amadey | 9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847

Analysis

max time kernel
300s
max time network
303s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
29-07-2023 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe
Size

6.5MB
MD5

89e9bc7a5d97370a0f4a35041a54a696
SHA1

c0e8572f48b2e5f83c39374f4175e35a5e7c2029
SHA256

9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847
SHA512

12100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2
SSDEEP

196608:3PbBDSjGzSuyKff2j6pdVY3d2dZo2tOuAX+W6+B6VJN1lev:3JKGzXuTwdZdLM+JS

Score

10^/10

amadey laplas redline clipper evasion infostealer persistence spyware stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

3.80

45.15.156.208/jd9dd3Vw/index.php

second.amadgood.com/jd9dd3Vw/index.php

Extracted

Family

laplas

http://206.189.229.43

Attributes

api_key
f52a5c9bc5eb2f51b22f04f3e85c301ac0170a650de6044773f0a8309fbdfb79

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Laplas Clipper
Laplas is a crypto wallet stealer with three variants written in Golang, C#, and C++.
stealer clipper laplas
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/4132-234-0x0000000000400000-0x000000000045A000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs

description	pid	Process	procid_target
PID 4804 created 3272	4804	rdpcllp.exe	60
PID 4804 created 3272	4804	rdpcllp.exe	60
PID 4804 created 3272	4804	rdpcllp.exe	60
PID 4804 created 3272	4804	rdpcllp.exe	60
PID 4804 created 3272	4804	rdpcllp.exe	60
PID 1384 created 3272	1384	updater.exe	60
PID 1384 created 3272	1384	updater.exe	60
PID 1384 created 3272	1384	updater.exe	60
PID 1384 created 3272	1384	updater.exe	60
PID 1384 created 3272	1384	updater.exe	60
PID 1384 created 3272	1384	updater.exe	60

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rdpcllp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostclp.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ntlhost.exe

Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	rdpcllp.exe
File created	C:\Windows\System32\drivers\etc\hosts	updater.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rdpcllp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rdpcllp.exe

Executes dropped EXE 7 IoCs

pid	Process
1432	oneetx.exe
3444	taskmask.exe
4804	rdpcllp.exe
4152	taskhostclp.exe
2564	oneetx.exe
1316	ntlhost.exe
1384	updater.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x000600000001affe-173.dat	themida
behavioral2/files/0x000600000001affe-180.dat	themida
behavioral2/memory/4804-181-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-182-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-198-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-200-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-201-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-202-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-203-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-204-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-260-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/memory/4804-366-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/files/0x000600000001affe-385.dat	themida
behavioral2/memory/4804-388-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp	themida
behavioral2/files/0x000700000001b009-392.dat	themida
behavioral2/memory/1384-397-0x00007FF72E5C0000-0x00007FF72F40A000-memory.dmp	themida
behavioral2/files/0x000700000001b009-784.dat	themida

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1148472871-1113856141-1322182616-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe"	taskhostclp.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpcllp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostclp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntlhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4804	rdpcllp.exe
4152	taskhostclp.exe
1316	ntlhost.exe
1384	updater.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3444 set thread context of 4132	3444	taskmask.exe	86
PID 1384 set thread context of 2328	1384	updater.exe	129
PID 1384 set thread context of 4992	1384	updater.exe	130

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Google\Chrome\updater.exe	rdpcllp.exe
File created	C:\Program Files\Google\Libs\WR64.sys	updater.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4524	sc.exe
3100	sc.exe
1564	sc.exe
524	sc.exe
2056	sc.exe
4152	sc.exe
1592	sc.exe
4812	sc.exe
3924	sc.exe
4840	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3784	schtasks.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	13	Go-http-client/1.1

