e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
1800s
max time network
1803s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-pljenaef83
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery evasion

Malware Config

Signatures

Contacts a large (612) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Modifies Windows Firewall 2 TTPs 22 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4176	netsh.exe
1656	netsh.exe
720	netsh.exe
976	netsh.exe
3104	netsh.exe
4048	netsh.exe
2152	netsh.exe
4012	netsh.exe
3976	netsh.exe
2140	netsh.exe
4980	netsh.exe
5104	netsh.exe
1528	netsh.exe
1968	netsh.exe
3416	netsh.exe
3576	netsh.exe
1044	netsh.exe
4100	netsh.exe
1028	netsh.exe
1808	netsh.exe
1968	netsh.exe
2092	netsh.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	~tlF677.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	svchost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000\Control Panel\International\Geo\Nation	~tl1DF9.tmp

Executes dropped EXE 12 IoCs

pid	Process
4248	svchost.exe
2260	~tl1DF9.tmp
3652	svchost.exe
4644	~tlF677.tmp
3568	svchost.exe
2056	~tlC04.tmp
516	svchost.exe
4460	~tl7197.tmp
100	svchost.exe
4052	~tlDCA8.tmp
4328	svchost.exe
3540	~tl4315.tmp

Drops file in System32 directory 30 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl7197.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tlC04.tmp
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tl4315.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getlog[1].htm	~tlDCA8.tmp
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	~tl1DF9.tmp
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\System\svchost.exe	~tl1DF9.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2360	schtasks.exe
1324	schtasks.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1668	powershell.exe
5036	powershell.exe
5036	powershell.exe
1668	powershell.exe
4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
4180	powershell.exe
4628	powershell.exe
4180	powershell.exe
4628	powershell.exe
2260	~tl1DF9.tmp
2260	~tl1DF9.tmp
2540	powershell.exe
2540	powershell.exe
5000	powershell.exe
5000	powershell.exe
2260	~tl1DF9.tmp
2260	~tl1DF9.tmp
3652	svchost.exe
3652	svchost.exe
4000	powershell.exe
4000	powershell.exe
2556	powershell.exe
2556	powershell.exe
4644	~tlF677.tmp
4644	~tlF677.tmp
2348	powershell.exe
1576	powershell.exe
2348	powershell.exe
1576	powershell.exe
3568	svchost.exe
3568	svchost.exe
4416	powershell.exe
4416	powershell.exe
2292	powershell.exe
2292	powershell.exe
2056	~tlC04.tmp
2056	~tlC04.tmp
3828	powershell.exe
3588	powershell.exe
3828	powershell.exe
3588	powershell.exe
516	svchost.exe
516	svchost.exe
3516	powershell.exe
1176	powershell.exe
3516	powershell.exe
1176	powershell.exe
4460	~tl7197.tmp
4460	~tl7197.tmp
4188	powershell.exe
100	powershell.exe
4188	powershell.exe
100	powershell.exe
100	svchost.exe
100	svchost.exe
1324	powershell.exe
4832	powershell.exe
1324	powershell.exe
4832	powershell.exe
4052	~tlDCA8.tmp
4052	~tlDCA8.tmp
1116	powershell.exe
1116	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	powershell.exe
Token: SeDebugPrivilege	5036	powershell.exe
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	4628	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	2556	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	2292	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeDebugPrivilege	1176	powershell.exe
Token: SeDebugPrivilege	4188	powershell.exe
Token: SeDebugPrivilege	100	powershell.exe
Token: SeDebugPrivilege	1324	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	3052	powershell.exe
Token: SeDebugPrivilege	2392	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 5036	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	95
