defendnot | 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644

Analysis

max time kernel
586s
max time network
904s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Matcha_external_v4.2.exe
Size 4.3MB
Sample260808-rhlfysyapa
SHA256 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644
MD5 77c6b9d2a2db97e1a5fcd5c4fae7df9f
SHA1 7af97baf4a6ebc86e8e9d817b7ac507e96122e04
SHA512 ea059f1bc8c6b2260249eccbabf01d028623abe18446ad833ded002d9f8db1965d9586781452edc59d5d66f59bf17a62f6482a935faf177a3f0e550026aef134
SSDEEP 98304:/iiNgScVIxpLfNuSZTKA0t9FFPEiEXZNnAKSb7L3w0i:/XWV+p9bk9fciEZNnCLA
TLSH
T13526D0303AEA4019F1B7AFB5DBD475DA9A6EF2233706955E148203870F23A41EDC713A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution defendnot hacktool persistence

Malware Config

Signatures

Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
hacktool defendnot

Detects Defendnot 1 IoCs

resource	yara_rule
behavioral2/files/0x000f00000001c5aa-109.dat	family_defendnot

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6020	powershell.exe
2372	powershell.exe
1756	powershell.exe
5352	powershell.exe
5268	powershell.exe
1460	powershell.exe
3776	powershell.exe