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3752	9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe
3752	9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe
1432	oneetx.exe
1432	oneetx.exe
3444	taskmask.exe
3444	taskmask.exe
3444	taskmask.exe
3444	taskmask.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
836	powershell.exe
836	powershell.exe
836	powershell.exe
4132	aspnet_compiler.exe
4132	aspnet_compiler.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
5040	powershell.exe
5040	powershell.exe
5040	powershell.exe
4804	rdpcllp.exe
4804	rdpcllp.exe
2564	oneetx.exe
2564	oneetx.exe
1384	updater.exe
1384	updater.exe
68	powershell.exe
68	powershell.exe
68	powershell.exe
1384	updater.exe
1384	updater.exe
1384	updater.exe
1384	updater.exe
1384	updater.exe
1384	updater.exe
3628	powershell.exe
3628	powershell.exe
3628	powershell.exe
1384	updater.exe
1384	updater.exe
1384	updater.exe
1384	updater.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe
4992	explorer.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
628	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3444	taskmask.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeDebugPrivilege	4132	aspnet_compiler.exe
Token: SeIncreaseQuotaPrivilege	836	powershell.exe
Token: SeSecurityPrivilege	836	powershell.exe
Token: SeTakeOwnershipPrivilege	836	powershell.exe
Token: SeLoadDriverPrivilege	836	powershell.exe
Token: SeSystemProfilePrivilege	836	powershell.exe
Token: SeSystemtimePrivilege	836	powershell.exe
Token: SeProfSingleProcessPrivilege	836	powershell.exe
Token: SeIncBasePriorityPrivilege	836	powershell.exe
Token: SeCreatePagefilePrivilege	836	powershell.exe
Token: SeBackupPrivilege	836	powershell.exe
Token: SeRestorePrivilege	836	powershell.exe
Token: SeShutdownPrivilege	836	powershell.exe
Token: SeDebugPrivilege	836	powershell.exe
Token: SeSystemEnvironmentPrivilege	836	powershell.exe
Token: SeRemoteShutdownPrivilege	836	powershell.exe
Token: SeUndockPrivilege	836	powershell.exe
Token: SeManageVolumePrivilege	836	powershell.exe
Token: 33	836	powershell.exe
Token: 34	836	powershell.exe
Token: 35	836	powershell.exe
Token: 36	836	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeShutdownPrivilege	2352	powercfg.exe
Token: SeCreatePagefilePrivilege	2352	powercfg.exe
Token: SeShutdownPrivilege	2572	powercfg.exe
Token: SeCreatePagefilePrivilege	2572	powercfg.exe
Token: SeShutdownPrivilege	3140	powercfg.exe
Token: SeCreatePagefilePrivilege	3140	powercfg.exe
Token: SeShutdownPrivilege	2204	powercfg.exe
Token: SeCreatePagefilePrivilege	2204	powercfg.exe
Token: SeIncreaseQuotaPrivilege	5040	powershell.exe
Token: SeSecurityPrivilege	5040	powershell.exe
Token: SeTakeOwnershipPrivilege	5040	powershell.exe
Token: SeLoadDriverPrivilege	5040	powershell.exe
Token: SeSystemProfilePrivilege	5040	powershell.exe
Token: SeSystemtimePrivilege	5040	powershell.exe
Token: SeProfSingleProcessPrivilege	5040	powershell.exe
Token: SeIncBasePriorityPrivilege	5040	powershell.exe
Token: SeCreatePagefilePrivilege	5040	powershell.exe
Token: SeBackupPrivilege	5040	powershell.exe
Token: SeRestorePrivilege	5040	powershell.exe
Token: SeShutdownPrivilege	5040	powershell.exe
Token: SeDebugPrivilege	5040	powershell.exe
Token: SeSystemEnvironmentPrivilege	5040	powershell.exe
Token: SeRemoteShutdownPrivilege	5040	powershell.exe
Token: SeUndockPrivilege	5040	powershell.exe
Token: SeManageVolumePrivilege	5040	powershell.exe
Token: 33	5040	powershell.exe
Token: 34	5040	powershell.exe
Token: 35	5040	powershell.exe
Token: 36	5040	powershell.exe
Token: SeIncreaseQuotaPrivilege	5040	powershell.exe