PID 4804 wrote to memory of 5036	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	95
PID 4804 wrote to memory of 1668	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	96
PID 4804 wrote to memory of 1668	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	96
PID 4804 wrote to memory of 1324	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	99
PID 4804 wrote to memory of 1324	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	99
PID 4804 wrote to memory of 4248	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	101
PID 4804 wrote to memory of 4248	4804	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	101
PID 4248 wrote to memory of 4180	4248	svchost.exe	104
PID 4248 wrote to memory of 4180	4248	svchost.exe	104
PID 4248 wrote to memory of 4628	4248	svchost.exe	106
PID 4248 wrote to memory of 4628	4248	svchost.exe	106
PID 4248 wrote to memory of 2260	4248	svchost.exe	108
PID 4248 wrote to memory of 2260	4248	svchost.exe	108
PID 2260 wrote to memory of 1084	2260	~tl1DF9.tmp	109
PID 2260 wrote to memory of 1084	2260	~tl1DF9.tmp	109
PID 2260 wrote to memory of 1028	2260	~tl1DF9.tmp	111
PID 2260 wrote to memory of 1028	2260	~tl1DF9.tmp	111
PID 2260 wrote to memory of 3416	2260	~tl1DF9.tmp	113
PID 2260 wrote to memory of 3416	2260	~tl1DF9.tmp	113
PID 2260 wrote to memory of 2540	2260	~tl1DF9.tmp	115
PID 2260 wrote to memory of 2540	2260	~tl1DF9.tmp	115
PID 2260 wrote to memory of 5000	2260	~tl1DF9.tmp	117
PID 2260 wrote to memory of 5000	2260	~tl1DF9.tmp	117
PID 2260 wrote to memory of 4388	2260	~tl1DF9.tmp	119
PID 2260 wrote to memory of 4388	2260	~tl1DF9.tmp	119
PID 2260 wrote to memory of 2360	2260	~tl1DF9.tmp	121
PID 2260 wrote to memory of 2360	2260	~tl1DF9.tmp	121
PID 2260 wrote to memory of 3652	2260	~tl1DF9.tmp	123
PID 2260 wrote to memory of 3652	2260	~tl1DF9.tmp	123
PID 3652 wrote to memory of 4744	3652	svchost.exe	124
PID 3652 wrote to memory of 4744	3652	svchost.exe	124
PID 3652 wrote to memory of 3976	3652	svchost.exe	126
PID 3652 wrote to memory of 3976	3652	svchost.exe	126
PID 3652 wrote to memory of 3576	3652	svchost.exe	128
PID 3652 wrote to memory of 3576	3652	svchost.exe	128
PID 3652 wrote to memory of 4000	3652	svchost.exe	130
PID 3652 wrote to memory of 4000	3652	svchost.exe	130
PID 3652 wrote to memory of 2556	3652	svchost.exe	132
PID 3652 wrote to memory of 2556	3652	svchost.exe	132
PID 3652 wrote to memory of 4644	3652	svchost.exe	134
PID 3652 wrote to memory of 4644	3652	svchost.exe	134
PID 4644 wrote to memory of 3408	4644	~tlF677.tmp	135
PID 4644 wrote to memory of 3408	4644	~tlF677.tmp	135
PID 4644 wrote to memory of 3104	4644	~tlF677.tmp	137
PID 4644 wrote to memory of 3104	4644	~tlF677.tmp	137
PID 4644 wrote to memory of 2140	4644	~tlF677.tmp	139
PID 4644 wrote to memory of 2140	4644	~tlF677.tmp	139
PID 4644 wrote to memory of 2348	4644	~tlF677.tmp	141
PID 4644 wrote to memory of 2348	4644	~tlF677.tmp	141
PID 4644 wrote to memory of 1576	4644	~tlF677.tmp	143
PID 4644 wrote to memory of 1576	4644	~tlF677.tmp	143
PID 3568 wrote to memory of 1500	3568	svchost.exe	146
PID 3568 wrote to memory of 1500	3568	svchost.exe	146
PID 3568 wrote to memory of 1044	3568	svchost.exe	148
PID 3568 wrote to memory of 1044	3568	svchost.exe	148
PID 3568 wrote to memory of 4100	3568	svchost.exe	150
PID 3568 wrote to memory of 4100	3568	svchost.exe	150
PID 3568 wrote to memory of 4416	3568	svchost.exe	152
PID 3568 wrote to memory of 4416	3568	svchost.exe	152
PID 3568 wrote to memory of 2292	3568	svchost.exe	154
PID 3568 wrote to memory of 2292	3568	svchost.exe	154
PID 3568 wrote to memory of 2056	3568	svchost.exe	156
PID 3568 wrote to memory of 2056	3568	svchost.exe	156

