Analysis
-
max time kernel
95s -
max time network
160s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
09-08-2021 03:41
Static task
static1
General
-
Target
666b2557bae9f06363a55e64fe992f17.exe
-
Size
6.6MB
-
MD5
666b2557bae9f06363a55e64fe992f17
-
SHA1
affc2a67755549665a57d51c3c8767992ff20557
-
SHA256
3d93d1e45579a47c3a3425fd16319c5a004396a2d98b7cf170ed009dad29c247
-
SHA512
b7a392dc16c54ed5c064211c97e43d476cdd9a735990bb223e88e220b59ea45d5d23327a7282b5c1cdaed05b6c8f4680359bbbf83cc44be3c47f6d689d5ba572
Malware Config
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
vidar
39.4
706
https://sergeevih43.tumblr.com/
-
profile_id
706
Extracted
redline
Cana
176.111.174.254:56328
Extracted
redline
DomAni2
flestriche.xyz:80
Extracted
metasploit
windows/single_exec
Signatures
-
Glupteba Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4676-513-0x0000000005140000-0x0000000005A66000-memory.dmp family_glupteba behavioral2/memory/4676-524-0x0000000000400000-0x000000000309A000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rUNdlL32.eXerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4840 4724 rUNdlL32.eXe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7008 4104 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7708 4104 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/4332-289-0x0000000006150000-0x000000000616B000-memory.dmp family_redline behavioral2/memory/4332-294-0x0000000008E20000-0x0000000008E39000-memory.dmp family_redline behavioral2/memory/4992-311-0x0000000000417E3A-mapping.dmp family_redline behavioral2/memory/4992-309-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral2/memory/4992-319-0x0000000005050000-0x0000000005656000-memory.dmp family_redline behavioral2/memory/5076-507-0x0000000000418E52-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars C:\Users\Admin\AppData\Local\Temp\Install.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
Processes:
WerFault.exeWerFault.exedescription pid process target process PID 5160 created 4144 5160 WerFault.exe jobiea_2.exe PID 5524 created 2976 5524 WerFault.exe jobiea_1.exe -
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
-
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2976-264-0x0000000004910000-0x00000000049AD000-memory.dmp family_vidar behavioral2/memory/2976-274-0x0000000000400000-0x0000000004424000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 39 IoCs
Processes:
Files.exeFile.exeFolder.exejg3_3uag.exeInstall.exeInfo.exepub2.exeKRSetp.exeInstallation.exeInstallations.exeFolder.exesetup_installer.exesetup_install.exejobiea_1.exejobiea_6.exejobiea_7.exejobiea_2.exejobiea_3.exejobiea_4.exejobiea_5.exejobiea_8.exejfiag3g_gg.exejobiea_7.exejfiag3g_gg.exettEUVchbDvpe9BoEAmDsXvwf.exe5TV1Lwgkd0GPOH7X296YfzcS.exeWrK0AX6z_c7puhjhW5CHyeLn.exeHMMVxxH6veX5lvaZs5gM34Z5.exeCnYQ7p_jHkrHh4hSqx0naCEQ.exe4VnAQtP5hZjomAnLLO8RgLvy.exefvi6XYkrxCf36J1LidptbX1T.exeTINRKAgDfn4C4ZLppguZdH6r.exeIZtrSXvUKnbZIdlYAXAnQ0ch.exeTFYa8n4rkCtuwFBa3ybWAEhG.exeXECPi1sJhEN2TqsvudxboNQp.exesD0VAMA9DVQAWmZccrdIVWER.exeKqK3ki9il89LyK0w9t6H5tP3.exej4x1dv1AteQuF67vAkr2vkDz.exehultuusECzhdb2td8Q48aELI.exepid process 3136 Files.exe 3836 File.exe 3416 Folder.exe 184 jg3_3uag.exe 4112 Install.exe 4156 Info.exe 4188 pub2.exe 4244 KRSetp.exe 4300 Installation.exe 4452 Installations.exe 4484 Folder.exe 4680 setup_installer.exe 4888 setup_install.exe 2976 jobiea_1.exe 4756 jobiea_6.exe 4248 jobiea_7.exe 4144 jobiea_2.exe 4596 jobiea_3.exe 4612 jobiea_4.exe 5004 jobiea_5.exe 4332 jobiea_8.exe 5244 jfiag3g_gg.exe 4992 jobiea_7.exe 5880 jfiag3g_gg.exe 4900 ttEUVchbDvpe9BoEAmDsXvwf.exe 4216 5TV1Lwgkd0GPOH7X296YfzcS.exe 5652 WrK0AX6z_c7puhjhW5CHyeLn.exe 5484 HMMVxxH6veX5lvaZs5gM34Z5.exe 4976 CnYQ7p_jHkrHh4hSqx0naCEQ.exe 60 4VnAQtP5hZjomAnLLO8RgLvy.exe 3644 fvi6XYkrxCf36J1LidptbX1T.exe 3912 TINRKAgDfn4C4ZLppguZdH6r.exe 4100 IZtrSXvUKnbZIdlYAXAnQ0ch.exe 4680 TFYa8n4rkCtuwFBa3ybWAEhG.exe 2216 XECPi1sJhEN2TqsvudxboNQp.exe 996 sD0VAMA9DVQAWmZccrdIVWER.exe 4192 KqK3ki9il89LyK0w9t6H5tP3.exe 4676 j4x1dv1AteQuF67vAkr2vkDz.exe 5216 hultuusECzhdb2td8Q48aELI.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe upx -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe vmprotect C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe vmprotect behavioral2/memory/184-133-0x0000000000400000-0x0000000000651000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
666b2557bae9f06363a55e64fe992f17.exeInstallation.exeFiles.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation 666b2557bae9f06363a55e64fe992f17.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Installation.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Files.exe -
Loads dropped DLL 9 IoCs
Processes:
pub2.exerundll32.exesetup_install.exehultuusECzhdb2td8Q48aELI.exepid process 4188 pub2.exe 4876 rundll32.exe 4888 setup_install.exe 4888 setup_install.exe 4888 setup_install.exe 4888 setup_install.exe 4888 setup_install.exe 4888 setup_install.exe 5216 hultuusECzhdb2td8Q48aELI.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
jg3_3uag.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA jg3_3uag.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 264 ipinfo.io 277 ipinfo.io 303 ipinfo.io 14 ipinfo.io 15 ipinfo.io 44 ipinfo.io 45 ip-api.com -
Drops file in System32 directory 4 IoCs
Processes:
svchost.exesvchost.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent C2E05F31448A8955 svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
svchost.exejobiea_7.exeuDdy8aMXXpaN46Wn55rZYd5a.exedescription pid process target process PID 568 set thread context of 5112 568 svchost.exe svchost.exe PID 4248 set thread context of 4992 4248 jobiea_7.exe jobiea_7.exe PID 568 set thread context of 4184 568 svchost.exe svchost.exe PID 4900 set thread context of 5076 4900 uDdy8aMXXpaN46Wn55rZYd5a.exe ttEUVchbDvpe9BoEAmDsXvwf.exe -
autoit_exe 2 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe autoit_exe C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe autoit_exe -
Drops file in Program Files directory 64 IoCs
Processes:
hultuusECzhdb2td8Q48aELI.exefvi6XYkrxCf36J1LidptbX1T.exedescription ioc process File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\jquery-ui-1.8.13.custom.css hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\dailymotion.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawaud_plugin.dll hultuusECzhdb2td8Q48aELI.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe fvi6XYkrxCf36J1LidptbX1T.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe fvi6XYkrxCf36J1LidptbX1T.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\mobile.css hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\01_googleimage.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_diagonals-thick_20_666666_40x40.png hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_flat_10_000000_40x100.png hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\Audio-48.png hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libwav_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\cli.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\host.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvc1_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\status.xml hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libdvdnav_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libty_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_glass_65_ffffff_1x400.png hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\common.js hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\vimeo.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libcdda_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\libvlccore.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\art\02_frenchtv.