Token: SeSecurityPrivilege	5040	powershell.exe
Token: SeTakeOwnershipPrivilege	5040	powershell.exe
Token: SeLoadDriverPrivilege	5040	powershell.exe
Token: SeSystemProfilePrivilege	5040	powershell.exe
Token: SeSystemtimePrivilege	5040	powershell.exe
Token: SeProfSingleProcessPrivilege	5040	powershell.exe
Token: SeIncBasePriorityPrivilege	5040	powershell.exe
Token: SeCreatePagefilePrivilege	5040	powershell.exe
Token: SeBackupPrivilege	5040	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3752	9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 1432	3752	9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe	70
PID 3752 wrote to memory of 1432	3752	9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe	70
PID 3752 wrote to memory of 1432	3752	9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe	70
PID 1432 wrote to memory of 3784	1432	oneetx.exe	71
PID 1432 wrote to memory of 3784	1432	oneetx.exe	71
PID 1432 wrote to memory of 3784	1432	oneetx.exe	71
PID 1432 wrote to memory of 3100	1432	oneetx.exe	73
PID 1432 wrote to memory of 3100	1432	oneetx.exe	73
PID 1432 wrote to memory of 3100	1432	oneetx.exe	73
PID 3100 wrote to memory of 3456	3100	cmd.exe	75
PID 3100 wrote to memory of 3456	3100	cmd.exe	75
PID 3100 wrote to memory of 3456	3100	cmd.exe	75
PID 3100 wrote to memory of 2256	3100	cmd.exe	76
PID 3100 wrote to memory of 2256	3100	cmd.exe	76
PID 3100 wrote to memory of 2256	3100	cmd.exe	76
PID 3100 wrote to memory of 2216	3100	cmd.exe	77
PID 3100 wrote to memory of 2216	3100	cmd.exe	77
PID 3100 wrote to memory of 2216	3100	cmd.exe	77
PID 3100 wrote to memory of 4460	3100	cmd.exe	78
PID 3100 wrote to memory of 4460	3100	cmd.exe	78
PID 3100 wrote to memory of 4460	3100	cmd.exe	78
PID 3100 wrote to memory of 2328	3100	cmd.exe	79
PID 3100 wrote to memory of 2328	3100	cmd.exe	79
PID 3100 wrote to memory of 2328	3100	cmd.exe	79
PID 3100 wrote to memory of 2572	3100	cmd.exe	80
PID 3100 wrote to memory of 2572	3100	cmd.exe	80
PID 3100 wrote to memory of 2572	3100	cmd.exe	80
PID 1432 wrote to memory of 3444	1432	oneetx.exe	81
PID 1432 wrote to memory of 3444	1432	oneetx.exe	81
PID 1432 wrote to memory of 3444	1432	oneetx.exe	81
PID 1432 wrote to memory of 4804	1432	oneetx.exe	82
PID 1432 wrote to memory of 4804	1432	oneetx.exe	82
PID 1432 wrote to memory of 4152	1432	oneetx.exe	83
PID 1432 wrote to memory of 4152	1432	oneetx.exe	83
PID 3444 wrote to memory of 200	3444	taskmask.exe	84
PID 3444 wrote to memory of 200	3444	taskmask.exe	84
PID 3444 wrote to memory of 200	3444	taskmask.exe	84
PID 3444 wrote to memory of 5028	3444	taskmask.exe	85
PID 3444 wrote to memory of 5028	3444	taskmask.exe	85
PID 3444 wrote to memory of 5028	3444	taskmask.exe	85
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 3444 wrote to memory of 4132	3444	taskmask.exe	86
PID 4048 wrote to memory of 4812	4048	cmd.exe	95
PID 4048 wrote to memory of 4812	4048	cmd.exe	95
PID 4048 wrote to memory of 1564	4048	cmd.exe	96
PID 4048 wrote to memory of 1564	4048	cmd.exe	96
PID 4048 wrote to memory of 524	4048	cmd.exe	97
PID 4048 wrote to memory of 524	4048	cmd.exe	97
PID 4048 wrote to memory of 3924	4048	cmd.exe	98
PID 4048 wrote to memory of 3924	4048	cmd.exe	98
PID 4048 wrote to memory of 2056	4048	cmd.exe	99
PID 4048 wrote to memory of 2056	4048	cmd.exe	99
PID 4116 wrote to memory of 2352	4116	cmd.exe	104
PID 4116 wrote to memory of 2352	4116	cmd.exe	104
PID 4116 wrote to memory of 2572	4116	cmd.exe	105
PID 4116 wrote to memory of 2572	4116	cmd.exe	105
PID 4116 wrote to memory of 3140	4116	cmd.exe	106
PID 4116 wrote to memory of 3140	4116	cmd.exe	106