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1668
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1324
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4628
- - C:\Users\Admin\AppData\Local\Temp\~tl1DF9.tmp
    C:\Users\Admin\AppData\Local\Temp\~tl1DF9.tmp
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2260
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh int ipv4 set dynamicport tcp start=1025 num=64511
      4⤵
      PID:1084
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1028
  - - C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3416
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2540
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5000
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /TN "Timer"
      4⤵
      PID:4388
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
      4⤵
      Creates scheduled task(s)
      PID:2360
  - - C:\Windows\System\svchost.exe
      "C:\Windows\System\svchost.exe" formal
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        5⤵
        
        PID:4744
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3976
    - - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        5⤵
        Modifies Windows Firewall
        
        PID:3576
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\~tlF677.tmp
        
        C:\Users\Admin\AppData\Local\Temp\~tlF677.tmp
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4644
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh int ipv4 set dynamicport tcp start=1025 num=64511
        6⤵
        
        PID:3408
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:3104
      - C:\Windows\System32\netsh.exe
        
        "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
        6⤵
        Modifies Windows Firewall
        
        PID:2140
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2348
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1576

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3568
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:1500
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1044
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Windows\TEMP\~tlC04.tmp
  C:\Windows\TEMP\~tlC04.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:2256
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4048
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2152
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3588

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:516
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:4340
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:1808
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3516
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1176
- C:\Windows\TEMP\~tl7197.tmp
  C:\Windows\TEMP\~tl7197.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:4664
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1528
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1968
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:100

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:100
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:584
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4980
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:5104
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4832
- C:\Windows\TEMP\~tlDCA8.tmp
  C:\Windows\TEMP\~tlDCA8.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:4012
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4176
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:5084

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:4328
- C:\Windows\system32\netsh.exe
  netsh int ipv4 set dynamicport tcp start=1025 num=64511
  2⤵
  PID:1580
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:720
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:976
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2440
- C:\Windows\TEMP\~tl4315.tmp
  C:\Windows\TEMP\~tl4315.tmp
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:3540
- - C:\Windows\system32\netsh.exe
    netsh int ipv4 set dynamicport tcp start=1025 num=64511
    3⤵
    PID:4844
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:1968
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:2092
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 d6fa39eab7ee36f44dc3f9f2839d098433db95c1eba924e4bcf4e5c0d268d961
MD5 15dde0683cd1ca19785d7262f554ba93
SHA1 d039c577e438546d10ac64837b05da480d06bf69
SHA512 57c0e1b87bc1c136f0d39f3ce64bb8f8274a0491e4ca6e45e5c7f9070aa9d9370c6f590ce37cd600b252df2638d870205249a514c43245ca7ed49017024a4672
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
MD5 eb1ad317bd25b55b2bbdce8a28a74a94
SHA1 98a3978be4d10d62e7411946474579ee5bdc5ea6
SHA512 d011f266c0240d84470c0f9577cd9e4927309bd19bb38570ca9704ed8e1d159f9bea982a59d3eefef72ce7a10bd81208b82e88ef57c7af587f7437a89769adc0
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e1ee9af6b9e3bfd41b7d2c980580bb7427883f1169ed3df4be11293ce7895465
MD5 dbb22d95851b93abf2afe8fb96a8e544
SHA1 920ec5fdb323537bcf78f7e29a4fc274e657f7a4
SHA512 16031134458bf312509044a3028be46034c544163c4ca956aee74d2075fbeb5873754d2254dc1d0b573ce1a644336ac4c8bd7147aba100bfdac8c504900ef3fc
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
MD5 6d3e9c29fe44e90aae6ed30ccf799ca8
SHA1 c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA512 60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_o1x15axp.nqp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o1x15axp.nqp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

~tl1DF9.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tl1DF9.tmp
Size 385KB
SHA256 cb82ea45a37f8f79d10726a7c165aa5b392b68d5ac954141129c1762a539722c
MD5 e802c96760e48c5139995ffb2d891f90
SHA1 bba3d278c0eb1094a26e5d2f4c099ad685371578
SHA512 97300ac501be6b6ea3ac1915361dd472824fe612801cab8561a02c7df071b1534190d2d5ef872d89d24c8c915b88101e7315f948f53215c2538d661181e3a5f0
SSDEEP 12288:+Fi5siE46KR5MEvyRy8QCH9oHainZgGTw:+Fqs34vliy8QCaHnnZgGTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