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\twitch.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\vlm.xml hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\luac.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\rockbox_fm_presets.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\stream_window.html hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\d3d11\libdirect3d11_filters_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libmpc_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libnoseek_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\librawvid_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\data_load.exe hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libidummy_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\js\controllers.js hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\appletrailers.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsdp_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\control\libwin_hotkeys_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libsmf_plugin.dll hultuusECzhdb2td8Q48aELI.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe fvi6XYkrxCf36J1LidptbX1T.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile.html hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\modules\httprequests.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libtta_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libshm_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\browse_window.html hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\offset_window.html hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist.json hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\requests\playlist_jstree.xml hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\koreus.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\gui\libqt_plugin.dll hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\jamendo.luac hultuusECzhdb2td8Q48aELI.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libaiff_plugin.dll hultuusECzhdb2td8Q48aELI.exe -
Drops file in Windows directory 3 IoCs
Processes:
WerFault.exeMicrosoftEdge.exeMicrosoftEdge.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 20 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5160 4144 WerFault.exe jobiea_2.exe 5524 2976 WerFault.exe jobiea_1.exe 4508 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 5688 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 5024 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 916 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 1616 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 4672 3800 WerFault.exe WrK0AX6z_c7puhjhW5CHyeLn.exe 6864 6432 WerFault.exe io2ZiQvfn9hLAOXOSIqAKanl.exe 6972 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 7116 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 6164 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 6264 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 6392 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 6904 60 WerFault.exe 4VnAQtP5hZjomAnLLO8RgLvy.exe 6960 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 6568 5484 WerFault.exe HMMVxxH6veX5lvaZs5gM34Z5.exe 4892 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 7868 1560 WerFault.exe SCxqGru1JmIDEW06x5AYAQF6.exe 7920 7676 WerFault.exe rundll32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
pub2.exeTFYa8n4rkCtuwFBa3ybWAEhG.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pub2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI TFYa8n4rkCtuwFBa3ybWAEhG.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI TFYa8n4rkCtuwFBa3ybWAEhG.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI TFYa8n4rkCtuwFBa3ybWAEhG.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exesvchost.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 3948 taskkill.exe -
Processes:
browser_broker.exebrowser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe -
Modifies data under HKEY_USERS 16 IoCs
Processes:
svchost.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe -
Modifies registry class 64 IoCs
Processes:
MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\650478DC7424C37C\2 = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\SplashScreen Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 1ee517dce18cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}\1 = "30" rundll32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\7289246C77593EBF svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0bef441148dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = c63e01d8e18cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{0ED7566F-2772-48E2-B277-747D827B3B30} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = a069bcece18cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0f441ddee18cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000476ca8e5ef35c5507d35f411d82347473f935e7b1091d7668cb35ec152f862fe1426093740a7cefb52004e63e5617bc4d0f9007a5efd92b5428f8bed49045c3fa02177f0985525f18814ef652ec42f4ea6f1097a13b63dd66c84e634eec5cc51fdfdff5fc36153917012020a306c13d8331a3b5d2adcf6f945323b7df45ba90de75a79620eea902599985426f8784393db136615328ffbb04439f7e55be711ae0ed9106dd80fc9bd7a48815df60a05d6b07edaf87fef52ef263931abc0870d29001834a733f207e25ec006fcee41f24f6afab822041cc6e9d0d1a89ffd5c2fc26eb8e814e4b1981393a15489153d528c922641e74a363fb9e5a3ba31148723fa8759dfd22e6e681b398c414c6c1ee0c90ba4c355685d19d8e24e34002b26c5cc819b365fdf47fe2ec61f8a9e8303eb1b4e136dca29b1bb67d472c603c75ac83be81e34f5035e76d97afca51cc90e83e0a812589136529049efaf23439f43ca2bd98289f689d1d2c33cc193620b5ebd87164378990f607d09f7a5b71b46020f915468d6673bc26b41ba0f055b4513c7a1194594357cfb159104854677108c1a9c600f9b52e52b MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe -
Processes:
Install.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Install.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Install.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 302 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 307 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 276 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 281 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
pub2.exerundll32.exesvchost.exeWerFault.exepid process 4188 pub2.exe 4188 pub2.exe 4876 rundll32.exe 4876 rundll32.exe 568 svchost.exe 568 svchost.exe 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 2996 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 5160 WerFault.exe 2996 2996 5160 WerFault.exe 5160 WerFault.exe 2996 2996 2996 2996 2996 2996 2996 2996 2996 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
pub2.exeMicrosoftEdgeCP.exepid process 4188 pub2.exe 5892 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