Executes dropped EXE 7 IoCs

pid	Process
3920	svchost.exe
4516	svchost.exe
6120	defendnot-loader.exe
3384	Stager.exe
3916	defendnot-loader.exe
1304	defendnot-loader.exe
4336	defendnot-loader.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
4212	Taskmgr.exe
944	Taskmgr.exe
4292	Taskmgr.exe
4292	Taskmgr.exe
992	Taskmgr.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\defendnot	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	OfficeClickToRun.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	Matcha_external_v4.2.exe
File opened (read-only)	\??\VBoxMiniRdrDN	svchost.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SERVIC~1\LOCALS~1\AppData\Local\Temp\MpCmdRun.log	MpCmdRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2420	cmd.exe
5036	cmd.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5476	schtasks.exe
5920	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4516	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5764	Matcha_external_v4.2.exe
6020	powershell.exe
6020	powershell.exe
2372	powershell.exe
2372	powershell.exe
2372	powershell.exe
6020	powershell.exe
4516	svchost.exe
4516	svchost.exe
1756	powershell.exe
1756	powershell.exe
5352	powershell.exe
5352	powershell.exe
1756	powershell.exe
5352	powershell.exe
5268	powershell.exe
5268	powershell.exe
5268	powershell.exe
1460	powershell.exe
1460	powershell.exe
1460	powershell.exe
3776	powershell.exe
3776	powershell.exe
3776	powershell.exe
3384	Stager.exe
3384	Stager.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
3348	svchost.exe
3348	svchost.exe
5940	svchost.exe
5940	svchost.exe
1176	svchost.exe
1176	svchost.exe
1420	svchost.exe
1420	svchost.exe
3532	svchost.exe
3532	svchost.exe
1420	svchost.exe
1420	svchost.exe
5940	svchost.exe
5940	svchost.exe
1420	svchost.exe
1420	svchost.exe
5940	svchost.exe
5940	svchost.exe
1420	svchost.exe
1420	svchost.exe
5940	svchost.exe
5940	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe
1420	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2312	explorer.exe
4516	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5764	Matcha_external_v4.2.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	4516	svchost.exe
Token: SeDebugPrivilege	3920	svchost.exe
Token: SeIncreaseQuotaPrivilege	6020	powershell.exe
Token: SeSecurityPrivilege	6020	powershell.exe
Token: SeTakeOwnershipPrivilege	6020	powershell.exe
Token: SeLoadDriverPrivilege	6020	powershell.exe
Token: SeSystemProfilePrivilege	6020	powershell.exe
Token: SeSystemtimePrivilege	6020	powershell.exe
Token: SeProfSingleProcessPrivilege	6020	powershell.exe
Token: SeIncBasePriorityPrivilege	6020	powershell.exe
Token: SeCreatePagefilePrivilege	6020	powershell.exe
Token: SeBackupPrivilege	6020	powershell.exe
Token: SeRestorePrivilege	6020	powershell.exe
Token: SeShutdownPrivilege	6020	powershell.exe
Token: SeDebugPrivilege	6020	powershell.exe
Token: SeSystemEnvironmentPrivilege	6020	powershell.exe
Token: SeRemoteShutdownPrivilege	6020	powershell.exe
Token: SeUndockPrivilege	6020	powershell.exe
Token: SeManageVolumePrivilege	6020	powershell.exe
Token: 33	6020	powershell.exe
Token: 34	6020	powershell.exe
Token: 35	6020	powershell.exe
Token: 36	6020	powershell.exe
Token: SeIncreaseQuotaPrivilege	2372	powershell.exe
Token: SeSecurityPrivilege	2372	powershell.exe
Token: SeTakeOwnershipPrivilege	2372	powershell.exe
Token: SeLoadDriverPrivilege	2372	powershell.exe
Token: SeSystemProfilePrivilege	2372	powershell.exe
Token: SeSystemtimePrivilege	2372	powershell.exe
Token: SeProfSingleProcessPrivilege	2372	powershell.exe
Token: SeIncBasePriorityPrivilege	2372	powershell.exe
Token: SeCreatePagefilePrivilege	2372	powershell.exe
Token: SeBackupPrivilege	2372	powershell.exe
Token: SeRestorePrivilege	2372	powershell.exe
Token: SeShutdownPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeSystemEnvironmentPrivilege	2372	powershell.exe
Token: SeRemoteShutdownPrivilege	2372	powershell.exe
Token: SeUndockPrivilege	2372	powershell.exe
Token: SeManageVolumePrivilege	2372	powershell.exe
Token: 33	2372	powershell.exe
Token: 34	2372	powershell.exe
Token: 35	2372	powershell.exe
Token: 36	2372	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	5352	powershell.exe
Token: SeIncreaseQuotaPrivilege	1756	powershell.exe
Token: SeSecurityPrivilege	1756	powershell.exe
Token: SeTakeOwnershipPrivilege	1756	powershell.exe
Token: SeLoadDriverPrivilege	1756	powershell.exe
Token: SeSystemProfilePrivilege	1756	powershell.exe
Token: SeSystemtimePrivilege	1756	powershell.exe
Token: SeProfSingleProcessPrivilege	1756	powershell.exe
Token: SeIncBasePriorityPrivilege	1756	powershell.exe
Token: SeCreatePagefilePrivilege	1756	powershell.exe
Token: SeBackupPrivilege	1756	powershell.exe
Token: SeRestorePrivilege	1756	powershell.exe
Token: SeShutdownPrivilege	1756	powershell.exe
Token: SeDebugPrivilege	1756	powershell.exe
Token: SeSystemEnvironmentPrivilege	1756	powershell.exe
Token: SeRemoteShutdownPrivilege	1756	powershell.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
4952	ctfmon.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe
5244	SecurityHealthSystray.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4516	svchost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2312	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5764 wrote to memory of 6020	5764	Matcha_external_v4.2.exe	90
PID 5764 wrote to memory of 2372	5764	Matcha_external_v4.2.exe	92
PID 5764 wrote to memory of 5476	5764	Matcha_external_v4.2.exe	94
PID 5764 wrote to memory of 4516	5764	Matcha_external_v4.2.exe	98
PID 4516 wrote to memory of 1756	4516	svchost.exe	101
PID 4516 wrote to memory of 5352	4516	svchost.exe	103
PID 4516 wrote to memory of 5920	4516	svchost.exe	104
PID 5764 wrote to memory of 5268	5764	Matcha_external_v4.2.exe	107
PID 4516 wrote to memory of 1460	4516	svchost.exe	109
PID 4516 wrote to memory of 3776	4516	svchost.exe	111
PID 5764 wrote to memory of 6120	5764	Matcha_external_v4.2.exe	113
PID 6120 wrote to memory of 4212	6120	defendnot-loader.exe	114
PID 4516 wrote to memory of 3384	4516	svchost.exe	115
PID 3384 wrote to memory of 3348	3384	Stager.exe	87
PID 3384 wrote to memory of 5940	3384	Stager.exe	78
PID 3384 wrote to memory of 1176	3384	Stager.exe	58
PID 3384 wrote to memory of 1420	3384	Stager.exe	20
PID 3384 wrote to memory of 3532	3384	Stager.exe	55
PID 3348 wrote to memory of 744	3348	svchost.exe	5
PID 3348 wrote to memory of 960	3348	svchost.exe	9
PID 1176 wrote to memory of 744	1176	svchost.exe	5
PID 1176 wrote to memory of 960	1176	svchost.exe	9
PID 3532 wrote to memory of 744	3532	svchost.exe	5
PID 3532 wrote to memory of 960	3532	svchost.exe	9
PID 3348 wrote to memory of 964	3348	svchost.exe	10
PID 3348 wrote to memory of 1160	3348	svchost.exe	14
PID 3348 wrote to memory of 3608	3348	svchost.exe	56
PID 3532 wrote to memory of 964	3532	svchost.exe	10
PID 1176 wrote to memory of 964	1176	svchost.exe	10
PID 3348 wrote to memory of 4952	3348	svchost.exe	64
PID 3348 wrote to memory of 5244	3348	svchost.exe	67
PID 1176 wrote to memory of 540	1176	svchost.exe	11
PID 3532 wrote to memory of 1160	3532	svchost.exe	14
PID 3532 wrote to memory of 3608	3532	svchost.exe	56
PID 3348 wrote to memory of 4764	3348	svchost.exe	79
PID 1176 wrote to memory of 836	1176	svchost.exe	13
PID 4516 wrote to memory of 1304	4516	svchost.exe	120
PID 3532 wrote to memory of 4952	3532	svchost.exe	64
PID 3348 wrote to memory of 5212	3348	svchost.exe	80
PID 1176 wrote to memory of 1160	1176	svchost.exe	14
PID 1176 wrote to memory of 1196	1176	svchost.exe	15
PID 3532 wrote to memory of 5244	3532	svchost.exe	67
PID 1304 wrote to memory of 4292	1304	defendnot-loader.exe	123
PID 3532 wrote to memory of 4764	3532	svchost.exe	79
PID 1176 wrote to memory of 1292	1176	svchost.exe	16
PID 3348 wrote to memory of 2312	3348	svchost.exe	81
PID 3532 wrote to memory of 5212	3532	svchost.exe	80
PID 3348 wrote to memory of 5764	3348	svchost.exe	88
PID 1176 wrote to memory of 1308	1176	svchost.exe	17
PID 3532 wrote to memory of 2312	3532	svchost.exe	81
PID 3348 wrote to memory of 2624	3348	svchost.exe
PID 3532 wrote to memory of 5764	3532	svchost.exe	88
PID 1176 wrote to memory of 1420	1176	svchost.exe	20
PID 3532 wrote to memory of 2624	3532	svchost.exe
PID 1176 wrote to memory of 1492	1176	svchost.exe	21
PID 3348 wrote to memory of 5008	3348	svchost.exe	96
PID 3916 wrote to memory of 944	3916	defendnot-loader.exe	126
PID 1176 wrote to memory of 1520	1176	svchost.exe	22
PID 3348 wrote to memory of 4516	3348	svchost.exe	98
PID 3532 wrote to memory of 5008	3532	svchost.exe	96
PID 1176 wrote to memory of 1580	1176	svchost.exe	23
PID 3348 wrote to memory of 3920	3348	svchost.exe	97
PID 3532 wrote to memory of 4516	3532	svchost.exe	98
PID 1176 wrote to memory of 1720	1176	svchost.exe	24

