SHA256
24e2f026cb22f7dd672b369b91c75847d66976c787142599a2ed8669f1666ed2

SHA512
016a5fc1a01b4e35cbf7873d2aba6e8801551ed1d9764b35ea383def83e60b50ae779814c51981d55c9b098c5d33933e360a0752e3855ed9c64e790ba388d179

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDB3.exe

Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDB3.exe

Filesize
4.5MB

MD5
369e7a430bab9b7a043b5ea1bd1496b2

SHA1
23eb3090bc77349f079ef516024bac184c9afdcf

SHA256
78b695c863e73f5bf4578d440dd5f109af68e8a6b76984bded546650045f5cb3

SHA512
27204fabb8903eaba505cb0b08c0d3e19bb3fa9c02846bf45969009d112345f67a2d12b6a755d448db5a315fbb965c260ed7eafaaae052a777028745ea7aa2e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Player3.exe

Filesize
244KB

MD5
43a3e1c9723e124a9b495cd474a05dcb

SHA1
d293f427eaa8efc18bb8929a9f54fb61e03bdd89

SHA256
619bbbc9e9ddd1f6b7961cacb33d99c8f558499a33751b28d91085aab8cb95ab

SHA512
6717d6be0f25d66ba3689b703b9f1360c172138faa0172168c531f55eb217050c03a41396b7a440e899974d71c2f42b41d07db0ef97751c420facfae1550bfa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\XandETC.exe

Filesize
3.7MB

MD5
3006b49f3a30a80bb85074c279acc7df

SHA1
728a7a867d13ad0034c29283939d94f0df6c19df

SHA256
f283b4c0ad4a902e1cb64201742ca4c5118f275e7b911a7dafda1ef01b825280

SHA512
e8fc5791892d7f08af5a33462a11d39d29b5e86a62cbf135b12e71f2fcaaa48d40d5e3238f64e17a2f126bcfb9d70553a02d30dc60a89f1089b2c1e7465105dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iedifg0y.xkb.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ss31.exe

Filesize
592KB

MD5
f7f9e101d55de528903e5214db5abe48

SHA1
70d276e53fb4bf479cf7c229a1ada9f72ccc344e

SHA256
2b8975d530e037d398ef15d6e53345672e2c23c8ed99d9efb4a75503353b39f4

SHA512
d3960fdb74bb86247077c239cf9b9643212ba71a5f0fed2c2134d50712442373227ad4fd80e7f1f125da0e082a026355a5179da7de69acb21ff9ea7869bfb05b

Download Submit
C:\Users\Admin\AppData\Local\a214f52c-cce7-46da-8cc1-9c6b92202632\16D.exe

Filesize
759KB

MD5
f194ac765ef33c0ea9492348021eddc3

SHA1
1d821007587e84e9516a3c6cfc6d05221e728614

SHA256
b8f105a2506e754dc7504e9f44714d5c5550fcb723e589dc70ed5d5e1de4559d

SHA512
2276dbcdad0c6c6ca3a7afce80b809da613150166b0e842a090d7a063ca902c9b5b5fbad718710f61aa096b3a1503237b66cd130cdcb4358791db8273cc54d94

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\cvccaau

Filesize
250KB

MD5
4ad7575406e8edd4e420fe106f7f0535

SHA1
4ca22b00893215644ac15ee6275339620cbcd4f9

SHA256
f1c6f74454ef5498046786e089c3fda9e44ec54045314878b8544ffbc9530a44

SHA512
7386ccd0ccc11abe0eeaf523c3c98060f292eabd04d64329000cb950dea4453dcec6c16d71d5d7a5b2fbd9990bcc815a4b5b7ebf5c3deefd2433b8b98459b471

Download Submit
C:\Users\Admin\AppData\Roaming\duccaau

Filesize
250KB

MD5
b23a1e7b01f2e386571ced85ed8ffc28

SHA1
ede627702d238afa3c6e6dd5d0c21843a06b32cc

SHA256
0047268fc9cde6cc323a33d6a3d7a3980d885d215bb853c2e8cbf77ad5f40347

SHA512
f2870987b8a0a74a773da4827828422b0646d9eeeea9d2fdaad02a517e7a13ff7f21bee8d8b7100edae7468671b5bcf0e1228974862b6974d65679afe58e6c06