MicrosoftEdge.exeInstall.exeKRSetp.exerundll32.exesvchost.exejobiea_5.exeWerFault.exedescription pid process Token: SeDebugPrivilege 4072 MicrosoftEdge.exe Token: SeDebugPrivilege 4072 MicrosoftEdge.exe Token: SeDebugPrivilege 4072 MicrosoftEdge.exe Token: SeDebugPrivilege 4072 MicrosoftEdge.exe Token: SeCreateTokenPrivilege 4112 Install.exe Token: SeAssignPrimaryTokenPrivilege 4112 Install.exe Token: SeLockMemoryPrivilege 4112 Install.exe Token: SeIncreaseQuotaPrivilege 4112 Install.exe Token: SeMachineAccountPrivilege 4112 Install.exe Token: SeTcbPrivilege 4112 Install.exe Token: SeSecurityPrivilege 4112 Install.exe Token: SeTakeOwnershipPrivilege 4112 Install.exe Token: SeLoadDriverPrivilege 4112 Install.exe Token: SeSystemProfilePrivilege 4112 Install.exe Token: SeSystemtimePrivilege 4112 Install.exe Token: SeProfSingleProcessPrivilege 4112 Install.exe Token: SeIncBasePriorityPrivilege 4112 Install.exe Token: SeCreatePagefilePrivilege 4112 Install.exe Token: SeCreatePermanentPrivilege 4112 Install.exe Token: SeBackupPrivilege 4112 Install.exe Token: SeRestorePrivilege 4112 Install.exe Token: SeShutdownPrivilege 4112 Install.exe Token: SeDebugPrivilege 4112 Install.exe Token: SeAuditPrivilege 4112 Install.exe Token: SeSystemEnvironmentPrivilege 4112 Install.exe Token: SeChangeNotifyPrivilege 4112 Install.exe Token: SeRemoteShutdownPrivilege 4112 Install.exe Token: SeUndockPrivilege 4112 Install.exe Token: SeSyncAgentPrivilege 4112 Install.exe Token: SeEnableDelegationPrivilege 4112 Install.exe Token: SeManageVolumePrivilege 4112 Install.exe Token: SeImpersonatePrivilege 4112 Install.exe Token: SeCreateGlobalPrivilege 4112 Install.exe Token: 31 4112 Install.exe Token: 32 4112 Install.exe Token: 33 4112 Install.exe Token: 34 4112 Install.exe Token: 35 4112 Install.exe Token: SeDebugPrivilege 4244 KRSetp.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 568 svchost.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 5004 jobiea_5.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeDebugPrivilege 4876 rundll32.exe Token: SeShutdownPrivilege 2996 Token: SeCreatePagefilePrivilege 2996 Token: SeShutdownPrivilege 2996 Token: SeCreatePagefilePrivilege 2996 Token: SeShutdownPrivilege 2996 Token: SeCreatePagefilePrivilege 2996 Token: SeShutdownPrivilege 2996 Token: SeCreatePagefilePrivilege 2996 Token: SeRestorePrivilege 5160 WerFault.exe Token: SeBackupPrivilege 5160 WerFault.exe -
Suspicious use of FindShellTrayWindow 23 IoCs
Processes:
File.exepid process 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 2996 2996 -
Suspicious use of SendNotifyMessage 21 IoCs
Processes:
File.exepid process 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe 3836 File.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
MicrosoftEdge.exeInfo.exeMicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeHMMVxxH6veX5lvaZs5gM34Z5.exefvi6XYkrxCf36J1LidptbX1T.exe4VnAQtP5hZjomAnLLO8RgLvy.exeTFYa8n4rkCtuwFBa3ybWAEhG.exeXECPi1sJhEN2TqsvudxboNQp.exej4x1dv1AteQuF67vAkr2vkDz.exehultuusECzhdb2td8Q48aELI.exeKqK3ki9il89LyK0w9t6H5tP3.exepid process 4072 MicrosoftEdge.exe 4156 Info.exe 4644 MicrosoftEdgeCP.exe 5420 MicrosoftEdge.exe 5892 MicrosoftEdgeCP.exe 5892 MicrosoftEdgeCP.exe 5484 HMMVxxH6veX5lvaZs5gM34Z5.exe 3644 fvi6XYkrxCf36J1LidptbX1T.exe 60 4VnAQtP5hZjomAnLLO8RgLvy.exe 4680 TFYa8n4rkCtuwFBa3ybWAEhG.exe 2216 XECPi1sJhEN2TqsvudxboNQp.exe 4676 j4x1dv1AteQuF67vAkr2vkDz.exe 5216 hultuusECzhdb2td8Q48aELI.exe 4192 KqK3ki9il89LyK0w9t6H5tP3.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
666b2557bae9f06363a55e64fe992f17.exeFiles.exeInstallation.exeFolder.exeInstallations.exerUNdlL32.eXesetup_installer.exerundll32.exesvchost.exeInstall.exesetup_install.execmd.exedescription pid process target process PID 628 wrote to memory of 3136 628 666b2557bae9f06363a55e64fe992f17.exe Files.exe PID 628 wrote to memory of 3136 628 666b2557bae9f06363a55e64fe992f17.exe Files.exe PID 628 wrote to memory of 3136 628 666b2557bae9f06363a55e64fe992f17.exe Files.exe PID 3136 wrote to memory of 3836 3136 Files.exe File.exe PID 3136 wrote to memory of 3836 3136 Files.exe File.exe PID 3136 wrote to memory of 3836 3136 Files.exe File.exe PID 628 wrote to memory of 3416 628 666b2557bae9f06363a55e64fe992f17.exe Folder.exe PID 628 wrote to memory of 3416 628 666b2557bae9f06363a55e64fe992f17.exe Folder.exe PID 628 wrote to memory of 3416 628 666b2557bae9f06363a55e64fe992f17.exe Folder.exe PID 628 wrote to memory of 184 628 666b2557bae9f06363a55e64fe992f17.exe jg3_3uag.exe PID 628 wrote to memory of 184 628 666b2557bae9f06363a55e64fe992f17.exe jg3_3uag.exe PID 628 wrote to memory of 184 628 666b2557bae9f06363a55e64fe992f17.exe jg3_3uag.exe PID 628 wrote to memory of 4112 628 666b2557bae9f06363a55e64fe992f17.exe Install.exe PID 628 wrote to memory of 4112 628 666b2557bae9f06363a55e64fe992f17.exe Install.exe PID 628 wrote to memory of 4112 628 666b2557bae9f06363a55e64fe992f17.exe Install.exe PID 628 wrote to memory of 4156 628 666b2557bae9f06363a55e64fe992f17.exe Info.exe PID 628 wrote to memory of 4156 628 666b2557bae9f06363a55e64fe992f17.exe Info.exe PID 628 wrote to memory of 4156 628 666b2557bae9f06363a55e64fe992f17.exe Info.exe PID 628 wrote to memory of 4188 628 666b2557bae9f06363a55e64fe992f17.exe pub2.exe PID 628 wrote to memory of 4188 628 666b2557bae9f06363a55e64fe992f17.exe pub2.exe PID 628 wrote to memory of 4188 628 666b2557bae9f06363a55e64fe992f17.exe pub2.exe PID 628 wrote to memory of 4244 628 666b2557bae9f06363a55e64fe992f17.exe KRSetp.exe PID 628 wrote to memory of 4244 628 666b2557bae9f06363a55e64fe992f17.exe KRSetp.exe PID 628 wrote to memory of 4300 628 666b2557bae9f06363a55e64fe992f17.exe Installation.exe PID 628 wrote to memory of 4300 628 666b2557bae9f06363a55e64fe992f17.exe Installation.exe PID 628 wrote to memory of 4300 628 666b2557bae9f06363a55e64fe992f17.exe Installation.exe PID 4300 wrote to memory of 4452 4300 Installation.exe Installations.exe PID 4300 wrote to memory of 4452 4300 Installation.exe Installations.exe PID 4300 wrote to memory of 4452 4300 Installation.exe Installations.exe PID 3416 wrote to memory of 4484 3416 Folder.exe Folder.exe PID 3416 wrote to memory of 4484 3416 Folder.exe Folder.exe PID 3416 wrote to memory of 4484 3416 Folder.exe Folder.exe PID 4452 wrote to memory of 4680 4452 Installations.exe setup_installer.exe PID 4452 wrote to memory of 4680 4452 Installations.exe setup_installer.exe PID 4452 wrote to memory of 4680 4452 Installations.exe setup_installer.exe PID 4840 wrote to memory of 4876 4840 rUNdlL32.eXe rundll32.exe PID 4840 wrote to memory of 4876 4840 rUNdlL32.eXe rundll32.exe PID 4840 wrote to memory of 4876 4840 rUNdlL32.eXe rundll32.exe PID 4680 wrote to memory of 4888 4680 setup_installer.exe setup_install.exe PID 4680 wrote to memory of 4888 4680 setup_installer.exe setup_install.exe PID 4680 wrote to memory of 4888 4680 setup_installer.exe setup_install.exe PID 4876 wrote to memory of 568 4876 rundll32.exe svchost.exe PID 568 wrote to memory of 5112 568 svchost.exe svchost.exe PID 568 wrote to memory of 5112 568 svchost.exe svchost.exe PID 4876 wrote to memory of 2788 4876 rundll32.exe svchost.exe PID 4112 wrote to memory of 2880 4112 Install.exe cmd.exe PID 4112 wrote to memory of 2880 4112 Install.exe cmd.exe PID 4112 wrote to memory of 2880 4112 Install.exe cmd.exe PID 568 wrote to memory of 5112 568 svchost.exe svchost.exe PID 4888 wrote to memory of 4308 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 4308 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 4308 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 3744 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 3744 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 3744 4888 setup_install.exe cmd.exe PID 4876 wrote to memory of 68 4876 rundll32.exe svchost.exe PID 4888 wrote to memory of 4104 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 4104 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 4104 4888 setup_install.exe cmd.exe PID 4308 wrote to memory of 2976 4308 cmd.exe jobiea_1.exe PID 4308 wrote to memory of 2976 4308 cmd.exe jobiea_1.exe PID 4308 wrote to memory of 2976 4308 cmd.exe jobiea_1.exe PID 4888 wrote to memory of 4220 4888 setup_install.exe cmd.exe PID 4888 wrote to memory of 4220 4888 setup_install.exe cmd.exe
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2788
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2708
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2696
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2476
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2424
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1852