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3272
- C:\Users\Admin\AppData\Local\Temp\9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe
  "C:\Users\Admin\AppData\Local\Temp\9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3784
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\eb0f58bce7" /P "Admin:N"&&CACLS "..\eb0f58bce7" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:3456
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:2256
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:2216
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4460
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\eb0f58bce7" /P "Admin:N"
        5⤵
        
        PID:2328
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\eb0f58bce7" /P "Admin:R" /E
        5⤵
        
        PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\1000127001\taskmask.exe
      "C:\Users\Admin\AppData\Local\Temp\1000127001\taskmask.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:200
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        
        PID:5028
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\1000128101\rdpcllp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000128101\rdpcllp.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Drops file in Drivers directory
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\1000129001\taskhostclp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000129001\taskhostclp.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:4152
    - - C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        
        C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:1316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4812
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1564
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:524
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:3924
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:2056
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5040
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2352
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2572
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3140
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2204
- C:\Windows\System32\schtasks.exe
  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
  2⤵
  PID:4328
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:68
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
  2⤵
  PID:4912
- - C:\Windows\System32\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    PID:4152
- - C:\Windows\System32\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    PID:1592
- - C:\Windows\System32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:4524
- - C:\Windows\System32\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    PID:4840
- - C:\Windows\System32\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    PID:3100
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
  2⤵
  PID:2216
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-ac 0
    3⤵
    PID:3452
- - C:\Windows\System32\powercfg.exe
    powercfg /x -hibernate-timeout-dc 0
    3⤵
    PID:2748
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-ac 0
    3⤵
    PID:1504
- - C:\Windows\System32\powercfg.exe
    powercfg /x -standby-timeout-dc 0
    3⤵
    PID:4984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#fyhjjuwy#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Windows\System32\conhost.exe
  C:\Windows\System32\conhost.exe
  2⤵
  PID:2328
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4992

C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2564

C:\Program Files\Google\Chrome\updater.exe
"C:\Program Files\Google\Chrome\updater.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:1384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Google\Chrome\updater.exe

Filesize
8.4MB

MD5
768200a76def472e675539094047bed9

SHA1
24bc17689541656a8a12902c7f19bd991193ca50

SHA256
79ff7ea339f95a557cec5e39d944118af6c105c29736e448d5aad60368eae5af

SHA512
143cfc563ebd3f57192adc4484ba0b4b246c4b63d3f10b0e90e83ea841ea83488636233eb58a8217fd1a9dd825075f28e0b1f858bc9e4a5fd5abb6e0712fabbb

Download Submit
C:\Program Files\Google\Chrome\updater.exe

Filesize
8.4MB

MD5
768200a76def472e675539094047bed9

SHA1
24bc17689541656a8a12902c7f19bd991193ca50

SHA256
79ff7ea339f95a557cec5e39d944118af6c105c29736e448d5aad60368eae5af

SHA512
143cfc563ebd3f57192adc4484ba0b4b246c4b63d3f10b0e90e83ea841ea83488636233eb58a8217fd1a9dd825075f28e0b1f858bc9e4a5fd5abb6e0712fabbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
3a3b478be233e5a021e8d23a4c78e262

SHA1
3098e038146c5a4186c24d2c92dba034abad77fd

SHA256
8eaa61f261f7f63a6cd8cd35c2930aa12faffd28fed94e15006fb5e47cf341a2

SHA512
b3e2a4b293edea053b71e7ae724feb1c995ea129b7adfd2851d595d721da15ca33a8500743d8a7083ad622c5c003d3153b8a4d0747e51fb9d8fe610bc67cbc3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000127001\taskmask.exe