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:960
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 960 -s 224
    3⤵
    PID:4088
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1160

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 964 -s 224
  2⤵
  PID:3144
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 964 -s 268
  2⤵
  PID:4824

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fb3c9875-a888-496e-bde9-bf52393d963d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-882a1868-f311-4c08-95ff-30367002e1c9 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-baad5338-3a22-45c7-bd22-e77c8c379273 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b20e0f7b-0d22-47fe-9cc1-fdb188a9d8d9 -LifetimeId:26886810-0d24-4ce0-97ed-28f13e02518c -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:836

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1196

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2028
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5212
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of UnmapMainImage
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Matcha_external_v4.2.exe
      "C:\Users\Admin\AppData\Local\Temp\Matcha_external_v4.2.exe"
      4⤵
      Checks for VirtualBox DLLs, possible anti-VM trick
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\34vdebsv.jsh
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6020
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\aixszqge.taw
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2372
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5476
    - - C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe
        
        "C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe"
        5⤵
        Executes dropped EXE
        Checks for VirtualBox DLLs, possible anti-VM trick
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4516
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\5qx2pnro.55n
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1756
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\cc2uqu53.zfo
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5352
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "svchost" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5920
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionProcess Stager.exe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:1460
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionProcess defendnot-loader.exe
        6⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\5qx2pnro.55n\Stager.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5qx2pnro.55n\Stager.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\cc2uqu53.zfo\defendnot-loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\cc2uqu53.zfo\defendnot-loader.exe" --silent --name "Windows Security"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1304
        