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1404
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1212
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1204
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1076
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:596
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\666b2557bae9f06363a55e64fe992f17.exe"C:\Users\Admin\AppData\Local\Temp\666b2557bae9f06363a55e64fe992f17.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\Files.exe"C:\Users\Admin\AppData\Local\Temp\Files.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\Folder.exe"C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a3⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:184 -
C:\Users\Admin\AppData\Local\Temp\Install.exe"C:\Users\Admin\AppData\Local\Temp\Install.exe"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵PID:2880
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\Info.exe"C:\Users\Admin\AppData\Local\Temp\Info.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4156 -
C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe"C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe"3⤵
- Executes dropped EXE
PID:5652 -
C:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exeC:\Users\Admin\Documents\WrK0AX6z_c7puhjhW5CHyeLn.exe4⤵PID:3800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3800 -s 245⤵
- Program crash
PID:4672 -
C:\Users\Admin\Documents\5TV1Lwgkd0GPOH7X296YfzcS.exe"C:\Users\Admin\Documents\5TV1Lwgkd0GPOH7X296YfzcS.exe"3⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe"C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe"3⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exeC:\Users\Admin\Documents\ttEUVchbDvpe9BoEAmDsXvwf.exe4⤵PID:5076
-
C:\Users\Admin\Documents\HMMVxxH6veX5lvaZs5gM34Z5.exe"C:\Users\Admin\Documents\HMMVxxH6veX5lvaZs5gM34Z5.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5484 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6348
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6992
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:6956
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5484 -s 15004⤵
- Program crash
PID:6568 -
C:\Users\Admin\Documents\CnYQ7p_jHkrHh4hSqx0naCEQ.exe"C:\Users\Admin\Documents\CnYQ7p_jHkrHh4hSqx0naCEQ.exe"3⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Roaming\3531407.exe"C:\Users\Admin\AppData\Roaming\3531407.exe"4⤵PID:4672
-
C:\Users\Admin\AppData\Roaming\5566121.exe"C:\Users\Admin\AppData\Roaming\5566121.exe"4⤵PID:4708
-
C:\Users\Admin\Documents\fvi6XYkrxCf36J1LidptbX1T.exe"C:\Users\Admin\Documents\fvi6XYkrxCf36J1LidptbX1T.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:3644 -
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"4⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:7416
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵PID:7744
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:7684
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:988
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"5⤵PID:8164
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"4⤵PID:4960
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"4⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:6736
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt5⤵PID:996
-
C:\Users\Admin\Documents\4VnAQtP5hZjomAnLLO8RgLvy.exe"C:\Users\Admin\Documents\4VnAQtP5hZjomAnLLO8RgLvy.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:60 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6604⤵
- Program crash
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 6724⤵
- Program crash
PID:5688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 7804⤵
- Program crash
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 8164⤵
- Program crash
PID:916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 10684⤵
- Program crash
PID:1616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 12524⤵
- Program crash
PID:6392 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 13404⤵
- Program crash
PID:6904 -
C:\Users\Admin\Documents\IZtrSXvUKnbZIdlYAXAnQ0ch.exe"C:\Users\Admin\Documents\IZtrSXvUKnbZIdlYAXAnQ0ch.exe"3⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\Documents\TINRKAgDfn4C4ZLppguZdH6r.exe"C:\Users\Admin\Documents\TINRKAgDfn4C4ZLppguZdH6r.exe"3⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\Documents\TFYa8n4rkCtuwFBa3ybWAEhG.exe"C:\Users\Admin\Documents\TFYa8n4rkCtuwFBa3ybWAEhG.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4680 -
C:\Users\Admin\Documents\sD0VAMA9DVQAWmZccrdIVWER.exe"C:\Users\Admin\Documents\sD0VAMA9DVQAWmZccrdIVWER.exe"3⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Roaming\6682473.exe"C:\Users\Admin\AppData\Roaming\6682473.exe"4⤵PID:620
-
C:\Users\Admin\AppData\Roaming\5092885.exe"C:\Users\Admin\AppData\Roaming\5092885.exe"4⤵PID:4376
-
C:\Users\Admin\Documents\XECPi1sJhEN2TqsvudxboNQp.exe"C:\Users\Admin\Documents\XECPi1sJhEN2TqsvudxboNQp.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2216 -
C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe"C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4192 -
C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe"C:\Users\Admin\Documents\KqK3ki9il89LyK0w9t6H5tP3.exe" -q4⤵PID:4128
-
C:\Users\Admin\Documents\j4x1dv1AteQuF67vAkr2vkDz.exe"C:\Users\Admin\Documents\j4x1dv1AteQuF67vAkr2vkDz.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4676 -
C:\Users\Admin\Documents\hultuusECzhdb2td8Q48aELI.exe"C:\Users\Admin\Documents\hultuusECzhdb2td8Q48aELI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5216 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf2931.tmp\tempfile.ps1"4⤵PID:5096
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf2931.tmp\tempfile.ps1"4⤵PID:7200
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf2931.tmp\tempfile.ps1"4⤵PID:7808
-
C:\Users\Admin\Documents\gB4XX4bi_kGEczfzz8kPAZZ8.exe"C:\Users\Admin\Documents\gB4XX4bi_kGEczfzz8kPAZZ8.exe"3⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\is-5TM07.tmp\gB4XX4bi_kGEczfzz8kPAZZ8.tmp"C:\Users\Admin\AppData\Local\Temp\is-5TM07.tmp\gB4XX4bi_kGEczfzz8kPAZZ8.tmp" /SL5="$501F6,138429,56832,C:\Users\Admin\Documents\gB4XX4bi_kGEczfzz8kPAZZ8.exe"4⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\is-TNUU8.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-TNUU8.tmp\Setup.exe" /Verysilent5⤵PID:4832
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"6⤵PID:7780
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"6⤵PID:7836
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"6⤵PID:7940
-
C:\Users\Admin\AppData\Local\Temp\note8876.exe"C:\Users\Admin\AppData\Local\Temp\note8876.exe" end7⤵PID:7860
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"6⤵PID:7884
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6696
-
C:\Users\Admin\AppData\Local\Temp\pub2.exe"C:\Users\Admin\AppData\Local\Temp\pub2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\Installation.exe"C:\Users\Admin\AppData\Local\Temp\Installation.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_2.exe6⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_2.exejobiea_2.exe7⤵
- Executes dropped EXE
PID:4144 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4144 -s 4888⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_7.exe6⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exejobiea_7.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4248 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_8.exe6⤵PID:4700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_6.exe6⤵PID:400
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_5.exe6⤵PID:4124
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_4.exe6⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_3.exe6⤵PID:4104