Filesize
2.2MB

MD5
e899a1808b9ca1b53992dd68df084265

SHA1
2d7982b52e43461943748c280e166f707627e4f6

SHA256
d3e44f4d004dd23433f3dbeb1532b853b645b6e213b0c5f5eee9a786bf0b762c

SHA512
1d5796d8a3b911620393b2cce990cca5a94b0f440fbee1a8e43df54cbdb3dcf4cc7f8bbdc26246f1ecd6c77ace007fbad830fbbaf63a9c697254d5f85ce2acf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000127001\taskmask.exe

Filesize
2.2MB

MD5
e899a1808b9ca1b53992dd68df084265

SHA1
2d7982b52e43461943748c280e166f707627e4f6

SHA256
d3e44f4d004dd23433f3dbeb1532b853b645b6e213b0c5f5eee9a786bf0b762c

SHA512
1d5796d8a3b911620393b2cce990cca5a94b0f440fbee1a8e43df54cbdb3dcf4cc7f8bbdc26246f1ecd6c77ace007fbad830fbbaf63a9c697254d5f85ce2acf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000127001\taskmask.exe

Filesize
2.2MB

MD5
e899a1808b9ca1b53992dd68df084265

SHA1
2d7982b52e43461943748c280e166f707627e4f6

SHA256
d3e44f4d004dd23433f3dbeb1532b853b645b6e213b0c5f5eee9a786bf0b762c

SHA512
1d5796d8a3b911620393b2cce990cca5a94b0f440fbee1a8e43df54cbdb3dcf4cc7f8bbdc26246f1ecd6c77ace007fbad830fbbaf63a9c697254d5f85ce2acf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000128101\rdpcllp.exe

Filesize
8.4MB

MD5
768200a76def472e675539094047bed9

SHA1
24bc17689541656a8a12902c7f19bd991193ca50

SHA256
79ff7ea339f95a557cec5e39d944118af6c105c29736e448d5aad60368eae5af

SHA512
143cfc563ebd3f57192adc4484ba0b4b246c4b63d3f10b0e90e83ea841ea83488636233eb58a8217fd1a9dd825075f28e0b1f858bc9e4a5fd5abb6e0712fabbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000128101\rdpcllp.exe

Filesize
8.4MB

MD5
768200a76def472e675539094047bed9

SHA1
24bc17689541656a8a12902c7f19bd991193ca50

SHA256
79ff7ea339f95a557cec5e39d944118af6c105c29736e448d5aad60368eae5af

SHA512
143cfc563ebd3f57192adc4484ba0b4b246c4b63d3f10b0e90e83ea841ea83488636233eb58a8217fd1a9dd825075f28e0b1f858bc9e4a5fd5abb6e0712fabbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000128101\rdpcllp.exe

Filesize
8.4MB

MD5
768200a76def472e675539094047bed9

SHA1
24bc17689541656a8a12902c7f19bd991193ca50

SHA256
79ff7ea339f95a557cec5e39d944118af6c105c29736e448d5aad60368eae5af

SHA512
143cfc563ebd3f57192adc4484ba0b4b246c4b63d3f10b0e90e83ea841ea83488636233eb58a8217fd1a9dd825075f28e0b1f858bc9e4a5fd5abb6e0712fabbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000129001\taskhostclp.exe

Filesize
4.0MB

MD5
3258deefff3ca70f3dfa3e67067ca611

SHA1
a28ec103c22b03f381dd72073cf620b11881b7b7

SHA256
11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

SHA512
541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000129001\taskhostclp.exe

Filesize
4.0MB

MD5
3258deefff3ca70f3dfa3e67067ca611

SHA1
a28ec103c22b03f381dd72073cf620b11881b7b7

SHA256
11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

SHA512
541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000129001\taskhostclp.exe

Filesize
4.0MB

MD5
3258deefff3ca70f3dfa3e67067ca611

SHA1
a28ec103c22b03f381dd72073cf620b11881b7b7

SHA256
11c3e7a62b3e78c6ec720aea618bf0a3854ad42535f888532c3e206f3724db4c

SHA512
541eec13adbb3afcc6ee0cfea2d1ddd71036a0da9be5fe6919a2becca5dc23089754d2e5bfd15886cd8e3981f982e40d28bb467132cfdf04844d930ca612b3b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\148472871111