        C:\Windows\SYSTEM32\Taskmgr.exe
        
        Taskmgr.exe
        7⤵
        Loads dropped DLL
        
        PID:4292
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -c Add-MpPreference -ExclusionProcess defendnot-loader.exe
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\defendnot-loader.exe
        
        "C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\defendnot-loader.exe" --silent --name "Windows Security"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:6120
      - C:\Windows\SYSTEM32\Taskmgr.exe
        
        Taskmgr.exe
        6⤵
        Loads dropped DLL
        
        PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2276

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2604
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:4952

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2804

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2908

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Modifies data under HKEY_USERS
PID:3504

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3532

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4324

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4620

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4692

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5140

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5204

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:5152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5940

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3348

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2712

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:5008

C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe
C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:1220

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3436
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 392 -p 964 -ip 964
  2⤵
  PID:5028

C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\defendnot-loader.exe
C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\defendnot-loader.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4464
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:5036

C:\Program Files\Windows Defender\MpCmdRun.exe
"C:\Program Files\Windows Defender\MpCmdRun.exe" -wdenable
1⤵
- Drops file in Windows directory
PID:4360
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2460

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:6028

C:\Users\Admin\AppData\Local\Temp\cc2uqu53.zfo\defendnot-loader.exe
C:\Users\Admin\AppData\Local\Temp\cc2uqu53.zfo\defendnot-loader.exe
1⤵
- Executes dropped EXE
PID:4336
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2432
- C:\Windows\SYSTEM32\Taskmgr.exe
  Taskmgr.exe
  2⤵
  - Loads dropped DLL
  PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c pause
  2⤵
  - Executes a command shell one-liner
  PID:2420

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:Global.DesktopSpotlight.AppXz2j21w56bgxkgsjhtn7zkjsepq96erz2.mca
1⤵
PID:4360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4552

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 50b9dc324634108ff1aa98008c68c20b19c4e982d377c82afc12ea505ff598bd
MD5 2effd9b76a5fd667b1642852861ce04e
SHA1 86c9117fff0fd1a99dbc6dba27ebd143235eb996
SHA512 5f51665089f7705ba4dbb70b3b6d4368208751a5577300c73910fa46c6b6fd038b6d1c26b0e455bcf2f0cff058e9d18768692a998ba4e273f8ed56c9c3d938a4
SSDEEP 1536:1KLg07Yo2hk3MFfKQVAflJdpHYLh4iUxpR40i71YigMQyPTOdBcV3CNBQkj2Va5o:1KLg07Yo2hk3MFfKQVAflJd9YLqiUpRe
TLSH
T1EC636292E9204E75E1A66F3EF15622627C30394690F8153211DC25EFA987D930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 44d1c794b1956d71d0fca943aa7f55868175f3274cfd84a549da445f2b01b1da
MD5 f35ade6c5a5b576451f7f404d7645cfc
SHA1 8d01e84041cace9c90f717785983d68a3c86ea30
SHA512 4809359329f677de78de24ed9e768f14e6c4a68572342dda05dd24f5b6e3a761d998e119d89db758b078f7af5cf479be0dacbb650daac9d676bf6e860fc2c4dc
TLSH
T15E212233F3DD8614C899403A60CDA91136FA87CB81DECFAB7B80D156A52FA99CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 46ef3346f5f3abc015f93bc8502b9e92e7ff6377b6bdbc6330bf11c9ab8dc566
MD5 316544e61381b108fd612a643a394bc6
SHA1 a0e469b2b89bb5ef3f80d1bf8a43c3766deb37fd
SHA512 b2a990c3ee38a610e22dedaec53c02bba274e4681a358df7be6b669b0c72cade46e21f8442d4abefbd12ecae31be4e2e210d6c47885b85411b7340a2d4c55bf2
TLSH
T10B212233F3DD8624C899403A60CDA81036FAC7CB81DECEAB7B80D155A52F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 df5de984121ab9eb702c2ef1c0716750e770551b5a5551fee347941d5bdfab01
MD5 8c274452b4cefabecd528a1214159e4a
SHA1 59fefbf3c332bed6d778918035ad778fc2d3cad5
SHA512 9bd08a264f82cf86abb106e99d71e24f4c93aac148ef207091e370f242e49fef2bdff11fb29d20b1b6e1001ccf746a6191f571e33772e0eedbd54b1ed1aa3102
TLSH
T1B0217633B3CC8654C899013A10CEAC1036BB87CB409E8E9B6B84D519A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

