dcrat | babed92f8fa49db0ca046162e82f7e2403f33c4ca9ea5097ba981a5d3d365793

Analysis

max time kernel
900s
max time network
905s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-uk
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
submitted
29/03/2025, 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

jopik.exe
Size

3.1MB
MD5

25af61a744bdfb7be6e811a1119d55f6
SHA1

c4352f21b66710e390592d50ae5914ce0c33cf56
SHA256

babed92f8fa49db0ca046162e82f7e2403f33c4ca9ea5097ba981a5d3d365793
SHA512

3b7bc8129c5fec44139d502b2c410680724bac368aa17094f6191d57e4f8fac182f28e86f8db512d0472e088540449171602a4f3b0db96b6811b7fb73f4580dc
SSDEEP

98304:jqmG8KBY7G6G6GCKuuhjtdtyDzPcuBol:2mv/G6Yad7a

Score

10^/10

dcrat salatstealer credential_access discovery execution infostealer rat spyware stealer upx

Malware Config

Signatures

DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect SalatStealer payload 57 IoCs

resource	yara_rule
behavioral1/memory/5912-10-0x0000000000BC0000-0x000000000173D000-memory.dmp	family_salatstealer
behavioral1/memory/6096-17-0x0000000000C50000-0x00000000017CD000-memory.dmp	family_salatstealer
behavioral1/memory/4852-36-0x0000000000280000-0x0000000000DFD000-memory.dmp	family_salatstealer
behavioral1/memory/4736-37-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-38-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-39-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-40-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-42-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-43-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-44-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-46-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-47-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-109-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-111-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-112-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-113-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-114-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-115-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-116-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-117-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-118-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-119-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4196-122-0x0000000000CD0000-0x000000000184D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-123-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-127-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-128-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-129-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-130-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-131-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-215-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-296-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-306-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-321-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-355-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-356-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-357-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-358-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-370-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-371-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-372-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/2640-376-0x0000000000CD0000-0x000000000184D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-377-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-378-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-379-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-380-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-381-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-414-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-631-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-674-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-675-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-676-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-677-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-679-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-681-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4736-682-0x0000000001000000-0x0000000001B7D000-memory.dmp	family_salatstealer
behavioral1/memory/4676-692-0x0000000000CD0000-0x000000000184D000-memory.dmp	family_salatstealer
behavioral1/memory/5296-723-0x0000000000CD0000-0x000000000184D000-memory.dmp	family_salatstealer

Process spawned unexpected child process 54 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5980	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	228	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5444	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5996	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1156	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4804	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1476	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1096	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5792	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	444	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5624	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2588	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1424	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1640	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	376	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3596	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1996	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4248	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	636	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1176	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5272	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3800	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3876	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1508	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	496	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5796	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5488	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5284	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4832	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3196	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5752	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4612	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4300	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2900	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1400	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4972	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3488	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5868	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4128	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5596	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5436	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3036	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5156	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5364	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2020	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5888	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5316	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	4288	schtasks.exe	82
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3632	4288	schtasks.exe	82

Salatstealer family
salatstealer
salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

DCRat payload 3 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

resource	yara_rule
behavioral1/files/0x000700000002836d-57.dat	dcrat
behavioral1/files/0x0007000000028373-79.dat	dcrat
behavioral1/memory/1052-81-0x0000000000E40000-0x0000000000FAA000-memory.dmp	dcrat

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\International\Geo\Nation	MeatSpin-Boost.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\International\Geo\Nation	NVIDIA Container.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 29 IoCs

pid	Process
4736	spoolsv.exe
6096	spoolsv.exe
4852	spoolsv.exe
3436	MeatSpin-Boost.exe
1164	NVIDIA Container.exe
1052	NVIDIA Container.exe
3972	dllhost.exe
4196	wininit.exe
2640	wininit.exe
5064	sihost.exe
5984	smartscreen.exe
3836	Taskmgr.exe
1740	TextInputHost.exe
4676	wininit.exe
3544	SearchApp.exe
6032	Registry.exe
1972	spoolsv.exe
1880	dllhost.exe
4048	SppExtComObj.exe
228	conhost.exe
5296	wininit.exe
2348	sihost.exe
2764	smartscreen.exe
2928	cmd.exe
2280	lsass.exe
2380	RuntimeBroker.exe
1908	smss.exe
2084	Taskmgr.exe
2992	csrss.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5404	powershell.exe
3484	powershell.exe
4032	powershell.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/5912-0-0x0000000000BC0000-0x000000000173D000-memory.dmp	upx
behavioral1/files/0x0007000000028347-5.dat	upx
behavioral1/memory/4736-8-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/5912-10-0x0000000000BC0000-0x000000000173D000-memory.dmp	upx
behavioral1/memory/6096-15-0x0000000000C50000-0x00000000017CD000-memory.dmp	upx
behavioral1/memory/6096-17-0x0000000000C50000-0x00000000017CD000-memory.dmp	upx
behavioral1/memory/4852-35-0x0000000000280000-0x0000000000DFD000-memory.dmp	upx
behavioral1/memory/4852-36-0x0000000000280000-0x0000000000DFD000-memory.dmp	upx
behavioral1/memory/4736-37-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-38-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-39-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-40-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-42-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-43-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-44-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-46-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-47-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-109-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-111-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-112-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-113-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-114-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-115-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-116-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-117-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-118-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-119-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4196-122-0x0000000000CD0000-0x000000000184D000-memory.dmp	upx
behavioral1/memory/4736-123-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-127-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-128-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-129-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-130-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-131-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-215-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-296-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-306-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-321-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-355-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-356-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-357-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-358-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-370-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-371-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-372-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/2640-374-0x0000000000CD0000-0x000000000184D000-memory.dmp	upx
behavioral1/memory/2640-376-0x0000000000CD0000-0x000000000184D000-memory.dmp	upx
behavioral1/memory/4736-377-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-378-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-379-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-380-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-381-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-414-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-631-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-674-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-675-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-676-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-677-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-679-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-681-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4736-682-0x0000000001000000-0x0000000001B7D000-memory.dmp	upx
behavioral1/memory/4676-690-0x0000000000CD0000-0x000000000184D000-memory.dmp	upx
behavioral1/memory/4676-692-0x0000000000CD0000-0x000000000184D000-memory.dmp	upx
behavioral1/memory/5296-721-0x0000000000CD0000-0x000000000184D000-memory.dmp	upx