Filesize
71KB

MD5
08bca14f9665e531d134ede3f5e67903

SHA1
9293b10128d06c63b519b0c116b11f1884477578

SHA256
a00bad50528a4c4b717ada6f76c38546f54bf64acd809d6265282e3f279032ba

SHA512
1a362d5ee037f21e4a284d7cf7ed829e055a87164432c570fbef61dab1965daca98f4a2b07ff47327ddbffc375fe182a03ee7574d06dd428cf8eae2c10c1c79b

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fblvsv15.mta.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.5MB

MD5
89e9bc7a5d97370a0f4a35041a54a696

SHA1
c0e8572f48b2e5f83c39374f4175e35a5e7c2029

SHA256
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847

SHA512
12100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.5MB

MD5
89e9bc7a5d97370a0f4a35041a54a696

SHA1
c0e8572f48b2e5f83c39374f4175e35a5e7c2029

SHA256
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847

SHA512
12100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.5MB

MD5
89e9bc7a5d97370a0f4a35041a54a696

SHA1
c0e8572f48b2e5f83c39374f4175e35a5e7c2029

SHA256
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847

SHA512
12100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\eb0f58bce7\oneetx.exe

Filesize
6.5MB

MD5
89e9bc7a5d97370a0f4a35041a54a696

SHA1
c0e8572f48b2e5f83c39374f4175e35a5e7c2029

SHA256
9b6b6c5cf8dbafd06176a1f8e5a7cf7fc78a5ffb86df627e6de4eb455506b847

SHA512
12100def3ac697a0fce815a3be2e41bb62f47f8a60b273c3cf367096c231c86110903322d8f351d8609f7f5f72f5aaf45d6539e09972c54221697820ece570f2

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
836.0MB

MD5
2f75eb4060f276ad55e2476f80acd9bb

SHA1
354f3ec64ea5635b708d974b6f6544241a6968d0

SHA256
3534a8ae56136f143b10c7781f7fa9f6832fcdd5bd07efeabbd56b0fea974ac6

SHA512
24962d877999f19dfa29f9f927b7fd5ad37587ada486919a4b2b49942331169b7e3e7033c9c60e9e468fde1aae0fcc11a5a0c92193ccbc61ce0b7ca89f0c9820

Download Submit
C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Filesize
836.0MB

MD5
2f75eb4060f276ad55e2476f80acd9bb

SHA1
354f3ec64ea5635b708d974b6f6544241a6968d0

SHA256
3534a8ae56136f143b10c7781f7fa9f6832fcdd5bd07efeabbd56b0fea974ac6

SHA512
24962d877999f19dfa29f9f927b7fd5ad37587ada486919a4b2b49942331169b7e3e7033c9c60e9e468fde1aae0fcc11a5a0c92193ccbc61ce0b7ca89f0c9820

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
3KB

MD5
00930b40cba79465b7a38ed0449d1449

SHA1
4b25a89ee28b20ba162f23772ddaf017669092a5

SHA256
eda1aae2c8fce700e3bdbe0186cf3db88400cf0ac13ec736e84dacba61628a01

SHA512
cbe4760ec041e7da7ab86474d5c82969cfccb8ccc5dbdac9436862d5b1b86210ab90754d3c8da5724176570d8842e57a716a281acba8719e90098a6f61a17c62

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
573d77d4e77a445f5db769812a0be865

SHA1
7473d15ef2d3c6894edefd472f411c8e3209a99c

SHA256
5ec3f268845a50e309ae0d80bcee4f4dd4cd1b279ab1e64b523a057c11074f1c

SHA512
af2422a9790a91cdcbe39e6ef6d17899c2cbd4159b1b71ac56f633015068d3afc678fcef34892575bf59bdf7d5914ec6070864940d44130263fe84e28abba2dc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
15KB