Stager.exe

Path C:\Users\Admin\AppData\Local\Temp\5qx2pnro.55n\Stager.exe
Size 155KB
SHA256 32ddcc8ec426baf56816514447c6cef2ef81b20b145946e7533401d3eb0ca929
MD5 ff508c605092d6aaf88651c4406162fb
SHA1 6986dd0dc239754ae457da779f065d70335190a5
SHA512 37905907e1a8b6e9e8108c54dd14b2f35f1643bdd79e1469e872eec37381bd6a453b5059aa5f5cf99f2659b0f3cf2b400464d95f60db63b2d7dd4617995b67ca
SSDEEP 3072:9v0TE0JxUUifwPGOzCzvebf/LlX3fR5fjbFBeHUY0kZ3tMwNH76z6:ibOUiEGnviZR5fjbFM0kZ9Mm
TLSH
T12BF31216FFDC82F6DE0C0A71EE73D21505FCA10642379A9E9DA1107B1A179C79C84AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ira5f3fe.5mx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ira5f3fe.5mx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ctx.bin

Path C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\ctx.bin
Size 131B
SHA256 2aea52e1e8139e97a3406c074d8c932c1ec0d7f7d000687315ad1d5c09229fdb
MD5 5ac8ce0a3cd6c17982b6da8b549c930d
SHA1 df997355c49169867b202b4367997630e4141e88
SHA512 23bbaff5b9113bbb23560cfd393214b8ceed93157f10a49aa378f8609483df71cbe8330c2a627079a0fddef30a1e0bf3a69b7df5b0f875048bf1cde13fa81597
MD5 SHA1 SHA512

Submit Download

ctx.bin

Path C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\ctx.bin
Size 131B
SHA256 5d7f018ddd2e052e2816d42ab6e1f204fd5103954102d574c6128b32fc8d56ef
MD5 555d91c31e323915b09acd85b167d656
SHA1 fbf73cc606eb4d9d89a443e9c8906fb3878bacd0
SHA512 15f5759ab5cf22f1f24316b63ee1b17987f34a7aa2217537d595bac7cc2cd619a122f53637c4d4aa10c5fb84a0a6c19475e85037f15e3d7bdbd2e7fd1d697134
MD5 SHA1 SHA512

Submit Download

defendnot-loader.exe

Path C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\defendnot-loader.exe
Size 581KB
SHA256 4776620d4a617ce96d83a3a2ae0999a9dc6ee79bd9dcefe296cd877a62aa2224
MD5 734d301654affee77396b554ccb04e0e
SHA1 7a4129e6a9180d4eb326e0c3a1f138539816cbc6
SHA512 48762065698d08366bc7413f65cc9f9577dc6099ecd8441bc48fb9a16e65d03fa6815b1000839fd4a34a5d11cebbc5a3a0505dc2d085e3e5ca424b6189490184
SSDEEP 12288:wDddddddddoCh8ahw7TLZ0yph0lhSMXliMsBk:wDddddddddoChjhw7CYh0lhSMXlns
TLSH
T18BC49D26B7E940F9D1ABC27889530A16EB737C4643616ACF03E44A675F236E05F3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot.dll

Path C:\Users\Admin\AppData\Local\Temp\aixszqge.taw\defendnot.dll
Size 427KB
SHA256 45e942ba59f3876b263a03ed7e5d5b1b250e84a0a4b4093b3c13b5fca4e12b21
MD5 edcfd344d44db165aaadaa1c75499daf
SHA1 09b25238b9df51d2d390599a12f49384f815fb73
SHA512 b295f371a3f0f907d8273b83bca32e6512b08dc10215ba2ad7f8e02c1b56c7d6f579a8affb693837fec711f9ef6a0f9ab1088f8760a58a21b7a430ef0fbbbb33
SSDEEP 6144:yuax4l7odwsjYGT5Zeu14MPQEPa6/ph0lhSMXlBXBWniG77mHBR:yppTzn1bZa6/ph0lhSMXliV3
TLSH
T15094AE16B7A580B9E16B8278C8570A05EB337C414791EBCF03A4DAB66F637D15B3EB01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\WindowsServices\svchost.exe
Size 4.3MB
SHA256 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644
MD5 77c6b9d2a2db97e1a5fcd5c4fae7df9f
SHA1 7af97baf4a6ebc86e8e9d817b7ac507e96122e04
SHA512 ea059f1bc8c6b2260249eccbabf01d028623abe18446ad833ded002d9f8db1965d9586781452edc59d5d66f59bf17a62f6482a935faf177a3f0e550026aef134
SSDEEP 98304:/iiNgScVIxpLfNuSZTKA0t9FFPEiEXZNnAKSb7L3w0i:/XWV+p9bk9fciEZNnCLA
TLSH
T13526D0303AEA4019F1B7AFB5DBD475DA9A6EF2233706955E148203870F23A41EDC713A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