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MSBuild\d3941fd2-78f3-008a-0de8-e3f0ee2bd278	jopik.exe
File opened for modification	C:\Program Files (x86)\MSBuild\spoolsv.exe	jopik.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\e1ef82546f0b02	NVIDIA Container.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\886983d96e3d3e	NVIDIA Container.exe
File created	C:\Program Files (x86)\Common Files\d3941fd2-78f3-008a-0de8-e3f0ee2bd278	jopik.exe
File created	C:\Program Files (x86)\MSBuild\spoolsv.exe	jopik.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe	spoolsv.exe
File created	C:\Program Files\Google\Chrome\Application\spoolsv.exe	spoolsv.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\f3b6ecef712a24	NVIDIA Container.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe	NVIDIA Container.exe
File created	C:\Program Files (x86)\Common Files\wininit.exe	jopik.exe
File opened for modification	C:\Program Files (x86)\Common Files\wininit.exe	jopik.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\services.exe	NVIDIA Container.exe
File created	C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\c5b4cb5e9653cc	NVIDIA Container.exe
File created	C:\Windows\Resources\Ease of Access Themes\Registry.exe	NVIDIA Container.exe
File created	C:\Windows\Resources\Ease of Access Themes\ee2ad38f3d4382	NVIDIA Container.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jopik.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NVIDIA Container.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wininit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2067557190-3677960511-2209622391-1000_Classes\Local Settings	NVIDIA Container.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	spoolsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	spoolsv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	spoolsv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 54 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5796	schtasks.exe
5488	schtasks.exe
5752	schtasks.exe
5596	schtasks.exe
5980	schtasks.exe
1424	schtasks.exe
5272	schtasks.exe
3876	schtasks.exe
4972	schtasks.exe
2020	schtasks.exe
3632	schtasks.exe
2644	schtasks.exe
4300	schtasks.exe
568	schtasks.exe
3512	schtasks.exe
3596	schtasks.exe
1996	schtasks.exe
1176	schtasks.exe
752	schtasks.exe
5868	schtasks.exe
5364	schtasks.exe
1096	schtasks.exe
444	schtasks.exe
5624	schtasks.exe
636	schtasks.exe
4832	schtasks.exe
4612	schtasks.exe
4128	schtasks.exe
3036	schtasks.exe
228	schtasks.exe
1156	schtasks.exe
1640	schtasks.exe
376	schtasks.exe
3800	schtasks.exe
3196	schtasks.exe
2900	schtasks.exe
5436	schtasks.exe
5996	schtasks.exe
4804	schtasks.exe
1476	schtasks.exe
5792	schtasks.exe
5284	schtasks.exe
1400	schtasks.exe
5888	schtasks.exe
5316	schtasks.exe
5444	schtasks.exe
4248	schtasks.exe
3488	schtasks.exe
5156	schtasks.exe
2484	schtasks.exe
2588	schtasks.exe
1900	schtasks.exe
1508	schtasks.exe
496	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5912	jopik.exe
5912	jopik.exe
5912	jopik.exe
5912	jopik.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4024	taskmgr.exe
4024	taskmgr.exe
6096	spoolsv.exe
6096	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4024	taskmgr.exe
4024	taskmgr.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4024	taskmgr.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4852	spoolsv.exe
4852	spoolsv.exe
4024	taskmgr.exe
4024	taskmgr.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4736	spoolsv.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4736	spoolsv.exe
4024	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 62 IoCs