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jobiea_1.exe6⤵
- Suspicious use of WriteProcessMemory
PID:4308
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:568 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:5112 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4184
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4072
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:2216
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4644
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_1.exejobiea_1.exe1⤵
- Executes dropped EXE
PID:2976 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 9282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5524
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_6.exejobiea_6.exe1⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\Documents\hGwQyPB6PnEzfc8c8WCIh9zS.exe"C:\Users\Admin\Documents\hGwQyPB6PnEzfc8c8WCIh9zS.exe"2⤵PID:3628
-
C:\Users\Admin\Documents\SCxqGru1JmIDEW06x5AYAQF6.exe"C:\Users\Admin\Documents\SCxqGru1JmIDEW06x5AYAQF6.exe"2⤵PID:1560
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 6603⤵
- Program crash
PID:6972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 6763⤵
- Program crash
PID:7116 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 6363⤵
- Program crash
PID:6164 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 6403⤵
- Program crash
PID:6264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 11483⤵
- Program crash
PID:6960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 13163⤵
- Program crash
PID:4892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 12803⤵
- Program crash
PID:7868 -
C:\Users\Admin\Documents\kS7d059hIP1bK6DDoNfKuoI4.exe"C:\Users\Admin\Documents\kS7d059hIP1bK6DDoNfKuoI4.exe"2⤵PID:5388
-
C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe"C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe"2⤵PID:5144
-
C:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exeC:\Users\Admin\Documents\io2ZiQvfn9hLAOXOSIqAKanl.exe3⤵PID:6432
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 244⤵
- Program crash
PID:6864 -
C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe"C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe"2⤵PID:4060
-
C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe"C:\Users\Admin\Documents\shbOQfT6MJZADtVosTs7Vvpz.exe" -q3⤵PID:4112
-
C:\Users\Admin\Documents\jzXvaLdX8j5F333TnZGkjBUs.exe"C:\Users\Admin\Documents\jzXvaLdX8j5F333TnZGkjBUs.exe"2⤵PID:3768
-
C:\Users\Admin\AppData\Roaming\6736999.exe"C:\Users\Admin\AppData\Roaming\6736999.exe"3⤵PID:6352
-
C:\Users\Admin\AppData\Roaming\2846732.exe"C:\Users\Admin\AppData\Roaming\2846732.exe"3⤵PID:7340
-
C:\Users\Admin\Documents\ALIdO6qFG3uRG7MoTWMoCeFn.exe"C:\Users\Admin\Documents\ALIdO6qFG3uRG7MoTWMoCeFn.exe"2⤵PID:3992
-
C:\Users\Admin\Documents\yAPR8N1kfN64mEGucOwiRmKe.exe"C:\Users\Admin\Documents\yAPR8N1kfN64mEGucOwiRmKe.exe"2⤵PID:4340
-
C:\Users\Admin\Documents\sHhg9aKeADG1sCm70m6_GAhL.exe"C:\Users\Admin\Documents\sHhg9aKeADG1sCm70m6_GAhL.exe"2⤵PID:5232
-
C:\Users\Admin\Documents\uDdy8aMXXpaN46Wn55rZYd5a.exe"C:\Users\Admin\Documents\uDdy8aMXXpaN46Wn55rZYd5a.exe"2⤵
- Suspicious use of SetThreadContext
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt3⤵PID:6824
-
C:\Users\Admin\Documents\SuwprT8LMurhDmhXvE_V5_LO.exe"C:\Users\Admin\Documents\SuwprT8LMurhDmhXvE_V5_LO.exe"2⤵PID:2832
-
C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe"C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe"2⤵PID:4768
-
C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exeC:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe3⤵PID:3800
-
C:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exeC:\Users\Admin\Documents\viiBJpdnECbacjxUVSafw0xy.exe3⤵PID:7184
-
C:\Users\Admin\Documents\WKsl0dodX8IR6zqUpCElfeBN.exe"C:\Users\Admin\Documents\WKsl0dodX8IR6zqUpCElfeBN.exe"2⤵PID:5408
-
C:\Users\Admin\AppData\Roaming\6736999.exe"C:\Users\Admin\AppData\Roaming\6736999.exe"3⤵PID:4724
-
C:\Users\Admin\AppData\Roaming\5297836.exe"C:\Users\Admin\AppData\Roaming\5297836.exe"3⤵PID:1136
-
C:\Users\Admin\Documents\szZ_4V94TlvhKcUtK8oFUgEJ.exe"C:\Users\Admin\Documents\szZ_4V94TlvhKcUtK8oFUgEJ.exe"2⤵PID:6496
-
C:\Users\Admin\Documents\0_zftHgkmfeWCs8ynLnFtTId.exe"C:\Users\Admin\Documents\0_zftHgkmfeWCs8ynLnFtTId.exe"2⤵PID:572
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszA5E3.tmp\tempfile.ps1"3⤵PID:7148
-
C:\Users\Admin\Documents\iRliB9MCJQPmvHIZ2bLhhb7A.exe"C:\Users\Admin\Documents\iRliB9MCJQPmvHIZ2bLhhb7A.exe"2⤵PID:6168
-
C:\Users\Admin\AppData\Local\Temp\is-6VGT7.tmp\iRliB9MCJQPmvHIZ2bLhhb7A.tmp"C:\Users\Admin\AppData\Local\Temp\is-6VGT7.tmp\iRliB9MCJQPmvHIZ2bLhhb7A.tmp" /SL5="$40372,138429,56832,C:\Users\Admin\Documents\iRliB9MCJQPmvHIZ2bLhhb7A.exe"3⤵PID:6272
-
C:\Users\Admin\AppData\Local\Temp\is-C41MJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-C41MJ.tmp\Setup.exe" /Verysilent4⤵PID:8176
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_5.exejobiea_5.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5004
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_8.exejobiea_8.exe1⤵
- Executes dropped EXE
PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_4.exejobiea_4.exe1⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
PID:5244 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
PID:5880
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_3.exejobiea_3.exe1⤵
- Executes dropped EXE
PID:4596
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exeC:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exe1⤵
- Executes dropped EXE
PID:4992
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5420
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5472
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5600
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5892
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5988
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5736
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7008 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:1192
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5376
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:7676
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7676 -s 6243⤵
- Program crash
PID:7920
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
b2a6b0c933fd8fb421318d4080c20262
SHA1245cefa2b343acc531898fcca13c78e836ddf281
SHA25685e669932e66b977adbee034a3d9af1e8872174e25b9df2c698869545179ea0e
SHA512fb279fb87b493c4453994dae3feeb870222ccf931dc10e93ae372ed851451f9691e2c1ce5460a4e948b68523a346a655c5ea40cc089f559f3248757777d46013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
ab7c942b61a01c9652c16d318283206a
SHA18f6e89a9080cc1586a52e7729190f022b31b13c1
SHA25659b216716d6cb1d2971864785218eb6cd60248cf24a62a63c5633be6e0e04b25
SHA512c1c07d2e8c48860b2fabcee7f37c6c210d4284d9610a8b788a05de9e397618763a4cad52d5e41fb5858c380d6659102fe5e609bf2fb0d80e6411101d4492902f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
924f06f0be11515b1bec2486d564bc83
SHA1c74c0655888f6a2a2f895c4803036f7144705775
SHA2560d128570ef2c61b298de2400cba9825140068ac230cd2a8aebb0a4135110e5ab
SHA512551e1ce75199975acf88da4eebf443fc7ff16e2d9808eaa4b469bb5539c8cf56fcb42bc0ee2fdf77b4e970faeaaf713edac96e552810568a5159c75f7a07a3bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
07e5d09f3a694bd79dbebe7597fb4846
SHA142f195794062cd7a45fc6dafa5239edef87f4a90
SHA256981a69f902c4de108b4552d6d2c197114d79b412fba886abc8e846bd07dbd382
SHA512842c24c8cf34cff4e6fc572ae1ac37e4d8a61900d6d0d474f7519611a93a57e0e8377611343042035834c079b5811b7cfd50714d4acd2322b483ac39a2642121
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_1.exeMD5
dd5f6d433f6e89c232d56c88a61392bd