defendnot

Path C:\Windows\System32\Tasks\defendnot
Size 3KB
SHA256 39d3b5ddc476f4e8745e00541216b44e2a19ffe9e7eb83075d1b7332d661471f
MD5 2495206692b2539119828bdc9fe1abdf
SHA1 27d220b1c729d91687f447a23f8bca4f1c2a17c7
SHA512 453f1c07f96f46876d8f464f15a52ae79144b8e569939cce57814e00a016b047491818847c39bc0c0b4980c5acb08a958a98204a002a2c1e8e7b612bf9dea03b
TLSH
T1BA61574367EE1208F2F76B6CAEB610218E67BD415938C46D00AC240DCBF7E2289607B7
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 f8ff58cd9d0706b5b3bea82124271dd6016dd3b08d0468778c2948a94687d1e6
MD5 3931ac709ccc23d188e34d23816c1c4a
SHA1 14d6b8a60d84e9ee5395e3fd21f9a616d832093c
SHA512 8b8c24f7177066df625839167123b1e823d2d5d2adc14fb1467a0b4a7d8ac2412e9eff01e4ea68c53e111334e43e7f152d1be0c5bf7e97795b6c060884e5c1a5
TLSH
T13DE08C167BA80208F5330A3C6973A845DA36B62AAE01CA9D0B35008D1C24FA2D833619
MD5 SHA1 SHA512 TLSH

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 9964a078b104aaf5d51e3858abb2216d5ac314e2706b759371aeaa8457b55f02
MD5 81ffd15ebb39e56a06148c186cfbf4ed
SHA1 7d710492b9e8db8935c500b15d3150ee9052fe0f
SHA512 e958104c76b33f9bacde5e56517289664f41049645d08782cd28fb45f3d9498c01ddeb0db62b9cd1f08fea909daeb8a25d5eb1709425d247cdb515893a6563a6
TLSH
T195E0C2256A680204E633167CDD625565453776A65D01C64A0B38548C0C2BF21A837366
MD5 SHA1 SHA512 TLSH

Submit Download

FB0D848F74F70BB2EAA93746D24D9749

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749
Size 330B
SHA256 14ee20cfea4d01d250fd4479f55edc083bb4243e88dfc46251430994c8baff00
MD5 00a011bf9033337f50da13eecb85e56a
SHA1 f8d14f3186ff4fe4b426409b10fae80667d5e2be
SHA512 e55651c58f35c41823f8d10a904283664aba04af305dd67c1774613b215397b7d7f17357e4f5df3c0911ec8fa9c75cb949995e7fcfc835c57420a45627d371b1
TLSH
T10FE02B053BD85202E9F34E3CED6564474D3B7567AE05C64D8B79114C0C24F62DC77319
MD5 SHA1 SHA512 TLSH

Submit Download

B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92
Size 422B
SHA256 e79cfe7e7417c2ac12e5133838decf0de233792341813f6b09e334fb86749de9
MD5 94cf7870cde4be22256056f61bb8be06
SHA1 cc579aa58316925b2476b2e4d22c32c4d0e018eb
SHA512 4146ca9ed19bc5196fc5dd98d5316e5291ef72cb4cd07fe09219318edefee1c3078e4591fc92f1b7a899a048672cbd42ab26a0d0a7a788a04d04db5880d695ed
TLSH
T144E0C0602CFD5028E731BF7C9BCE152E4A3EF6A70804A7B83B20020C6619D800D39B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/744-200-0x00000294BD470000-0x00000294BD49B000-memory.dmp