description	pid	Process
Token: SeDebugPrivilege	4024	taskmgr.exe
Token: SeSystemProfilePrivilege	4024	taskmgr.exe
Token: SeCreateGlobalPrivilege	4024	taskmgr.exe
Token: SeDebugPrivilege	4736	spoolsv.exe
Token: SeDebugPrivilege	1052	NVIDIA Container.exe
Token: SeDebugPrivilege	3972	dllhost.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	4328	powershell.exe
Token: SeDebugPrivilege	1284	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	4928	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	3484	powershell.exe
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	5740	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe
Token: SeDebugPrivilege	5064	sihost.exe
Token: SeDebugPrivilege	5984	smartscreen.exe
Token: SeDebugPrivilege	1252	powershell.exe
Token: SeDebugPrivilege	1096	powershell.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	4016	powershell.exe
Token: SeDebugPrivilege	4408	powershell.exe
Token: SeDebugPrivilege	4280	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe
Token: SeDebugPrivilege	2108	powershell.exe
Token: SeDebugPrivilege	4720	powershell.exe
Token: SeDebugPrivilege	6108	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	6052	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeDebugPrivilege	5944	powershell.exe
Token: SeDebugPrivilege	1456	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe
Token: SeDebugPrivilege	2640	powershell.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeDebugPrivilege	2708	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe
Token: SeDebugPrivilege	832	powershell.exe
Token: SeDebugPrivilege	5532	powershell.exe
Token: SeDebugPrivilege	460	powershell.exe
Token: SeDebugPrivilege	3836	Taskmgr.exe
Token: SeDebugPrivilege	1740	TextInputHost.exe
Token: SeDebugPrivilege	3544	SearchApp.exe
Token: SeDebugPrivilege	6032	Registry.exe
Token: SeDebugPrivilege	1972	spoolsv.exe
Token: SeDebugPrivilege	1880	dllhost.exe
Token: SeDebugPrivilege	4048	SppExtComObj.exe
Token: SeDebugPrivilege	228	conhost.exe
Token: SeDebugPrivilege	2348	sihost.exe
Token: SeDebugPrivilege	2764	smartscreen.exe
Token: SeDebugPrivilege	2928	cmd.exe
Token: SeDebugPrivilege	2280	lsass.exe
Token: SeDebugPrivilege	2380	RuntimeBroker.exe
Token: SeDebugPrivilege	1908	smss.exe
Token: SeDebugPrivilege	2084	Taskmgr.exe
Token: SeDebugPrivilege	2992	csrss.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe
4024	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5912 wrote to memory of 4736	5912	jopik.exe	83
PID 5912 wrote to memory of 4736	5912	jopik.exe	83
PID 5912 wrote to memory of 4736	5912	jopik.exe	83
PID 4736 wrote to memory of 6096	4736	spoolsv.exe	86
PID 4736 wrote to memory of 6096	4736	spoolsv.exe	86
PID 4736 wrote to memory of 6096	4736	spoolsv.exe	86
PID 4736 wrote to memory of 4852	4736	spoolsv.exe	91
PID 4736 wrote to memory of 4852	4736	spoolsv.exe	91
PID 4736 wrote to memory of 4852	4736	spoolsv.exe	91
PID 4736 wrote to memory of 4312	4736	spoolsv.exe	97
PID 4736 wrote to memory of 4312	4736	spoolsv.exe	97
PID 4736 wrote to memory of 4312	4736	spoolsv.exe	97
PID 4312 wrote to memory of 3436	4312	cmd.exe	99
PID 4312 wrote to memory of 3436	4312	cmd.exe	99
PID 3436 wrote to memory of 1164	3436	MeatSpin-Boost.exe	100
PID 3436 wrote to memory of 1164	3436	MeatSpin-Boost.exe	100
PID 3436 wrote to memory of 1164	3436	MeatSpin-Boost.exe	100
PID 1164 wrote to memory of 6044	1164	NVIDIA Container.exe	101
PID 1164 wrote to memory of 6044	1164	NVIDIA Container.exe	101
PID 1164 wrote to memory of 6044	1164	NVIDIA Container.exe	101
PID 6044 wrote to memory of 4240	6044	WScript.exe	102
PID 6044 wrote to memory of 4240	6044	WScript.exe	102
PID 6044 wrote to memory of 4240	6044	WScript.exe	102
PID 4240 wrote to memory of 1052	4240	cmd.exe	104
PID 4240 wrote to memory of 1052	4240	cmd.exe	104
PID 1052 wrote to memory of 3972	1052	NVIDIA Container.exe	159
PID 1052 wrote to memory of 3972	1052	NVIDIA Container.exe	159
PID 4736 wrote to memory of 4996	4736	spoolsv.exe	161
PID 4736 wrote to memory of 4996	4736	spoolsv.exe	161
PID 4736 wrote to memory of 4996	4736	spoolsv.exe	161
PID 4736 wrote to memory of 2140	4736	spoolsv.exe	163
PID 4736 wrote to memory of 2140	4736	spoolsv.exe	163
PID 4736 wrote to memory of 2140	4736	spoolsv.exe	163
PID 4736 wrote to memory of 4328	4736	spoolsv.exe	165
PID 4736 wrote to memory of 4328	4736	spoolsv.exe	165
PID 4736 wrote to memory of 4328	4736	spoolsv.exe	165
PID 4736 wrote to memory of 1284	4736	spoolsv.exe	167
PID 4736 wrote to memory of 1284	4736	spoolsv.exe	167
PID 4736 wrote to memory of 1284	4736	spoolsv.exe	167
PID 4736 wrote to memory of 4244	4736	spoolsv.exe	169
PID 4736 wrote to memory of 4244	4736	spoolsv.exe	169
PID 4736 wrote to memory of 4244	4736	spoolsv.exe	169
PID 4736 wrote to memory of 4944	4736	spoolsv.exe	171
PID 4736 wrote to memory of 4944	4736	spoolsv.exe	171
PID 4736 wrote to memory of 4944	4736	spoolsv.exe	171
PID 4736 wrote to memory of 4928	4736	spoolsv.exe	173
PID 4736 wrote to memory of 4928	4736	spoolsv.exe	173
PID 4736 wrote to memory of 4928	4736	spoolsv.exe	173
PID 4736 wrote to memory of 1684	4736	spoolsv.exe	175
PID 4736 wrote to memory of 1684	4736	spoolsv.exe	175
PID 4736 wrote to memory of 1684	4736	spoolsv.exe	175
PID 4736 wrote to memory of 5404	4736	spoolsv.exe	178
PID 4736 wrote to memory of 5404	4736	spoolsv.exe	178
PID 4736 wrote to memory of 5404	4736	spoolsv.exe	178
PID 4736 wrote to memory of 6100	4736	spoolsv.exe	180
PID 4736 wrote to memory of 6100	4736	spoolsv.exe	180
PID 4736 wrote to memory of 6100	4736	spoolsv.exe	180
PID 4736 wrote to memory of 3484	4736	spoolsv.exe	182
PID 4736 wrote to memory of 3484	4736	spoolsv.exe	182
PID 4736 wrote to memory of 3484	4736	spoolsv.exe	182
PID 4736 wrote to memory of 4032	4736	spoolsv.exe	183
PID 4736 wrote to memory of 4032	4736	spoolsv.exe	183
PID 4736 wrote to memory of 4032	4736	spoolsv.exe	183
PID 4736 wrote to memory of 5740	4736	spoolsv.exe	186

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\jopik.exe
"C:\Users\Admin\AppData\Local\Temp\jopik.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Program Files (x86)\MSBuild\spoolsv.exe
  "C:\Program Files (x86)\MSBuild\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\spoolsv.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6096
- - C:\Program Files\Google\Chrome\Application\spoolsv.exe
    "C:\Program Files\Google\Chrome\Application\spoolsv.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "start C:\Users\Admin\AppData\Local\Temp/MeatSpin-Boost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\MeatSpin-Boost.exe
      C:\Users\Admin\AppData\Local\Temp/MeatSpin-Boost.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe"
        6⤵
        Checks computer location settings
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6044
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat" "
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4240
        