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
811d351aabd7b708fef7683cf5e29e15

SHA1
06fd89e5a575f45d411cf4b3a2d277e642e73dbb

SHA256
0915139ab02088c3932bcc062ce22d4e9c81aa6df0eacd62900d73d7ad2d3b18

SHA512
702d847c2aa3c9526ddf34249de06e58f5e3182d6ef66f77ddbdbbd2e9836026da6eacac2c892cf186d79bdc227a85c14f493b746c03233ef8820d981721c70a

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
302a7c179ef577c237c5418fb770fd27

SHA1
343ef00d1357a8d2ff6e1143541a8a29435ed30c

SHA256
9e6b50764916c21c41d6e7c4999bdf27120c069ec7a9268100e1ce5df845149f

SHA512
f2472371a322d0352772defb959ea0a9da0d5ca8f412f6abafac2e6547bcc8a53394a6fb81b488521fc256bfc9f3205d92c6b69d6d139bdb260fb46578946699

Download Submit
memory/520-230-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-223-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-236-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-238-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-239-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-245-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-224-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-229-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-254-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/520-222-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/600-1142-0x0000000000C10000-0x0000000000C1C000-memory.dmp

Filesize
48KB

Download
memory/600-1143-0x0000000002F00000-0x0000000002F27000-memory.dmp

Filesize
156KB

Download
memory/884-1148-0x0000000002F00000-0x0000000002F27000-memory.dmp

Filesize
156KB

Download
memory/884-1149-0x00000000007F0000-0x00000000007F9000-memory.dmp

Filesize
36KB

Download
memory/884-1203-0x0000000002F00000-0x0000000002F27000-memory.dmp

Filesize
156KB

Download
memory/992-262-0x00007FF674F20000-0x00007FF6752DD000-memory.dmp

Filesize
3.7MB

Download
memory/1296-292-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1296-306-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-276-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-277-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-279-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-281-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-283-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-286-0x0000000000970000-0x00000000009D2000-memory.dmp

Filesize
392KB

Download
memory/1296-288-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-290-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1296-291-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-274-0x0000000004DB0000-0x00000000052AE000-memory.dmp

Filesize
5.0MB

Download
memory/1296-287-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1296-294-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-296-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-298-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-300-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-302-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-304-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-275-0x0000000004CE0000-0x0000000004D36000-memory.dmp

Filesize
344KB

Download
memory/1296-308-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-310-0x0000000004CE0000-0x0000000004D32000-memory.dmp

Filesize
328KB

Download
memory/1296-1073-0x00000000052B0000-0x00000000058B6000-memory.dmp

Filesize
6.0MB

Download
memory/1296-1075-0x00000000058F0000-0x0000000005902000-memory.dmp

Filesize
72KB

Download
memory/1296-1078-0x0000000005920000-0x0000000005A2A000-memory.dmp

Filesize
1.0MB

Download
memory/1296-1079-0x0000000005A30000-0x0000000005A6E000-memory.dmp

Filesize
248KB

Download
memory/1296-1080-0x0000000005AC0000-0x0000000005B0B000-memory.dmp

Filesize
300KB

Download
memory/1296-1081-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1296-271-0x00000000024F0000-0x000000000254A000-memory.dmp

Filesize
360KB

Download
memory/1296-1087-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Filesize
408KB

Download
memory/1296-1093-0x0000000006B60000-0x0000000006BF2000-memory.dmp

Filesize
584KB

Download
memory/1296-1097-0x0000000006D10000-0x0000000006D86000-memory.dmp

Filesize
472KB

Download
memory/1296-1098-0x0000000006DB0000-0x0000000006DCE000-memory.dmp

Filesize
120KB

Download
memory/1296-1102-0x0000000006E80000-0x0000000006ED0000-memory.dmp

Filesize
320KB

Download
memory/1296-1103-0x0000000006F00000-0x00000000070C2000-memory.dmp

Filesize
1.8MB

Download
memory/1296-1104-0x00000000070D0000-0x00000000075FC000-memory.dmp

Filesize
5.2MB

Download
memory/1296-1109-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1296-1110-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1296-1111-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/1652-1133-0x0000000000870000-0x000000000089E000-memory.dmp