~tlF677.tmp

Path C:\Users\Admin\AppData\Local\Temp\~tlF677.tmp
Size 393KB
SHA256 33c53cd5265502e7b62432dba0e1b5ed702b5007cc79973ccd1e71b2acc01e86
MD5 9dbdd43a2e0b032604943c252eaf634a
SHA1 9584dc66f3c1cce4210fdf827a1b4e2bb22263af
SHA512 b7b20b06dac952a96eda254bad29966fe7a4f827912beb0bc66d5af5b302d7c0282d70c1b01ff782507dd03a1d58706f05cb157521c7f2887a43085ffe5f94d1
SSDEEP 6144:GqqLlyLkmSr1MuM3oCQmIKFShtejiIMdeq7Hm72qgdfuF0WSytM86Kp:UcLkRr1p69IKmzjn3dfdyw
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 ed9ec12bba9fded5d2021a7c9f0474e2f09cc7f1b85617d3e789653dd3e581a4
MD5 ce429ca18521f43e55a599bb78c1cc24
SHA1 264524f1bf8939e983069aa7752fd2f66798f7b0
SHA512 f8bc49d99fc4958e96e39331b80ea795c2124048ec9c199bce6b33ecf435a27c53c8b3517142d9a8695b125ee750afb8503fd6de384fd67c7ca2364d6f8999ab
SSDEEP 12288:chg2XX65ugwunc+posCEzibHj4bnKtFDl2I9yRb8rxg2YUSYhG:chgXU9o82nk0REK8rG
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 11.8MB
SHA256 470af95a1c0202dc1afcee89489b40d3f01d6cc5226539a37104287dec39e8bd
MD5 8264e8a9338f61e61c9087726d58569d
SHA1 099529918f3088042823a59c2321566e37538b23
SHA512 da68b590d1f14b0b3681b5db32e0b75f2f5f75f55c9c3f177afeab42168329dd8e9a730558c1dd974b6a365a197d8f1126ddf85343deb131669996cdbe94701b
SSDEEP 24576:ii1iGyeJJahPlqa1ibpYAZc0DTnP8SPOiPMuf5jR3kqE+gF8zvkdYYs+ukH19CPl:vTnfcSBPzdxyj4ynq
MD5 SHA1 SHA512 SSDEEP