        C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe
        
        "C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1052
        
        C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe
        
        "C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c "start C:\Users\Admin\AppData\Local\Temp/MeatSpin-Boost.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4996
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2140
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1284
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4244
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4928
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoExit "[console]::InputEncoding = [console]::OutputEncoding = New-Object System.Text.UTF8Encoding"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5404
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6100
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe " Set-ItemProperty -Path \"HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\" -Name \"shutdownwithoutlogon\" -Value 1 -Type DWord Set-ItemProperty -Path \"HKLM:\SYSTEM\CurrentControlSet\Control\Error Message Instrument\" -Name \"EnableDefaultReply\" -Value 1 -Type DWord Set-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\" -Name \"ShutdownWarningDialogTimeout\" -Value 1 -Type DWord "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3484
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe " [void][system.reflection.Assembly]::LoadFrom('C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll') [void][system.reflection.Assembly]::LoadFrom('C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll') Add-Type -Assembly System.Windows.Forms Add-Type -AssemblyName System.Drawing $form = New-Object System.Windows.Forms.Form $rdp = New-Object AxMSTSCLib.AxMsRdpClient8NotSafeForScripting $form.Controls.Add($rdp) $form.Size = New-Object System.Drawing.Size(0,0) $form.ShowInTaskbar = $false $form.WindowState = 1; $form.FormBorderStyle = 0; function func { $rdp.AdvancedSettings2.DisplayConnectionBar = 'true' $rdp.AdvancedSettings7.EnableCredSspSupport = 'true' $rdp.DesktopHeight = 1080; $rdp.DesktopWidth = 1920; [object]$robj = $true [MSTSCLib.IMsRdpExtendedSettings] | ForEach-Object { $_.GetProperty(\"Property\").SetValue( $rdp.GetOcx(), $robj, @(\"ConnectToChildSession\") ) } $rdp.Connect() } $form.add_Shown({ func } ) $form.ShowDialog() "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4032
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5740
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1252
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1096
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:656
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4280
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4720
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6108
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1456
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4584
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2640
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4184
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1960
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2708
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:460

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4024

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4404

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4912

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5980

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:228

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 5 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\Taskmgr.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Taskmgr" /sc ONLOGON /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\Taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 7 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\Taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4804

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1476

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1096

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 8 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5792

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 10 /tr "'C:\Users\Public\smss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:444

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Public\smss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5624

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 8 /tr "'C:\fc080a577739bdbaee43ae5ca1\lsass.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2588

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\fc080a577739bdbaee43ae5ca1\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1424

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "lsassl" /sc MINUTE /mo 12 /tr "'C:\fc080a577739bdbaee43ae5ca1\lsass.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:568

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1640

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 6 /tr "'C:\Recovery\WindowsRE\sihost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:376

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 14 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\services.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "servicess" /sc MINUTE /mo 13 /tr "'C:\Windows\SoftwareDistribution\PostRebootEventCache.V2\services.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1996

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 13 /tr "'C:\Users\All Users\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4248

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Users\All Users\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:636

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 10 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\RuntimeBroker.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5272

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3800

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBrokerR" /sc MINUTE /mo 13 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3876

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\cmd.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmd" /sc ONLOGON /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1508

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\cmd.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:496

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 5 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5796

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreen" /sc ONLOGON /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "smartscreens" /sc MINUTE /mo 6 /tr "'C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5284

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 5 /tr "'C:\fc080a577739bdbaee43ae5ca1\SearchApp.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4832

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchApp" /sc ONLOGON /tr "'C:\fc080a577739bdbaee43ae5ca1\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3196

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\fc080a577739bdbaee43ae5ca1\SearchApp.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5752

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 7 /tr "'C:\Windows\Resources\Ease of Access Themes\Registry.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4612

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Registry" /sc ONLOGON /tr "'C:\Windows\Resources\Ease of Access Themes\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4300

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RegistryR" /sc MINUTE /mo 10 /tr "'C:\Windows\Resources\Ease of Access Themes\Registry.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2900

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4972

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsv" /sc ONLOGON /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1400

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 10 /tr "'C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3488

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 11 /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5868

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHost" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4128

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TextInputHostT" /sc MINUTE /mo 8 /tr "'C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5596

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 12 /tr "'C:\Users\Public\Downloads\conhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5436

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Public\Downloads\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3036

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\conhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5156

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 13 /tr "'C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5364

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Taskmgr" /sc ONLOGON /tr "'C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "TaskmgrT" /sc MINUTE /mo 7 /tr "'C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5888

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 5 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2484

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 14 /tr "'C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3632

C:\Program Files (x86)\Common Files\wininit.exe
"C:\Program Files (x86)\Common Files\wininit.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4196

C:\Program Files (x86)\Common Files\wininit.exe
"C:\Program Files (x86)\Common Files\wininit.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2640

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe
"C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5984

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:1300

C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe
"C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe
"C:\NVIDIA\DisplayDriver\535.21\TextInputHost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Program Files (x86)\Common Files\wininit.exe
"C:\Program Files (x86)\Common Files\wininit.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4676

C:\fc080a577739bdbaee43ae5ca1\SearchApp.exe
"C:\fc080a577739bdbaee43ae5ca1\SearchApp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\Resources\Ease of Access Themes\Registry.exe
"C:\Windows\Resources\Ease of Access Themes\Registry.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6032

C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\logs\spoolsv.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe
"C:\27bcfc6558aaf0254f0c5fc8ee67bab5\dllhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Users\All Users\SppExtComObj.exe
"C:\Users\All Users\SppExtComObj.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Users\Public\Downloads\conhost.exe
"C:\Users\Public\Downloads\conhost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:228

C:\Program Files (x86)\Common Files\wininit.exe
"C:\Program Files (x86)\Common Files\wininit.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5296

C:\Recovery\WindowsRE\sihost.exe
"C:\Recovery\WindowsRE\sihost.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2348