SHA12582fc1d123384bd7e2a07638bb37fcd3d79ca9a
SHA2560db8aeda5003da3a7a88699ece04556f0f6b1d1400514d4cb374c88ddb8ec63d
SHA512a513f488566540091a031db709d3cfbefdb3668ed5b849ec45dbc9371d45aa25f9489c0990dd25c1f14b92cfcd25dd06b1126aef5ba4051f3f1a0c49b8af2d0a
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_1.txtMD5
dd5f6d433f6e89c232d56c88a61392bd
SHA12582fc1d123384bd7e2a07638bb37fcd3d79ca9a
SHA2560db8aeda5003da3a7a88699ece04556f0f6b1d1400514d4cb374c88ddb8ec63d
SHA512a513f488566540091a031db709d3cfbefdb3668ed5b849ec45dbc9371d45aa25f9489c0990dd25c1f14b92cfcd25dd06b1126aef5ba4051f3f1a0c49b8af2d0a
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_2.exeMD5
0d8ebc2a16581f7b514a1699550ed552
SHA172f226e8efc041d998384a120f8e45d22c0f4218
SHA256c638b1a56525b01c7a73366fc7c8d0c2b29353a31c4fcf3a7b7037e52caf4f28
SHA5122e95e4df0a97bc9ea341b93383b3ea4b68db4259ac53da9a29ec80bc00894c5c82a32d4cbb7927ae1808103e6b7491e0a18f406b02363a47a45a0de463b51f72
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_2.txtMD5
0d8ebc2a16581f7b514a1699550ed552
SHA172f226e8efc041d998384a120f8e45d22c0f4218
SHA256c638b1a56525b01c7a73366fc7c8d0c2b29353a31c4fcf3a7b7037e52caf4f28
SHA5122e95e4df0a97bc9ea341b93383b3ea4b68db4259ac53da9a29ec80bc00894c5c82a32d4cbb7927ae1808103e6b7491e0a18f406b02363a47a45a0de463b51f72
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_3.exeMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_3.txtMD5
6e487aa1b2d2b9ef05073c11572925f2
SHA1b2b58a554b75029cd8bdf5ffd012611b1bfe430b
SHA25677eec57eba8ad26c2fd97cc4240a13732f301c775e751ee72079f656296d9597
SHA512b7512fcf5dcfbe1c1807d85dfff39bd0cac57adf2696b7129a8c9d70ea7f8249c301a97ecba0f190eb622a216530215585ce6d8d8ce9b112e5728792ecace739
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_4.exeMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_4.txtMD5
5668cb771643274ba2c375ec6403c266
SHA1dd78b03428b99368906fe62fc46aaaf1db07a8b9
SHA256d417bd4de6a5227f5ea5cff3567e74fe2b2a25c0a80123b7b37b27db89adc384
SHA512135bd12414773cc84270af5225920a01487626528d7bbc2b703be71652265772c2e5488ee3f7e2c53b0b01c617b8c7920e0b457472b6724cfa9ec4c390b0a55a
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_5.exeMD5
a2a580db98baafe88982912d06befa64
SHA1dce4f7af68efca42ac7732870b05f5055846f0f3
SHA25618310737141e60462bb77bc7e1cd3024fa3308c96f0e2dd37a71b995c72f3a09
SHA512c4a4887659212674112c4eb40baf2bf227a4b04a9b2c140ea142cc2a47a1cd73c4a0fe6c7cf285f521dd912ef635ae2925ac11bfa9eddbf014493d71e029756b
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_5.txtMD5
a2a580db98baafe88982912d06befa64
SHA1dce4f7af68efca42ac7732870b05f5055846f0f3
SHA25618310737141e60462bb77bc7e1cd3024fa3308c96f0e2dd37a71b995c72f3a09
SHA512c4a4887659212674112c4eb40baf2bf227a4b04a9b2c140ea142cc2a47a1cd73c4a0fe6c7cf285f521dd912ef635ae2925ac11bfa9eddbf014493d71e029756b
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_6.exeMD5
9065c4e9a648b1be7c03db9b25bfcf2a
SHA16ee58f69e199bbc1c7653a4e8621dd583ec6ac61
SHA2568bd28ed722c7ce293f0a9ce3644e595965e448354ec231cfca25f887605c6f47
SHA512ad09b354bb85f7534102da2e35ebd4dd5b5c35809e8726968f96170726abd997927e5aa8bc1390571152552361fa139fe04c7a9830b94e627541cc1fd51a329d
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_6.txtMD5
9065c4e9a648b1be7c03db9b25bfcf2a
SHA16ee58f69e199bbc1c7653a4e8621dd583ec6ac61
SHA2568bd28ed722c7ce293f0a9ce3644e595965e448354ec231cfca25f887605c6f47
SHA512ad09b354bb85f7534102da2e35ebd4dd5b5c35809e8726968f96170726abd997927e5aa8bc1390571152552361fa139fe04c7a9830b94e627541cc1fd51a329d
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.exeMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_7.txtMD5
4668a7d4b9f6b8f672fc9292dd4744c1
SHA10de41192524e78fd816256fd166845b7ca0b0a92
SHA256f855237cba5b06f971f92764edb011d5949efed129d14056130069b1e12bd3db
SHA512f8219e0d5753d9348e22949d90080a43e273733244ef9fab4925cc9f62299bf0c1b25ed9f96d6c17167c3474c4d7e977f8658ac1bf46de1e9691c2f43dccf5ff
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_8.exeMD5
69fc838583e8b440224db92056131e86
SHA1a9939288bff48a284b8a6639a3cf99d3ffe65bf2
SHA256f3b6310267708b944d216b6076b68f97111b5230db97a37d84fe759c441295f6
SHA512b4ee74a25607eaac2910eda1953bef56d010ea4bda5d17e8d61f4d34c3ca0301ab2465f41a9644c03fdf7183910953dbbf8da51c7f02f6da5463ff7355080a32
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\jobiea_8.txtMD5
69fc838583e8b440224db92056131e86
SHA1a9939288bff48a284b8a6639a3cf99d3ffe65bf2
SHA256f3b6310267708b944d216b6076b68f97111b5230db97a37d84fe759c441295f6
SHA512b4ee74a25607eaac2910eda1953bef56d010ea4bda5d17e8d61f4d34c3ca0301ab2465f41a9644c03fdf7183910953dbbf8da51c7f02f6da5463ff7355080a32
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exeMD5
55ab593b5eb8ec1e1fd06be8730df3d7
SHA1dc15bde4ba775b9839472735c0ec13577aa2bf79
SHA256020463cd59e09900861e72453b1b1516ea628532b7441192c07272f8356d1179
SHA512bec85c4f9f201785d13faf6dbe6267c0a685e4c1272046d5aa231304b6ed7b80ce25e6e6d7f807ede53880bce311a0902e06518c897605b6dc4a27b77a39749f
-
C:\Users\Admin\AppData\Local\Temp\7zS84229BB4\setup_install.exeMD5
55ab593b5eb8ec1e1fd06be8730df3d7
SHA1dc15bde4ba775b9839472735c0ec13577aa2bf79
SHA256020463cd59e09900861e72453b1b1516ea628532b7441192c07272f8356d1179
SHA512bec85c4f9f201785d13faf6dbe6267c0a685e4c1272046d5aa231304b6ed7b80ce25e6e6d7f807ede53880bce311a0902e06518c897605b6dc4a27b77a39749f
-
C:\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
47cd23007e0a8cf522c380f10d3be548
SHA1f302b0397aacce44658f6f7b53d074509d755d8a
SHA256bf2a431dc29c4c9d3dd7bfe7d1be3c9ed8925767882ac7b21573a0ee4e3f41b3
SHA5122bbee20d410d179495f493014f736f49495d6aed33326a629d953774f99442c81d7382b7207f852911b5b903b28179eaa4b1e8717be24e6a27d3c30175dbac87
-
C:\Users\Admin\AppData\Local\Temp\Files.exeMD5
47cd23007e0a8cf522c380f10d3be548
SHA1f302b0397aacce44658f6f7b53d074509d755d8a
SHA256bf2a431dc29c4c9d3dd7bfe7d1be3c9ed8925767882ac7b21573a0ee4e3f41b3
SHA5122bbee20d410d179495f493014f736f49495d6aed33326a629d953774f99442c81d7382b7207f852911b5b903b28179eaa4b1e8717be24e6a27d3c30175dbac87
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Folder.exeMD5
b89068659ca07ab9b39f1c580a6f9d39
SHA17e3e246fcf920d1ada06900889d099784fe06aa5
SHA2569d225182e9a8f073e8cf1d60a8258369a394bcae5fbc52d845d71a0fa440539c
SHA512940690b0844e678e45ead2e7639407ffac43ab45265d2682a4c2e6400ac8fa2188c50a3b17dad241517dd4624ee92d159c7e6d59c8d069b9edd1445115255d52
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
92acb4017f38a7ee6c5d2f6ef0d32af2
SHA11b932faf564f18ccc63e5dabff5c705ac30a61b8
SHA2562459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1
SHA512d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73
-
C:\Users\Admin\AppData\Local\Temp\Info.exeMD5
92acb4017f38a7ee6c5d2f6ef0d32af2
SHA11b932faf564f18ccc63e5dabff5c705ac30a61b8
SHA2562459694049abfe227ddcf5b4d813fe3ae8e1e9066de5228acf20c958d425c2e1
SHA512d385b2857d934628e1df3ef493b3a33e2a042c5974d9c153c126a86a28fc61bcc02db0a0791c225378994737a16cd35b74f217600d4b837cda779200c9faeb73
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
6db938b22272369c0c2f1589fae2218f
SHA18279d75d704aaf9346e8f86df5aa1f2e8a734bb9
SHA256a3f4061d3d60ae5a3ee4a168f1bec3790e1927f77184915a821d1eade478677e
SHA512a83cae75c7d9f98e4841f1517ec6ea867731f3f3c52a2f12c372be01c7da0a53d458eadfc61309a906ed63c48ca80194ddf52a084044a20e8a2bd3679e492c31
-
C:\Users\Admin\AppData\Local\Temp\Install.exeMD5
6db938b22272369c0c2f1589fae2218f
SHA18279d75d704aaf9346e8f86df5aa1f2e8a734bb9
SHA256a3f4061d3d60ae5a3ee4a168f1bec3790e1927f77184915a821d1eade478677e
SHA512a83cae75c7d9f98e4841f1517ec6ea867731f3f3c52a2f12c372be01c7da0a53d458eadfc61309a906ed63c48ca80194ddf52a084044a20e8a2bd3679e492c31
-
C:\Users\Admin\AppData\Local\Temp\Installation.exeMD5
388d7fcda38028b69216261fce678fd5
SHA16a62a5060438a6e70d5271ac83ee255c372fd1ba