Submit Download

output1[1].jpg

Path C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\output1[1].jpg
Size 393KB
SHA256 6ec8fe67dc01d8c3de9cfc94ca49ae25e46ed61f5a48f1a956ef269efa4ae08f
MD5 72e28e2092a43e0d70289f62bec20e65
SHA1 944f2b81392ee946f4767376882c5c1bda6dddb5
SHA512 31c0587cd1df4d63088973d72a015b144b64411031ac4c1904c54c4f43b5990b8016cc6d29e3b0238f86432005588c72b98806306918fdaf2786498de340e466
SSDEEP 12288:RAX1i8dWkhx9shLu6f+kndj6nT65OEMLZGL2t:RCi8dT9KS6f+kmTL5I6
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
MD5 bdb25c22d14ec917e30faf353826c5de
SHA1 6c2feb9cea9237bc28842ebf2fea68b3bd7ad190
SHA512 b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c
SSDEEP 96:iq3NYqGeHo9xrLSdx4qKkq3qktznENYrhGaq66iNLm0RIzoZcBPQhDAyRLcxZpoG:iqdYqGAjdx4qKkq3qktznEuZq6FIzoI
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3c9e294b278566fc67bfe3e179e3a8a8202cb0d9c5d88067383ccb924d3e123b
MD5 a3cfb10d5c8b5c64d7ffb2764e7a5b62
SHA1 927f7b2ca2a3053123d4bba64fa758a62f656acf
SHA512 a4a2363a1d2e42a63552d41f3d10524a9aa2d73057d63d3ce1b12db53c2b11cacd7586909b565c1bf7a50131ede39ab15e8e077e0e6af6fab5a039427d3f4beb
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d829b0e2e9b63e980260d83e4b44a2e25bdfc0d593036e5195359f432d995bdb
MD5 e4bc69225fcebc498ec1495e428cda13
SHA1 4889d7f3546c82c4d6544615e9f31d873b20f6db
SHA512 089644a9c848f55b9fd144105382567b382e5e2d0b082b1b66a28aae2d393645c2de2ccfd82e68690f6fb0570b1a5adada93e1a1ac3cf84a01e219a2951bebde
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a
MD5 b42c70c1dbf0d1d477ec86902db9e986
SHA1 1d1c0a670748b3d10bee8272e5d67a4fabefd31f
SHA512 57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 085cf746903ae4fe3be49a9ef382f64cc09d7cec88789f9c207c9e2886c53e9b
MD5 6714d2ce29e2b80c6ec82827abecc844
SHA1 c5316f2b4b4a073e25a694e20d7ee47441d459fc
SHA512 93d8275ca299d01c41c4a1e7077c2a1c22e6a017962d3aab60411dfa59d05144f170a01eae278dad64da55f3dba57d2a2986d8bcbb4c48e018652f1b0dae90f7
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 9d70a7dc15e248b27d6bf474b86ac4ec094cc2f0d043dd125036bc2d319d4c50
MD5 877cbe19207b431000ab1f991bf8ca46
SHA1 16fefd70e50230c0a26cbb00cad1016ea7745d6c
SHA512 91e6a97a69cbc727d7a97abc2abe44df32d0bfb509ceecabd9fbfd0208dbd659248e05f11abed60caeb84d6f12307255379be2a4db613703e2067044724a13fa
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2b410080b96ea8fd941f8b3fc3bc9d5df764b39fd8e071fa7d3c51f6b18a401f
MD5 adaf389a034f8060163f712de4474cb3
SHA1 91202bbcf2d64949e9d3c4ebfac0c5060308f304
SHA512 6823c4e5554cfd6629294692a7015a6897534644014bfac4765e70dbcb68f218148d683a4ccb07f88066044dc0ea60d151dec0c57e358be8e3c0767e0247a51f
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 764B
SHA256 1d24d1596946e2b90b450e569093e389d0b9fc788e2c44dacca0c0b669c39b4e
MD5 b12e224d3b9d77c9ff3cb0f037dd12a7
SHA1 c80f246c6b4cf77cd3798c454edaf4bfdf7d86cc
SHA512 ffcd6ea606bc6f438ac915d298a3c374b5acfe3a3c7dc2efe65bec522edd6103fe5de1ed2a0925b869f6e67fa96c70937dbf1a347c0762a29cda816fc199a1ce
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 860f8700c8a5f4daaa0e46ba57b8de0c4dd6fbe728ac60e2fbf324d6c94d64d2
MD5 f0802c82bbc3c604193e9636a6ceed96
SHA1 6d98355e298027e01d5cc40f8cb26b2309888b7d
SHA512 b27cb5b66a8b10f57674df1e1b91edb9535dd7781d6f4706933f3e8b96b7c9172419ee9056b4ab64e6d98cbc509754dbba25ffdd587205ad9f6514806f62c2ed
MD5 SHA1 SHA512

Submit Download

memory/1576-235-0x00000243C5F80000-0x00000243C5F90000-memory.dmp

Download

memory/1576-238-0x00007FFCF8050000-0x00007FFCF8B11000-memory.dmp

Download

memory/1576-222-0x00000243C5F80000-0x00000243C5F90000-memory.dmp

Download

memory/1576-221-0x00007FFCF8050000-0x00007FFCF8B11000-memory.dmp

Download

memory/1668-24-0x00007FFCF73E0000-0x00007FFCF7EA1000-memory.dmp

Download

memory/1668-25-0x0000019EB4740000-0x0000019EB4750000-memory.dmp

Download

memory/1668-35-0x00007FFCF73E0000-0x00007FFCF7EA1000-memory.dmp

Download

memory/1668-26-0x0000019EB4740000-0x0000019EB4750000-memory.dmp

Download

memory/1668-10-0x0000019EB46E0000-0x0000019EB4702000-memory.dmp

Download

memory/2056-335-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/2056-333-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/2056-391-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/2260-125-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2260-167-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2260-126-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2260-124-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2260-123-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2260-121-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/2292-273-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Download