C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe
"C:\27bcfc6558aaf0254f0c5fc8ee67bab5\smartscreen.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\27bcfc6558aaf0254f0c5fc8ee67bab5\cmd.exe
"C:\27bcfc6558aaf0254f0c5fc8ee67bab5\cmd.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2928

C:\fc080a577739bdbaee43ae5ca1\lsass.exe
"C:\fc080a577739bdbaee43ae5ca1\lsass.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2280

C:\27bcfc6558aaf0254f0c5fc8ee67bab5\RuntimeBroker.exe
"C:\27bcfc6558aaf0254f0c5fc8ee67bab5\RuntimeBroker.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2380

C:\Users\Public\smss.exe
"C:\Users\Public\smss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe
"C:\NVIDIA\DisplayDriver\535.21\Taskmgr.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe
"C:\Program Files (x86)\Windows Photo Viewer\uk-UA\csrss.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\NVIDIA\DisplayDriver\535.21\NVIDIA Container.exe

Filesize
1.4MB

MD5
4a591f46c87b49a7de93f5ac771cd4ab

SHA1
e0992350818e5c56d3f2e3a6db340d1f5b8f3314

SHA256
b495e22042b08f27b690da18986ec74d5054a65d05d5cf41fdecd5751482ccbd

SHA512
b498445d1e427853690250aebff35cbd7e28e85a89ad868e3483930b16ec13198357cfcd5feb45567b1bc8f3d9f97c5ecf2d242c8a5e9d758a536d0498ba7955

Download Submit
C:\NVIDIA\DisplayDriver\535.21\mxJne99RtKqQDunPUGdos.bat

Filesize
53B

MD5
7784d810f5ff3afa8df50e360eb90e7d

SHA1
f04802a991ff6461aa1c35b7c0f68e43d5a114c6

SHA256
0385dbf94fc27705560cf0b6b04e9a37181db486ee8f7573c5ad2217d18f4ca0

SHA512
80038ae2bfd5f8ca3f4812ab5c342878f98978007125c9dca5edb915701a5383916131cdc3082c054c49c508cd210aff70319ac0fc498cbdd6cee776df672cac

Download Submit
C:\NVIDIA\DisplayDriver\535.21\zajaYJ4rqwpmDK2a6yrvwdV.vbe

Filesize
225B

MD5
d7df2670ad0c6c7b9cc48122f20f086c

SHA1
e69bf8c214d8c4b768125ca03e402e1c871cc233

SHA256
d3bf5c54de984dd2d1d779494deb8a995cc062eb5f25c465d0de78d99b8cc52b

SHA512
05ed88410790bf74dc7ab880f893e555c4859c133e79a89f28b5e1a68c36f4a4f28d3b7b6532953c04b6d23a21faf53e60107efde9e6acb492a9235d48943f03

Download Submit
C:\Program Files (x86)\MSBuild\spoolsv.exe

Filesize
3.1MB

MD5
25af61a744bdfb7be6e811a1119d55f6

SHA1
c4352f21b66710e390592d50ae5914ce0c33cf56

SHA256
babed92f8fa49db0ca046162e82f7e2403f33c4ca9ea5097ba981a5d3d365793

SHA512
3b7bc8129c5fec44139d502b2c410680724bac368aa17094f6191d57e4f8fac182f28e86f8db512d0472e088540449171602a4f3b0db96b6811b7fb73f4580dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cmd.exe.log

Filesize
1KB

MD5
b08c36ce99a5ed11891ef6fc6d8647e9

SHA1
db95af417857221948eb1882e60f98ab2914bf1d

SHA256
cc9248a177495f45ec70b86c34fc5746c56730af36ace98ac7eb365dbafda674

SHA512
07e62581eace395b0a9699d727761648103180c21155d84ea09140f9e1c9690705c419118545aa67a564334bbde32710225fe3aa92b0b4b4210cb91f0058b1ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\dllhost.exe.log

Filesize
1KB

MD5
12a813ec669d9480f522198c50939fb3

SHA1
8183507eb58e6d4a2681cc13371ab673f92b644f

SHA256
049951a35a57119f9057c912a8ce26ef4aeea74c8442693cc8ba99527c2483fb

SHA512
f02a15dc78a391966f0f7c86c9663469a1c8e47dab6b7b4f47fcf45f4587b66008bec68e598fee9d690e7a749a974e86bde0a3c5b17f0d2e6ca6445816b3983d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
c3c8c7edc7bdeb3c512771a68bd878ab

SHA1
0be3d1e296640d418a890041fd5d3b12ceea71df

SHA256
136776ac6adcb472e0ed37035f6f773df3fb5d347f017fea3f1f2af0b103e5f2

SHA512
dc9bdc7f504cefb344dbeaaf11f924c4cebaefa4dcaa02fdff2baca56f4864c4f81a49c525db7c9f7cc2cfa306f4c8bdfbce1043b9182d94627de76d1805e33f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Filesize
54KB

MD5
542cd77a068efbb092a44e01cf113686

SHA1
9f558df5bc5191d1326531cbdd059d1193a29746

SHA256
413de2d91b7a96ace0a2e2de99baff31bc431b88523b120f4c4b7ab7698ddae5

SHA512
5d1b23c4241e2a4a772ff84abdbdfe66532e5698c9a5aca6275d48702f916dd2465967f11a7b1f84543c47075bcba8945d6d173db3a839740f837baf5bed38c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
16KB

MD5
78668e2c5880a65bdf4eddcd2b2d010f

SHA1
a34425f86b9984b5cc2237069c004c877177a833

SHA256
e77fb00b25b6e4b98a019f1b43497dd30680686854ebbb4005da20b4ad0733d4

SHA512
26e67f4718481161370271ac3dbe81bd6f8f6638642fed6b0f7bde776d8e104d2a716b12d917a96a46f8dc3d7f4ecda27f855339cc7bd716e336cc68745726b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
708db9b1cfd9bf8fd8a1f5e2e9d16d02