MD5
5f5aa607657efd596f2ba27625bb7ed4

SHA1
6818e799afcb486fa9416eb29468c10f7a051d88

SHA256
f5a8fbb9d69c35df83b4721a580777a6d7f748965b8db902257a73a2d48b787b

SHA512
0b6d87751aaa6da840f932e718d1444e0b7d033f3eecfac988a9b9e4266370d852d7a5f28d65526968807fe56018902c0a6c1ac876a276efce876aebb57fa93b

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
631f4b3792b263fdda6b265e93be4747

SHA1
1d6916097d419198bfdf78530d59d0d9f3e12d45

SHA256
4e68d2d067c5680a2e55853ac58b16f199b09f1b9e5f2174605fff18da828976

SHA512
e0280041c4ca63971ab2524f25d2047820f031c1b4aeb6021a3367297045ddf6616ffccafb54630eb07fd154571d844329ebcc34d6ce64834cb77cba373e4fbe

Download Submit
memory/836-268-0x000001E8AF690000-0x000001E8AF6B2000-memory.dmp

Filesize
136KB

Download
memory/836-320-0x000001E897100000-0x000001E897110000-memory.dmp

Filesize
64KB

Download
memory/836-271-0x000001E8AF940000-0x000001E8AF9B6000-memory.dmp

Filesize
472KB

Download
memory/836-324-0x00007FFEA1260000-0x00007FFEA1C4C000-memory.dmp

Filesize
9.9MB

Download
memory/836-285-0x000001E897100000-0x000001E897110000-memory.dmp

Filesize
64KB

Download
memory/836-266-0x000001E897100000-0x000001E897110000-memory.dmp

Filesize
64KB

Download
memory/836-307-0x00007FFEA1260000-0x00007FFEA1C4C000-memory.dmp

Filesize
9.9MB

Download
memory/836-319-0x000001E897100000-0x000001E897110000-memory.dmp

Filesize
64KB

Download
memory/836-265-0x000001E897100000-0x000001E897110000-memory.dmp

Filesize
64KB

Download
memory/836-264-0x00007FFEA1260000-0x00007FFEA1C4C000-memory.dmp

Filesize
9.9MB

Download
memory/1316-380-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-379-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-391-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-386-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-383-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-389-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-378-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/1316-376-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1316-398-0x0000000000820000-0x0000000001163000-memory.dmp

Filesize
9.3MB

Download
memory/1384-399-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/1384-397-0x00007FF72E5C0000-0x00007FF72F40A000-memory.dmp

Filesize
14.3MB

Download
memory/1432-184-0x0000000000980000-0x0000000001421000-memory.dmp

Filesize
10.6MB

Download
memory/1432-138-0x0000000000980000-0x0000000001421000-memory.dmp

Filesize
10.6MB

Download
memory/1432-136-0x0000000000980000-0x0000000001421000-memory.dmp

Filesize
10.6MB

Download
memory/1432-135-0x0000000000600000-0x0000000000601000-memory.dmp

Filesize
4KB

Download
memory/2564-410-0x0000000000980000-0x0000000001421000-memory.dmp

Filesize
10.6MB

Download
memory/2564-411-0x0000000000790000-0x0000000000791000-memory.dmp

Filesize
4KB

Download
memory/3444-227-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-217-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-233-0x00000000052E0000-0x00000000052E1000-memory.dmp

Filesize
4KB

Download
memory/3444-207-0x00000000055B0000-0x00000000055C0000-memory.dmp

Filesize
64KB

Download
memory/3444-206-0x0000000005290000-0x00000000052AC000-memory.dmp

Filesize
112KB

Download
memory/3444-205-0x0000000072040000-0x000000007272E000-memory.dmp

Filesize
6.9MB

Download
memory/3444-231-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-229-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-208-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-225-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-223-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-221-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-219-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-237-0x0000000072040000-0x000000007272E000-memory.dmp

Filesize
6.9MB

Download
memory/3444-209-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-215-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-168-0x0000000005320000-0x00000000053BC000-memory.dmp

Filesize
624KB

Download
memory/3444-167-0x0000000072040000-0x000000007272E000-memory.dmp

Filesize
6.9MB

Download
memory/3444-166-0x00000000008E0000-0x0000000000B26000-memory.dmp

Filesize
2.3MB

Download
memory/3444-213-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3444-211-0x0000000005290000-0x00000000052A5000-memory.dmp