Download

memory/744-243-0x00000294BD4D0000-0x00000294BD4FB000-memory.dmp

Download

memory/744-248-0x00000294BD4D0000-0x00000294BD4FB000-memory.dmp

Download

memory/744-249-0x00000294BD4D0000-0x00000294BD4FB000-memory.dmp

Download

memory/744-250-0x00000294BD4D0000-0x00000294BD4FB000-memory.dmp

Download

memory/744-251-0x00000294BD4D0000-0x00000294BD4FB000-memory.dmp

Download

memory/744-238-0x00000294BD4A0000-0x00000294BD4CB000-memory.dmp

Download

memory/744-237-0x00000294BD4A0000-0x00000294BD4CB000-memory.dmp

Download

memory/744-236-0x00000294BD4A0000-0x00000294BD4CB000-memory.dmp

Download

memory/744-235-0x00000294BD4A0000-0x00000294BD4CB000-memory.dmp

Download

memory/744-230-0x00000294BD4A0000-0x00000294BD4CB000-memory.dmp

Download

memory/744-205-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/744-204-0x00000294BD470000-0x00000294BD49B000-memory.dmp

Download

memory/744-203-0x00000294BD470000-0x00000294BD49B000-memory.dmp

Download

memory/744-202-0x00000294BD470000-0x00000294BD49B000-memory.dmp

Download

memory/744-201-0x00000294BD470000-0x00000294BD49B000-memory.dmp

Download

memory/744-195-0x00000294BD470000-0x00000294BD49B000-memory.dmp

Download

memory/1160-266-0x000001EE0CEB0000-0x000001EE0CEDB000-memory.dmp

Download

memory/1160-260-0x000001EE0CEB0000-0x000001EE0CEDB000-memory.dmp

Download

memory/1160-267-0x000001EE0CEB0000-0x000001EE0CEDB000-memory.dmp

Download

memory/1160-268-0x000001EE0CEB0000-0x000001EE0CEDB000-memory.dmp

Download

memory/1160-265-0x000001EE0CEB0000-0x000001EE0CEDB000-memory.dmp

Download

memory/1160-269-0x000001EE0CEB0000-0x000001EE0CEDB000-memory.dmp

Download

memory/1160-270-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/1176-208-0x00000199A56C0000-0x00000199A56C9000-memory.dmp

Download

memory/1176-210-0x00000199A56C0000-0x00000199A56C9000-memory.dmp

Download

memory/1176-209-0x00000199A56C0000-0x00000199A56C9000-memory.dmp

Download

memory/1420-164-0x00000206746D0000-0x00000206746FB000-memory.dmp

Download

memory/1420-166-0x00000206746D0000-0x00000206746FB000-memory.dmp

Download

memory/1420-165-0x00000206746D0000-0x00000206746FB000-memory.dmp

Download

memory/1420-154-0x0000020672FB0000-0x0000020672FB9000-memory.dmp

Download

memory/1420-145-0x0000020672FB0000-0x0000020672FB9000-memory.dmp

Download

memory/1420-153-0x0000020672FB0000-0x0000020672FB9000-memory.dmp

Download

memory/1420-146-0x0000020672FB0000-0x0000020672FB9000-memory.dmp

Download

memory/1420-167-0x00000206746D0000-0x00000206746FB000-memory.dmp

Download

memory/1420-159-0x00000206746D0000-0x00000206746FB000-memory.dmp

Download

memory/1420-158-0x00000206746D0000-0x00000206746FB000-memory.dmp

Download

memory/1420-157-0x0000020672FC0000-0x0000020672FE6000-memory.dmp

Download

memory/1420-155-0x0000020672FB0000-0x0000020672FB9000-memory.dmp

Download

memory/2372-57-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-37-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-49-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-59-0x000001E271B00000-0x000001E271B0A000-memory.dmp

Download

memory/2372-36-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-50-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-48-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-81-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-51-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-52-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-41-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-56-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-53-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/2372-39-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/3348-186-0x000001B6CB110000-0x000001B6CB119000-memory.dmp