SHA1
dd4f808f1bf1a0f63083a4256fe00a11c560624f

SHA256
5d627200331c81ca0e73d6e3cf3744e750fb49e9fbb9c9d734ea25e191e88a20

SHA512
7d5a4f531c442100558506d85953cc36dc5258ded2fbcb5e85fbe06b4ba6211ecb5f14e146dcd8e992dd51d62296adc47c92db838fe2ea3f8349528e406de86f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
1cdcc31f4af318c657dd11ffcd492ee3

SHA1
f8ed4d230b176936fafce04706a2f75cf455edab

SHA256
2ca4e96c137586c89b625965fd74f33352ad4792e08beb863b646e86b9e80a66

SHA512
b3e3886806ab16ef8432c501e4b11a4cf3f67d7179a036279f0e47fd799eb124803aaf9d6781b8acf3da7156e53744119a9e574c798eb889cd7530c30f347273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
bee712caf9906e4c1927b625852fce32

SHA1
a6cb02871c50c3d1b695ed05873f73b105e6504a

SHA256
087e1ee535cd81af68e21f5d4627be4a070e19867545bd16439dc3571e2767ed

SHA512
98bc368e174ed0644014dfff9bfa12a1e45916488f552f75e455e46325260513804782e65d1d0c2932e0201eca9254489b477f9771e42971c3da65eec8382e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
fe03221ae64484aeddcb4ffccd147b29

SHA1
e294938918ca5c22ef57e75b80b194f64bc6b090

SHA256
bcecf1bff2d248a54b82f3c0ce1d46366afd42418bbad6b720536200801c6058

SHA512
c219e6073443415b69b5f63500bb89bd9d33bf84ab8d35abd5532834e697aca436893edb6771f71992a287f01c9f860c740eda5edd585dcf0687e573e09463e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
3b9d414e04e92babff1c84e2f3e5704b

SHA1
90da59940e0275266f346769b15edc793e1a56ac

SHA256
c0163abfaa9bb8256827cfe32c31ff8b2fbf95b832a272a19bc3e31b89cfa3ed

SHA512
155cc23f1d73aae4705e310bf92d410fd190ac2293d75330833b775c1c8e25ed47d889a48e555624b2a6a260dff6a70bb618938e5a4d3af13ddb290ca13b2af6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
405af19c20b5562c59403e441a655409

SHA1
e30a57c8a73cbdab307742454005097b5c177358

SHA256
60b0bb92d08a1e23ea99f5cafce5eeacc542d876221ef4abecd1f2aef752a5a1

SHA512
e0d3b717c5dd2046a002549e74d3d217582779a6e78b9dca4628defb591c6630991990540b4d5bb332e933cbe40e79cb5f9a9323ef2b253d2cd2b27d03d6346c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
67221941fe64fc66474d6aa748452af4

SHA1
c399f398543d7d5dae8c859ba04ff59fc76fa0b3

SHA256
edfa0f2cd432db30b7c67c4aa2a3402748a70f8a9e7a20da95a44c40bb3448d5

SHA512
b444ceb4840a3f624bddb5096b2de82b07aa27160231508d358b57e2385297f68ce297065e5375352919232a68bd546d3e813608171e069e4f347b37d35032d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
8908bb52a671a79da16909445e49230a

SHA1
cbdb947c46b4ed5ac3526a6ac1dfa41fdcb4ba56

SHA256
71d0100aabe25a8fb2e10a6ce74444d29ccd09241c398fa48c92410567c56f93

SHA512
233f45937df59b473dcddabc74f41169e7a4efcce2a5450e592ed4671e34cdcf29484b27a228689103e52f6dffe741a32fdb0b55b7a78772816c3e79aa168634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
d3c603c8e605f350db94db69f5b8b323

SHA1
393349468be93090ca923870a74db405e5d8d0b0

SHA256
9233eb5b3fd5fb7ae8ea37753d5fa11065630fe28ea89d709f12af5ef40b127f

SHA512
9a17b5edaf5c708ea581eeb25405ac83d82d42c864bd0101c684aee0a23eb0f8db3b6efd87b7a8d67f8fda92c459df27ca966d1d9cf726f4245a30103da79d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
78c692ee0c78a59415b66fdb0ab7a8a2

SHA1
83e388b0b5151dd121a41a60ded0334e71711441

SHA256
18f1e3fd5899ce9bf9e80b993a39f4f9d8a502dd6b83ca4a4659e0141e94d11b

SHA512
1dde0231d2cbe0fb4e6f2485f71852ea7db90f5c49bd96b1c7c893c22354918cf25aab8f18d096930cb8591cd9a7754c4b808e65273815dcd91bd458c070609c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
141ba4e46ed3ae9ea4e6934a3cdda574

SHA1
95f3393a9de5f0ab9ded4309b1103352e8e5e618

SHA256
8b2469431839ca737f378719d77ff3367dd124d321bf7916632f6050a1842397

SHA512
959d7dd9dab046d2e478ca52cbd18818ba198e52f002786f605a7b48a349495651ae18dc690866a8fcec405990eac936398426f7d01f2fa73f4317f10c13565e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
1b1aac034ddbc962147182686163d019

SHA1
0dbdc31880f64312a9eec8b1405fbfb6bda7bc9d

SHA256
eacb4568fb6ff8c5acbcac534f0ff6f111785d5fc640bc25092fd30a80a0baf2

SHA512
458268d195624313e8351d0effd24ccdc957ea07cb148361d0a1a345a37785fd03863fd7da65a96c0697f48e7a422a6a19e0cf4929ba155142118c0376b1a5de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
bb657196a258aaf29d991b82ec7a5f55

SHA1
332cdbdcd4998cfec4b70bb65b7846d1cf81a276

SHA256
2f780598ba82daf1d01acbae996ca5f69b66f8b655b57728835b3f37f8911ecd

SHA512
4d5d38a654226745c793617f206f7dc6184dcf162fee8a538d722fc33b07d9a7454ec6a1bfb0f30a1cda449ff11edaf19f2746263d2c564099c38db141381847