memory/2292-296-0x000001C8FCAF0000-0x000001C8FCBA5000-memory.dmp

Download

memory/2292-295-0x000001C8E4120000-0x000001C8E4130000-memory.dmp

Download

memory/2292-311-0x000001C8FCD50000-0x000001C8FCD6A000-memory.dmp

Download

memory/2292-274-0x000001C8E4120000-0x000001C8E4130000-memory.dmp

Download

memory/2292-308-0x000001C8FC750000-0x000001C8FC75A000-memory.dmp

Download

memory/2292-313-0x000001C8FCD30000-0x000001C8FCD36000-memory.dmp

Download

memory/2292-293-0x000001C8FCAD0000-0x000001C8FCAEC000-memory.dmp

Download

memory/2292-310-0x000001C8FCCF0000-0x000001C8FCCFA000-memory.dmp

Download

memory/2292-314-0x000001C8FCD40000-0x000001C8FCD4A000-memory.dmp

Download

memory/2292-294-0x00007FF413310000-0x00007FF413320000-memory.dmp

Download

memory/2292-321-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Download

memory/2348-232-0x00000206F13B0000-0x00000206F13C0000-memory.dmp

Download

memory/2348-234-0x00007FFCF8050000-0x00007FFCF8B11000-memory.dmp

Download

memory/2348-210-0x00007FFCF8050000-0x00007FFCF8B11000-memory.dmp

Download

memory/2540-127-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/2540-151-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/2556-196-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/2556-182-0x0000021AF1EC0000-0x0000021AF1ED0000-memory.dmp

Download

memory/2556-181-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/3568-331-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3568-258-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3568-260-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3652-205-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3652-168-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/3652-166-0x0000000140000000-0x000000014015E400-memory.dmp

Download

memory/4000-193-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/4000-170-0x00000172B2680000-0x00000172B2690000-memory.dmp

Download

memory/4000-169-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/4180-73-0x00007FFCF6EB0000-0x00007FFCF7971000-memory.dmp

Download

memory/4180-50-0x00007FFCF6EB0000-0x00007FFCF7971000-memory.dmp

Download

memory/4248-122-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4248-74-0x000000000A550000-0x000000000AA4C000-memory.dmp

Download

memory/4248-49-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4416-262-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Download

memory/4416-315-0x0000021BD77B0000-0x0000021BD77C0000-memory.dmp

Download

memory/4416-306-0x00007FF41FCF0000-0x00007FF41FD00000-memory.dmp

Download

memory/4416-307-0x0000021BD77B0000-0x0000021BD77C0000-memory.dmp

Download

memory/4416-263-0x0000021BD77B0000-0x0000021BD77C0000-memory.dmp

Download

memory/4416-309-0x0000021BF0580000-0x0000021BF059C000-memory.dmp

Download

memory/4416-320-0x00007FFCF8280000-0x00007FFCF8D41000-memory.dmp

Download

memory/4416-312-0x0000021BF0570000-0x0000021BF0578000-memory.dmp

Download

memory/4628-51-0x00007FFCF6EB0000-0x00007FFCF7971000-memory.dmp

Download

memory/4628-72-0x00007FFCF6EB0000-0x00007FFCF7971000-memory.dmp

Download

memory/4644-207-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4644-206-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4644-209-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4644-204-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4644-208-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4644-240-0x0000000140000000-0x0000000140170400-memory.dmp

Download

memory/4804-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4804-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4804-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4804-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4804-46-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/5000-154-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/5000-138-0x00007FFCF7F70000-0x00007FFCF8A31000-memory.dmp

Download

memory/5000-140-0x0000029E99EE0000-0x0000029E99EF0000-memory.dmp

Download

memory/5000-139-0x0000029E99EE0000-0x0000029E99EF0000-memory.dmp

Download

memory/5036-27-0x000001AEDF810000-0x000001AEDF820000-memory.dmp

Download

memory/5036-36-0x00007FFCF73E0000-0x00007FFCF7EA1000-memory.dmp

Download

memory/5036-28-0x000001AEDF810000-0x000001AEDF820000-memory.dmp

Download

memory/5036-29-0x00007FFCF73E0000-0x00007FFCF7EA1000-memory.dmp

Download