SHA256bbcaa9da67933eb2039d79ad2419099dafdc5f4370170cbcd028c07afd7b6b8f
SHA512e27d1dfdd04cf21cfa8f748515a5eb91d7a40db879661de4fde17d3b9de3786a611265b9196eac67c482375f16370dc9674d716e6de8df36fd0f92bf34441bb4
-
C:\Users\Admin\AppData\Local\Temp\Installation.exeMD5
388d7fcda38028b69216261fce678fd5
SHA16a62a5060438a6e70d5271ac83ee255c372fd1ba
SHA256bbcaa9da67933eb2039d79ad2419099dafdc5f4370170cbcd028c07afd7b6b8f
SHA512e27d1dfdd04cf21cfa8f748515a5eb91d7a40db879661de4fde17d3b9de3786a611265b9196eac67c482375f16370dc9674d716e6de8df36fd0f92bf34441bb4
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exeMD5
17ca6d3d631e127a68546893deb72e25
SHA1ffaeea06da0a817c9152db826d65384d8eb9c724
SHA2562b3bebb4ebf3389810eaecb6b7f0c8f8ed55b7d7b7777b3ffd5f974f4ad63143
SHA512de25aabadab675c262fc7717df3f8ca6a7da9d7566a7a994ea04acf4207ce059a70421f3818a153396a9bbc13a98beaef334b93ab06b139f4ca163e350b19825
-
C:\Users\Admin\AppData\Local\Temp\KRSetp.exeMD5
17ca6d3d631e127a68546893deb72e25
SHA1ffaeea06da0a817c9152db826d65384d8eb9c724
SHA2562b3bebb4ebf3389810eaecb6b7f0c8f8ed55b7d7b7777b3ffd5f974f4ad63143
SHA512de25aabadab675c262fc7717df3f8ca6a7da9d7566a7a994ea04acf4207ce059a70421f3818a153396a9bbc13a98beaef334b93ab06b139f4ca163e350b19825
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exeMD5
954264f2ba5b24bbeecb293be714832c
SHA1fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0
SHA256db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c
SHA5128fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exeMD5
954264f2ba5b24bbeecb293be714832c
SHA1fde3ad6e6d8ab951b002c7ca17e867bf3c1d9ba0
SHA256db5906a6a58c5f7e8991fb5c3a7201843142844650eb5b89bdf89094aba9e96c
SHA5128fb15e5888d713e10df04b64c0a24250547a978eac9a7b25d653c343f01afc204fa661937a76644a2dcd3f5b65225450d3aaecb67014125a50722df21467ee53
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exeMD5
128a8139deaf665018019b61025c099f
SHA1c2954ffeda92e1d4bad2a416afb8386ffd8fe828
SHA256e10f5bc4cb6610bd2aee334a581f2a9872b16c830bdce2f67ffe3cf57bf0b065
SHA512eb6bf322f941776245cebac5e26dd6721a1517eac0fac12b9e05466c17f1e1ffcdb6eda63365287b99d39fd30642a84bc120e95f2c19f7656d3c75c3d0772bf4
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Installations.exeMD5
128a8139deaf665018019b61025c099f
SHA1c2954ffeda92e1d4bad2a416afb8386ffd8fe828
SHA256e10f5bc4cb6610bd2aee334a581f2a9872b16c830bdce2f67ffe3cf57bf0b065
SHA512eb6bf322f941776245cebac5e26dd6721a1517eac0fac12b9e05466c17f1e1ffcdb6eda63365287b99d39fd30642a84bc120e95f2c19f7656d3c75c3d0772bf4
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
403a3ca597d4c6ccbc10efe5b1c3f936
SHA19414113836782991eedfb66adef25f477a2eeb18
SHA2563c2e0510af3d7096b3154434803a763b930e486d74f7ec1fd0b6beca295cf75c
SHA512a8abd3094bb151829da2122b98fd0c013ba81db40b688e1abfc6745c5e27fe570c011a9e1c77ed364db9c68b7f83df392e4558cdc35af620deb2b2fc473b99c7
-
C:\Users\Admin\AppData\Local\Temp\axhub.datMD5
13abe7637d904829fbb37ecda44a1670
SHA1de26b60d2c0b1660220caf3f4a11dfabaa0e7b9f
SHA2567a20b34c0f9b516007d40a570eafb782028c5613138e8b9697ca398b0b3420d6
SHA5126e02ca1282f3d1bbbb684046eb5dcef412366a0ed2276c1f22d2f16b978647c0e35a8d728a0349f022295b0aba30139b2b8bb75b92aa5fdcc18aae9dcf357d77
-
C:\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeMD5
7fee8223d6e4f82d6cd115a28f0b6d58
SHA11b89c25f25253df23426bd9ff6c9208f1202f58b
SHA256a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59
SHA5123ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4
-
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exeMD5
f6fa4c09ce76fd0ce97d147751023a58
SHA19778955cdf7af23e4e31bfe94d06747c3a4a4511
SHA256bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78
SHA51241435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5
-
C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exeMD5
f6fa4c09ce76fd0ce97d147751023a58
SHA19778955cdf7af23e4e31bfe94d06747c3a4a4511
SHA256bf95bc109f6d9577ccc4fefdc9c9ffcb3b5f4bf53ea0751044255bd7bffa5d78
SHA51241435375bcd2a61611b8bd83393220f6215110427656bf803d2d4e8385665d6953c28d14b8788d530bc24c8f3a022d2c4d94ca2ac5c48e39c2d9411e4bc947a5
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
7c096137b7aeac8c060e1ca112426939
SHA116f10b11fa26f820f28c3a3d5a65d3351be76f0c
SHA2568ff01ff179e77e6d9c475d50b5fb9999f508f346224c594c742297026a715df8
SHA512c0a0586f3d0096cabd0c18a4f064d1cfba00cfcda600893eab58e5cdb6ea9a260111d23734dca62015d5a91ac4d98b44696718c0c3245b9052a492fcc4182b8b
-
C:\Users\Admin\AppData\Local\Temp\pub2.exeMD5
7c096137b7aeac8c060e1ca112426939
SHA116f10b11fa26f820f28c3a3d5a65d3351be76f0c
SHA2568ff01ff179e77e6d9c475d50b5fb9999f508f346224c594c742297026a715df8
SHA512c0a0586f3d0096cabd0c18a4f064d1cfba00cfcda600893eab58e5cdb6ea9a260111d23734dca62015d5a91ac4d98b44696718c0c3245b9052a492fcc4182b8b
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
0ad600b00aa2381172fefcadfd558f94
SHA1d761bd0ea41910dd981919c2e520b04b3e23b443
SHA256f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215
SHA51292d4561b6793b20293de88bedd36ad4d3c74492b5926efd61588e83f8be8c863a9309596b63ca0591829929f45196f08f14e718163ed1c00e93b04ef844c6ea6
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
0ad600b00aa2381172fefcadfd558f94
SHA1d761bd0ea41910dd981919c2e520b04b3e23b443
SHA256f278959980ff3dccad6aad448f4dca4034f2832fe85269c0d11b504c270da215
SHA51292d4561b6793b20293de88bedd36ad4d3c74492b5926efd61588e83f8be8c863a9309596b63ca0591829929f45196f08f14e718163ed1c00e93b04ef844c6ea6
-
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS84229BB4\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\CC4F.tmpMD5
50741b3f2d7debf5d2bed63d88404029
SHA156210388a627b926162b36967045be06ffb1aad3
SHA256f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c
SHA512fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3
-
\Users\Admin\AppData\Local\Temp\axhub.dllMD5
1c7be730bdc4833afb7117d48c3fd513
SHA1dc7e38cfe2ae4a117922306aead5a7544af646b8
SHA2568206b4b3897ca45b9e083273f616902966e57091516844906e6ae2aefe63cef1
SHA5127936c862a06b7ecdb6710a1bb62cbea149f75504b580c2f100945674c987f3eec53e9aa5915e32b4f74bcf46f2df9468f68a454400faebd909f933e8072e0f2e
-
memory/60-443-0x0000000000000000-mapping.dmp
-
memory/60-497-0x0000000002C80000-0x0000000002DCA000-memory.dmpFilesize
1.3MB
-
memory/60-500-0x0000000000400000-0x0000000002C80000-memory.dmpFilesize
40.5MB
-
memory/68-246-0x000001E321F00000-0x000001E321F71000-memory.dmpFilesize
452KB
-
memory/184-342-0x0000000004B70000-0x0000000004B78000-memory.dmpFilesize
32KB
-
memory/184-343-0x0000000006CA0000-0x0000000006CA8000-memory.dmpFilesize
32KB
-
memory/184-345-0x0000000006CA0000-0x0000000006CA8000-memory.dmpFilesize
32KB
-
memory/184-133-0x0000000000400000-0x0000000000651000-memory.dmpFilesize
2.3MB
-
memory/184-344-0x0000000004AC0000-0x0000000004AC8000-memory.dmpFilesize
32KB
-
memory/184-341-0x0000000004820000-0x0000000004828000-memory.dmpFilesize
32KB
-
memory/184-126-0x0000000000000000-mapping.dmp
-
memory/184-348-0x0000000003470000-0x00000000034D0000-memory.dmpFilesize
384KB
-
memory/184-347-0x0000000006CA0000-0x0000000006CA8000-memory.dmpFilesize
32KB
-
memory/184-346-0x0000000004AC0000-0x0000000004AC8000-memory.dmpFilesize
32KB
-
memory/400-215-0x0000000000000000-mapping.dmp
-
memory/568-241-0x00000260750A0000-0x0000026075111000-memory.dmpFilesize
452KB
-
memory/568-237-0x0000026074FE0000-0x000002607502C000-memory.dmpFilesize
304KB
-
memory/596-261-0x0000019047C60000-0x0000019047CD1000-memory.dmpFilesize
452KB
-
memory/996-499-0x000000001B9D0000-0x000000001B9D2000-memory.dmpFilesize
8KB
-
memory/996-454-0x0000000000000000-mapping.dmp
-
memory/1076-245-0x000001F319E70000-0x000001F319EE1000-memory.dmpFilesize
452KB
-
memory/1204-280-0x00000168EFD60000-0x00000168EFDD1000-memory.dmpFilesize
452KB
-