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
490aae8b7ac39de58fa4277a90781e49

SHA1
fb308111a76cc14c90cdd55a31d44be4953b2ef9

SHA256
89ee2022975f4a70edf1b1f9b31af07b69af202445ae3cf8c2d2f36860ad04f3

SHA512
12bcef49d5cffb10eb1e06af39f21399324eef9a492426a940660ee3e1729a19b1e87df5dc9821db3bc0c4a2c377488a5fc0c4495b0c3146ef1bd78112b9f841

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b3e7a917b4c25c027eda5df73b625988

SHA1
0f2268049a56160ec6963fbaef6eb0402f1107df

SHA256
a3c7840e48ba3bf9f555b2ab74ef7ced900ea2c9aa5d24c68b87dabd93952ae5

SHA512
54062503e217397409992b29bd8f3168d322a6abc14fcf0bee7f4cfc803f7d707f62addefc57f682667485d870ee4722f021340ab239536052e8917a680413c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
0ed89bfe8295cec7d512a99cd0d01e21

SHA1
75303fc6a9168b5276c5fe64fda63c82ce8e768e

SHA256
64ccfc24b794e50b42bc35d923ec2a084df26425d930eb99e1c6b0097340fa5f

SHA512
d33f8315d7aa542a3269398ced05d019c0bdec3c36900119f1bf1afb901ece7860ab42a584abb40f2862b6d5f9bc7d3f3e41ebf5d64e0214d540c549ec6708d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
84fc61d55b22221c26456a2b8277cea6

SHA1
093f5da6fe8d5f7fb84e3ae5cedcb1229d4fe112

SHA256
3af2acc2e5f05105105615f756bdec9bd15dab0dd11ad28a437db8336a9ba837

SHA512
9405fba8303c7bbb14fb6ea1f4691c5df3ec5b91eca573c978c3ce63e329d1942fb669c1d27baac709e2ee6d9b5166e5878766e87b7df0ec38b00bdbea82f1d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
653e78f4b604e34596241981111ac4a0

SHA1
a70a083fcd1316c12fca3bc744f21ebcb3b6f6be

SHA256
39f1fe1afdc7fc01ae6e24bbe2b44fb655cf7c69d0646ee47d613449a34ced28

SHA512
d8eb95a103ed5725652c4e6f34c25c55412bd6fe5b28c29097922b69ed5fcff3fbf865242a3eba18bb1968164d5d62d50179d924349cea60532ebfea25f9da70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
a059d8d307f8a42e10896f3d5d0f02cd

SHA1
401ddccdae79948e7d7fdba07d2e22c130a1ac63

SHA256
d18e72b50bee814fc7f0eb4bd24653d35f2feae764aa19f182747bbce941bc8e

SHA512
aa591459a831be013bf26d85392b64d051ecc5b97afeebbcc7b706a92de1815f1acd4f24cf522ed6f0952e9601afe2919dd702f14eaa54d14f5059fcd180471b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b1cd41a08aedbfa472a02e2063398dfe

SHA1
d58a19cf248803e344db629e71a0cd43f36fb580

SHA256
fa1da5ee33a249d8edff51df7c8808674dc7da730ace33c4c499c722d6e12bde

SHA512
3cc444091533bb9b1095212dccb65196e4f8edeb9e3782eae544fb710e85a9125673583f8ddccef8690155df07b164e9c7c444106696e8ff0a58cd72a70cd6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

Filesize
18KB

MD5
b7afde8c123cf69bae32297e2e255d77

SHA1
2bf2e0a22f8bc36c3dd2be533abaf9092c99f686

SHA256
b430962dbb91cd99576f9bdf835f6aeeccb535b7cbb2e0c516f590b8f355f995

SHA512
78bea981eb4f2427ec7fc2819e7bdc12734d42aa523727b0f21fcb35fbeaeee76c4478e6445da7cf424b06277c464216426a2b79d53e58032922be0ea99b5907

Download Submit
C:\Users\Admin\AppData\Local\Temp\MeatSpin-Boost.exe

Filesize
5.5MB

MD5
be02946478a9c90e257612a5773aa43c

SHA1
99ac2322ab94d70882022ec6e6e01a3381d0a788

SHA256
25b742d68dbe7121e955cdca8b7e6a7d3280ff8e8c3dbf7bbed9526501ef224b

SHA512
a00e6e5988b54ef1acd6733122ce8e83e2a7baaf00991d301f5a8a3023e33d55c02e6af4cc5985deb7a49fceea60a13a11b8bbefdb12d7e23af0d555c6f4b993

Download Submit
C:\Users\Admin\AppData\Local\Temp\MeatSpin-Boost.exe

Filesize
3.3MB

MD5
1858c416dcb6ab17a4ba38c24003a041

SHA1
9fe8a39cdc7bed0b38f3e3bbcf207f18b0433ca5

SHA256
3403bac5c539f75b944da6960af9f9347f9665ad9ac578266602c0bc8b7e5dc7

SHA512
b6d8eef0becbbe97592b37883120897cb9592a6d1905c555f5e7c089e756dd80822325c2374637ed9a02a8db2d46c1a98fbc00660cb495abec6c99a67c6802d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\NVIDIA Container.exe

Filesize
1.8MB

MD5
531bf67134a7c1fb4096113ca58cc648

SHA1
99e0fc1fb7a07c0685e426b327921d3e6c34498c

SHA256
67942630366d114efa35f3f4a79741a4a4eb2c3b0c8ffaac07af527f84d4489a

SHA512
8facae8335a4f33f54e48c64814946eb8b480800b4453612fffcef64117946a35d493f433d4e27186ee864603da756319f816e70c3bfc08b8bb1861fc7030ff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_f05tp4rd.wqf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1052-86-0x000000001C110000-0x000000001C11E000-memory.dmp