Download

memory/3348-140-0x000001B6CB0F0000-0x000001B6CB0F5000-memory.dmp

Download

memory/3348-185-0x000001B6CB110000-0x000001B6CB119000-memory.dmp

Download

memory/3348-187-0x000001B6CB110000-0x000001B6CB119000-memory.dmp

Download

memory/3384-133-0x00007FFB99A90000-0x00007FFB99E31000-memory.dmp

Download

memory/3384-136-0x00007FFB9B410000-0x00007FFB9B4D7000-memory.dmp

Download

memory/3384-132-0x00007FFB9C680000-0x00007FFB9C8E3000-memory.dmp

Download

memory/3384-131-0x0000025E323F0000-0x0000025E3241C000-memory.dmp

Download

memory/3532-214-0x000001447A970000-0x000001447A979000-memory.dmp

Download

memory/3532-213-0x000001447A970000-0x000001447A979000-memory.dmp

Download

memory/3532-212-0x000001447A970000-0x000001447A979000-memory.dmp

Download

memory/3608-282-0x000001CE09E00000-0x000001CE09E2B000-memory.dmp

Download

memory/3608-286-0x00007FFB5C7C0000-0x00007FFB5C7D0000-memory.dmp

Download

memory/3608-285-0x000001CE09E00000-0x000001CE09E2B000-memory.dmp

Download

memory/3608-284-0x000001CE09E00000-0x000001CE09E2B000-memory.dmp

Download

memory/3608-283-0x000001CE09E00000-0x000001CE09E2B000-memory.dmp

Download

memory/3608-281-0x000001CE09E00000-0x000001CE09E2B000-memory.dmp

Download

memory/3608-276-0x000001CE09E00000-0x000001CE09E2B000-memory.dmp

Download

memory/4516-79-0x00000247239D0000-0x00000247239FA000-memory.dmp

Download

memory/4516-78-0x0000024723980000-0x00000247239CA000-memory.dmp

Download

memory/4516-64-0x0000024723550000-0x0000024723562000-memory.dmp

Download

memory/4516-71-0x0000024723760000-0x00000247237B0000-memory.dmp

Download

memory/4516-70-0x00000247236D0000-0x000002472370A000-memory.dmp

Download

memory/4516-72-0x0000024723870000-0x0000024723922000-memory.dmp

Download

memory/4516-73-0x0000024723710000-0x000002472375A000-memory.dmp

Download

memory/4516-74-0x00000247237B0000-0x00000247237FE000-memory.dmp

Download

memory/4516-75-0x0000024723800000-0x0000024723828000-memory.dmp

Download

memory/4516-76-0x0000024723830000-0x0000024723864000-memory.dmp

Download

memory/4516-77-0x0000024723930000-0x000002472397C000-memory.dmp

Download

memory/5764-12-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-58-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-100-0x0000019D58770000-0x0000019D5877A000-memory.dmp

Download

memory/5764-1-0x0000019D3CC10000-0x0000019D3D064000-memory.dmp

Download

memory/5764-2-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-3-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-4-0x0000019D3D570000-0x0000019D3D58E000-memory.dmp

Download

memory/5764-5-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-6-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-55-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-7-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-8-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-0-0x00007FFB799CF000-0x00007FFB799D0000-memory.dmp

Download

memory/5764-101-0x0000019D587A0000-0x0000019D587B2000-memory.dmp

Download

memory/5764-9-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-10-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-11-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-13-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-17-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-16-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-15-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5764-14-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/5940-189-0x00000287B5860000-0x00000287B5869000-memory.dmp

Download

memory/5940-226-0x00000287B5A50000-0x00000287B5A7B000-memory.dmp

Download

memory/5940-224-0x00000287B5A50000-0x00000287B5A7B000-memory.dmp

Download

memory/5940-218-0x00000287B5A50000-0x00000287B5A7B000-memory.dmp

Download

memory/5940-190-0x00000287B5860000-0x00000287B5869000-memory.dmp

Download

memory/5940-191-0x00000287B5860000-0x00000287B5869000-memory.dmp

Download

memory/5940-225-0x00000287B5A50000-0x00000287B5A7B000-memory.dmp

Download

memory/5940-223-0x00000287B5A50000-0x00000287B5A7B000-memory.dmp

Download

memory/6020-22-0x0000022CA53E0000-0x0000022CA5402000-memory.dmp

Download

memory/6020-31-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-18-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-28-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-19-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-29-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-33-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-30-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-32-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-35-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-27-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-54-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-47-0x0000022CA55B0000-0x0000022CA5662000-memory.dmp

Download

memory/6020-25-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-26-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-82-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-44-0x0000022CA5590000-0x0000022CA55AE000-memory.dmp

Download

memory/6020-87-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download

memory/6020-34-0x00007FFB79840000-0x00007FFB7A1E4000-memory.dmp

Download