Filesize
184KB

Download
memory/1652-1134-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/1652-1172-0x0000000000870000-0x000000000089E000-memory.dmp

Filesize
184KB

Download
memory/2000-1154-0x0000000000160000-0x000000000016B000-memory.dmp

Filesize
44KB

Download
memory/2000-1153-0x00000000007F0000-0x00000000007F9000-memory.dmp

Filesize
36KB

Download
memory/2000-1230-0x00000000007F0000-0x00000000007F9000-memory.dmp

Filesize
36KB

Download
memory/2052-1263-0x0000024A453F0000-0x0000024A45400000-memory.dmp

Filesize
64KB

Download
memory/2052-1264-0x0000024A453F0000-0x0000024A45400000-memory.dmp

Filesize
64KB

Download
memory/2252-213-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/2396-1157-0x0000000000160000-0x000000000016B000-memory.dmp

Filesize
44KB

Download
memory/2396-1262-0x0000000000160000-0x000000000016B000-memory.dmp

Filesize
44KB

Download
memory/2396-1158-0x0000000000CF0000-0x0000000000CFD000-memory.dmp

Filesize
52KB

Download
memory/2452-1163-0x0000000002FF0000-0x0000000002FFB000-memory.dmp

Filesize
44KB

Download
memory/2452-1162-0x0000000000CF0000-0x0000000000CFD000-memory.dmp

Filesize
52KB

Download
memory/3012-171-0x0000000000D70000-0x0000000001200000-memory.dmp

Filesize
4.6MB

Download
memory/3208-157-0x0000000001140000-0x0000000001156000-memory.dmp

Filesize
88KB

Download
memory/3208-122-0x0000000000F10000-0x0000000000F26000-memory.dmp

Filesize
88KB

Download
memory/3208-141-0x0000000001170000-0x0000000001186000-memory.dmp

Filesize
88KB

Download
memory/3628-123-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/3628-121-0x0000000000870000-0x0000000000879000-memory.dmp

Filesize
36KB

Download
memory/3896-202-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3896-215-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3896-201-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3896-196-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3896-199-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3916-156-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download
memory/3948-1132-0x0000000000870000-0x000000000089E000-memory.dmp

Filesize
184KB

Download
memory/3952-139-0x0000000000720000-0x0000000000729000-memory.dmp

Filesize
36KB

Download
memory/3952-143-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/4040-1119-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/4040-1167-0x0000000004DA0000-0x0000000004DB0000-memory.dmp

Filesize
64KB

Download
memory/4040-1120-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/4164-155-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/4164-158-0x0000000000400000-0x0000000000702000-memory.dmp

Filesize
3.0MB

Download
memory/4188-1139-0x0000000000C10000-0x0000000000C1C000-memory.dmp

Filesize
48KB

Download
memory/4188-1138-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/4188-1175-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/4656-165-0x0000000000240000-0x000000000068A000-memory.dmp

Filesize
4.3MB

Download
memory/4776-200-0x0000000002460000-0x000000000257B000-memory.dmp

Filesize
1.1MB

Download
memory/4952-1183-0x0000019DAAE80000-0x0000019DAAEA2000-memory.dmp

Filesize
136KB

Download
memory/4952-1231-0x0000019D92830000-0x0000019D92840000-memory.dmp

Filesize
64KB

Download
memory/4952-1204-0x0000019D92830000-0x0000019D92840000-memory.dmp

Filesize
64KB

Download
memory/4952-1205-0x0000019D92830000-0x0000019D92840000-memory.dmp

Filesize
64KB

Download
memory/4952-1187-0x0000019DAB9D0000-0x0000019DABA46000-memory.dmp

Filesize
472KB

Download
memory/5112-1171-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download
memory/5112-1123-0x0000000000B20000-0x0000000000B2F000-memory.dmp

Filesize
60KB

Download
memory/5112-1122-0x0000000000170000-0x000000000017B000-memory.dmp

Filesize
44KB

Download