Filesize
56KB

Download
memory/1052-87-0x000000001C120000-0x000000001C12E000-memory.dmp

Filesize
56KB

Download
memory/1052-88-0x000000001C130000-0x000000001C13C000-memory.dmp

Filesize
48KB

Download
memory/1052-84-0x000000001BBA0000-0x000000001BBB6000-memory.dmp

Filesize
88KB

Download
memory/1052-85-0x0000000003170000-0x0000000003180000-memory.dmp

Filesize
64KB

Download
memory/1052-83-0x000000001C160000-0x000000001C1B0000-memory.dmp

Filesize
320KB

Download
memory/1052-82-0x000000001BB70000-0x000000001BB8C000-memory.dmp

Filesize
112KB

Download
memory/1052-81-0x0000000000E40000-0x0000000000FAA000-memory.dmp

Filesize
1.4MB

Download
memory/1284-275-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/1284-274-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/1684-253-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/1684-252-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/2140-225-0x00000000077C0000-0x00000000077D1000-memory.dmp

Filesize
68KB

Download
memory/2140-149-0x00000000071F0000-0x0000000007234000-memory.dmp

Filesize
272KB

Download
memory/2140-229-0x0000000007850000-0x0000000007858000-memory.dmp

Filesize
32KB

Download
memory/2140-228-0x0000000007860000-0x000000000787A000-memory.dmp

Filesize
104KB

Download
memory/2140-227-0x0000000007810000-0x0000000007824000-memory.dmp

Filesize
80KB

Download
memory/2140-226-0x0000000007800000-0x000000000780E000-memory.dmp

Filesize
56KB

Download
memory/2140-196-0x0000000007790000-0x000000000779A000-memory.dmp

Filesize
40KB

Download
memory/2140-186-0x0000000008690000-0x0000000008D0A000-memory.dmp

Filesize
6.5MB

Download
memory/2140-184-0x00000000075F0000-0x000000000760E000-memory.dmp

Filesize
120KB

Download
memory/2140-185-0x0000000007610000-0x00000000076B3000-memory.dmp

Filesize
652KB

Download
memory/2140-132-0x00000000049E0000-0x0000000004A16000-memory.dmp

Filesize
216KB

Download
memory/2140-133-0x0000000005220000-0x00000000058EA000-memory.dmp

Filesize
6.8MB

Download
memory/2140-134-0x00000000050E0000-0x0000000005102000-memory.dmp

Filesize
136KB

Download
memory/2140-136-0x0000000005A40000-0x0000000005AA6000-memory.dmp

Filesize
408KB

Download
memory/2140-135-0x0000000005960000-0x00000000059C6000-memory.dmp

Filesize
408KB

Download
memory/2140-137-0x0000000005AB0000-0x0000000005E07000-memory.dmp

Filesize
3.3MB

Download
memory/2140-174-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/2140-147-0x0000000006040000-0x000000000605E000-memory.dmp

Filesize
120KB

Download
memory/2140-148-0x0000000006080000-0x00000000060CC000-memory.dmp

Filesize
304KB

Download
memory/2140-172-0x00000000075B0000-0x00000000075E2000-memory.dmp

Filesize
200KB

Download
memory/2140-159-0x0000000007410000-0x00000000074A6000-memory.dmp

Filesize
600KB

Download
memory/2140-161-0x00000000073E0000-0x0000000007402000-memory.dmp

Filesize
136KB

Download
memory/2140-160-0x0000000007390000-0x00000000073AA000-memory.dmp

Filesize
104KB

Download
memory/2140-162-0x0000000007A60000-0x0000000008006000-memory.dmp

Filesize
5.6MB

Download
memory/2140-173-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/2640-374-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/2640-376-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/3436-52-0x0000000000920000-0x0000000000C6A000-memory.dmp

Filesize
3.3MB

Download
memory/4024-24-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-28-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-29-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-27-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-26-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-30-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-18-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-19-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-20-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4024-25-0x0000019E22A40000-0x0000019E22A41000-memory.dmp

Filesize
4KB

Download
memory/4032-354-0x0000000007CB0000-0x0000000007CBA000-memory.dmp

Filesize
40KB

Download
memory/4032-353-0x0000000007BE0000-0x0000000007C72000-memory.dmp

Filesize
584KB

Download
memory/4196-124-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/4196-122-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/4244-263-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/4244-264-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/4328-285-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/4328-286-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/4676-692-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/4676-690-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-44-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-674-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-112-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-306-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-321-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-111-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-113-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-114-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-355-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-356-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-357-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-358-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-109-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-370-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-371-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-372-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-123-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-116-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-377-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-378-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-379-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-380-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-381-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-117-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-47-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-414-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-46-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-115-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-43-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-42-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-40-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-631-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-39-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-38-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-37-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-682-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-681-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-215-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-118-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-131-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-130-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-129-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-128-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-8-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-127-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-119-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-296-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-675-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-676-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-677-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4736-679-0x0000000001000000-0x0000000001B7D000-memory.dmp

Filesize
11.5MB

Download
memory/4852-35-0x0000000000280000-0x0000000000DFD000-memory.dmp

Filesize
11.5MB

Download
memory/4852-36-0x0000000000280000-0x0000000000DFD000-memory.dmp

Filesize
11.5MB

Download
memory/4928-242-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/4928-241-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/4944-230-0x00000000710A0000-0x00000000710EC000-memory.dmp

Filesize
304KB

Download
memory/4944-231-0x00000000713E0000-0x0000000071737000-memory.dmp

Filesize
3.3MB

Download
memory/5296-721-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/5296-723-0x0000000000CD0000-0x000000000184D000-memory.dmp

Filesize
11.5MB

Download
memory/5912-0-0x0000000000BC0000-0x000000000173D000-memory.dmp

Filesize
11.5MB

Download
memory/5912-10-0x0000000000BC0000-0x000000000173D000-memory.dmp

Filesize
11.5MB

Download
memory/6096-15-0x0000000000C50000-0x00000000017CD000-memory.dmp

Filesize
11.5MB

Download
memory/6096-17-0x0000000000C50000-0x00000000017CD000-memory.dmp

Filesize
11.5MB

Download