Filesize
84KB

Download
memory/3752-122-0x0000000000CF0000-0x0000000001791000-memory.dmp

Filesize
10.6MB

Download
memory/3752-134-0x0000000000CF0000-0x0000000001791000-memory.dmp

Filesize
10.6MB

Download
memory/3752-124-0x0000000000CF0000-0x0000000001791000-memory.dmp

Filesize
10.6MB

Download
memory/3752-121-0x00000000017F0000-0x00000000017F1000-memory.dmp

Filesize
4KB

Download
memory/4132-245-0x00000000088B0000-0x0000000008EB6000-memory.dmp

Filesize
6.0MB

Download
memory/4132-250-0x0000000007C30000-0x0000000007D3A000-memory.dmp

Filesize
1.0MB

Download
memory/4132-234-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4132-236-0x0000000072040000-0x000000007272E000-memory.dmp

Filesize
6.9MB

Download
memory/4132-238-0x0000000007DA0000-0x000000000829E000-memory.dmp

Filesize
5.0MB

Download
memory/4132-239-0x0000000007940000-0x00000000079D2000-memory.dmp

Filesize
584KB

Download
memory/4132-282-0x0000000008390000-0x00000000083F6000-memory.dmp

Filesize
408KB

Download
memory/4132-242-0x0000000007B10000-0x0000000007B20000-memory.dmp

Filesize
64KB

Download
memory/4132-241-0x00000000078C0000-0x00000000078CA000-memory.dmp

Filesize
40KB

Download
memory/4132-303-0x0000000072040000-0x000000007272E000-memory.dmp

Filesize
6.9MB

Download
memory/4132-304-0x0000000007B10000-0x0000000007B20000-memory.dmp

Filesize
64KB

Download
memory/4132-365-0x000000000B050000-0x000000000B57C000-memory.dmp

Filesize
5.2MB

Download
memory/4132-255-0x0000000007BA0000-0x0000000007BEB000-memory.dmp

Filesize
300KB

Download
memory/4132-313-0x00000000097F0000-0x0000000009866000-memory.dmp

Filesize
472KB

Download
memory/4132-364-0x000000000A950000-0x000000000AB12000-memory.dmp

Filesize
1.8MB

Download
memory/4132-315-0x0000000005490000-0x00000000054AE000-memory.dmp

Filesize
120KB

Download
memory/4132-248-0x0000000007AE0000-0x0000000007AF2000-memory.dmp

Filesize
72KB

Download
memory/4132-253-0x0000000007B60000-0x0000000007B9E000-memory.dmp

Filesize
248KB

Download
memory/4152-252-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-254-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-318-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-199-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-267-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-258-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-249-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-257-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-256-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-305-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/4152-251-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-240-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-247-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-372-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-244-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-246-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/4152-377-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/4152-243-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4152-289-0x00000000012E0000-0x0000000001C23000-memory.dmp

Filesize
9.3MB

Download
memory/4804-366-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-201-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-260-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-181-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-388-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-390-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/4804-183-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/4804-182-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-232-0x00007FFEBD010000-0x00007FFEBD1EB000-memory.dmp

Filesize
1.9MB

Download
memory/4804-198-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-204-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-203-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-202-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/4804-200-0x00007FF668B80000-0x00007FF6699CA000-memory.dmp

Filesize
14.3MB

Download
memory/5040-373-0x000001A619770000-0x000001A619780000-memory.dmp

Filesize
64KB

Download
memory/5040-329-0x00007FFEA0570000-0x00007FFEA0F5C000-memory.dmp

Filesize
9.9MB

Download
memory/5040-384-0x00007FFEA0570000-0x00007FFEA0F5C000-memory.dmp

Filesize
9.9MB

Download
memory/5040-332-0x000001A619770000-0x000001A619780000-memory.dmp

Filesize
64KB

Download
memory/5040-333-0x000001A619770000-0x000001A619780000-memory.dmp

Filesize
64KB

Download
memory/5040-349-0x000001A619770000-0x000001A619780000-memory.dmp

Filesize
64KB

Download