memory/1212-270-0x000001F680D40000-0x000001F680DB1000-memory.dmpFilesize
452KB
-
memory/1404-284-0x00000252C4950000-0x00000252C49C1000-memory.dmpFilesize
452KB
-
memory/1560-557-0x0000000000000000-mapping.dmp
-
memory/1852-263-0x0000028E5AEA0000-0x0000028E5AF11000-memory.dmpFilesize
452KB
-
memory/2216-459-0x0000000000430000-0x00000000004DE000-memory.dmpFilesize
696KB
-
memory/2216-452-0x0000000000000000-mapping.dmp
-
memory/2216-457-0x00000000001F0000-0x0000000000200000-memory.dmpFilesize
64KB
-
memory/2300-218-0x0000000000000000-mapping.dmp
-
memory/2424-234-0x000001ACF6040000-0x000001ACF60B1000-memory.dmpFilesize
452KB
-
memory/2476-224-0x00000141E4560000-0x00000141E45D1000-memory.dmpFilesize
452KB
-
memory/2696-285-0x000001BB25840000-0x000001BB258B1000-memory.dmpFilesize
452KB
-
memory/2708-297-0x000001F04BD80000-0x000001F04BDF1000-memory.dmpFilesize
452KB
-
memory/2788-243-0x0000027922B70000-0x0000027922BE1000-memory.dmpFilesize
452KB
-
memory/2880-189-0x0000000000000000-mapping.dmp
-
memory/2976-264-0x0000000004910000-0x00000000049AD000-memory.dmpFilesize
628KB
-
memory/2976-274-0x0000000000400000-0x0000000004424000-memory.dmpFilesize
64.1MB
-
memory/2976-208-0x0000000000000000-mapping.dmp
-
memory/2996-269-0x0000000000E60000-0x0000000000E75000-memory.dmpFilesize
84KB
-
memory/3136-116-0x0000000000000000-mapping.dmp
-
memory/3416-124-0x0000000000000000-mapping.dmp
-
memory/3628-559-0x0000000000000000-mapping.dmp
-
memory/3644-444-0x0000000000000000-mapping.dmp
-
memory/3744-203-0x0000000000000000-mapping.dmp
-
memory/3836-121-0x0000000000000000-mapping.dmp
-
memory/3912-446-0x0000000000000000-mapping.dmp
-
memory/3912-501-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/3948-277-0x0000000000000000-mapping.dmp
-
memory/4100-496-0x0000000002B60000-0x0000000002B61000-memory.dmpFilesize
4KB
-
memory/4100-447-0x0000000000000000-mapping.dmp
-
memory/4104-207-0x0000000000000000-mapping.dmp
-
memory/4112-129-0x0000000000000000-mapping.dmp
-
memory/4124-213-0x0000000000000000-mapping.dmp
-
memory/4128-533-0x0000000000000000-mapping.dmp
-
memory/4144-228-0x0000000000000000-mapping.dmp
-
memory/4144-267-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4144-279-0x0000000000400000-0x00000000043C8000-memory.dmpFilesize
63.8MB
-
memory/4156-132-0x0000000000000000-mapping.dmp
-
memory/4184-324-0x00007FF635214060-mapping.dmp
-
memory/4184-328-0x000001B4B4C70000-0x000001B4B4CE4000-memory.dmpFilesize
464KB
-
memory/4184-395-0x000001B4B7600000-0x000001B4B7706000-memory.dmpFilesize
1.0MB
-
memory/4184-393-0x000001B4B6680000-0x000001B4B669B000-memory.dmpFilesize
108KB
-
memory/4184-327-0x000001B4B4AE0000-0x000001B4B4B2E000-memory.dmpFilesize
312KB
-
memory/4188-134-0x0000000000000000-mapping.dmp
-
memory/4188-159-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4188-168-0x0000000000400000-0x0000000002BF1000-memory.dmpFilesize
39.9MB
-
memory/4192-456-0x0000000000000000-mapping.dmp
-
memory/4216-438-0x0000000000000000-mapping.dmp
-
memory/4216-494-0x0000000004930000-0x0000000004F36000-memory.dmpFilesize
6.0MB
-
memory/4220-210-0x0000000000000000-mapping.dmp
-
memory/4244-153-0x0000000002FF0000-0x0000000002FF2000-memory.dmpFilesize
8KB
-
memory/4244-151-0x0000000001380000-0x000000000139C000-memory.dmpFilesize
112KB
-
memory/4244-138-0x0000000000000000-mapping.dmp
-
memory/4244-152-0x00000000013A0000-0x00000000013A1000-memory.dmpFilesize
4KB
-
memory/4244-150-0x0000000001370000-0x0000000001371000-memory.dmpFilesize
4KB
-
memory/4244-147-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/4248-248-0x00000000008B0000-0x00000000008B1000-memory.dmpFilesize
4KB
-
memory/4248-258-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/4248-223-0x0000000000000000-mapping.dmp
-
memory/4248-271-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4248-272-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/4276-532-0x0000000000000000-mapping.dmp
-
memory/4292-527-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4292-517-0x0000000000000000-mapping.dmp
-
memory/4300-143-0x0000000000000000-mapping.dmp
-
memory/4308-201-0x0000000000000000-mapping.dmp
-
memory/4332-282-0x0000000004550000-0x000000000457F000-memory.dmpFilesize
188KB
-
memory/4332-290-0x0000000008920000-0x0000000008921000-memory.dmpFilesize
4KB
-
memory/4332-304-0x0000000004932000-0x0000000004933000-memory.dmpFilesize
4KB
-
memory/4332-305-0x0000000004933000-0x0000000004934000-memory.dmpFilesize
4KB
-
memory/4332-306-0x00000000094F0000-0x00000000094F1000-memory.dmpFilesize
4KB
-
memory/4332-307-0x0000000009520000-0x0000000009521000-memory.dmpFilesize
4KB
-
memory/4332-303-0x0000000008E50000-0x0000000008E51000-memory.dmpFilesize
4KB
-
memory/4332-295-0x0000000000400000-0x00000000043E1000-memory.dmpFilesize
63.9MB
-
memory/4332-289-0x0000000006150000-0x000000000616B000-memory.dmpFilesize
108KB
-
memory/4332-296-0x0000000004934000-0x0000000004936000-memory.dmpFilesize
8KB
-
memory/4332-316-0x0000000009570000-0x0000000009571000-memory.dmpFilesize
4KB
-
memory/4332-294-0x0000000008E20000-0x0000000008E39000-memory.dmpFilesize
100KB
-
memory/4332-320-0x0000000009700000-0x0000000009701000-memory.dmpFilesize
4KB
-
memory/4332-247-0x0000000000000000-mapping.dmp
-
memory/4332-302-0x0000000004930000-0x0000000004931000-memory.dmpFilesize
4KB
-
memory/4452-154-0x0000000000000000-mapping.dmp
-
memory/4484-156-0x0000000000000000-mapping.dmp
-
memory/4596-232-0x0000000000000000-mapping.dmp
-
memory/4612-233-0x0000000000000000-mapping.dmp
-
memory/4676-524-0x0000000000400000-0x000000000309A000-memory.dmpFilesize
44.6MB
-
memory/4676-513-0x0000000005140000-0x0000000005A66000-memory.dmpFilesize
9.1MB
-
memory/4676-460-0x0000000000000000-mapping.dmp
-
memory/4680-161-0x0000000000000000-mapping.dmp
-
memory/4680-505-0x0000000000400000-0x0000000002C6D000-memory.dmpFilesize
40.4MB
-
memory/4680-498-0x0000000002D90000-0x0000000002D99000-memory.dmpFilesize
36KB
-
memory/4680-448-0x0000000000000000-mapping.dmp
-
memory/4684-537-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/4684-521-0x0000000000000000-mapping.dmp
-
memory/4684-536-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/4684-535-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4700-221-0x0000000000000000-mapping.dmp
-
memory/4756-222-0x0000000000000000-mapping.dmp
-
memory/4876-165-0x0000000000000000-mapping.dmp
-
memory/4876-214-0x00000000011A0000-0x00000000011FD000-memory.dmpFilesize
372KB
-
memory/4876-209-0x0000000004B26000-0x0000000004C27000-memory.dmpFilesize
1.0MB
-
memory/4888-220-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4888-187-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4888-188-0x0000000000400000-0x000000000051E000-memory.dmpFilesize
1.1MB
-
memory/4888-184-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4888-183-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4888-166-0x0000000000000000-mapping.dmp
-
memory/4888-227-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4888-231-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4888-216-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4900-439-0x0000000000000000-mapping.dmp
-
memory/4900-475-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/4960-531-0x0000000000000000-mapping.dmp
-
memory/4976-441-0x0000000000000000-mapping.dmp
-
memory/4976-491-0x0000000001070000-0x0000000001072000-memory.dmpFilesize
8KB
-
memory/4992-311-0x0000000000417E3A-mapping.dmp
-
memory/4992-309-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4992-319-0x0000000005050000-0x0000000005656000-memory.dmpFilesize
6.0MB
-
memory/5004-265-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/5004-262-0x0000000000B40000-0x0000000000B5F000-memory.dmpFilesize
124KB
-
memory/5004-238-0x0000000000000000-mapping.dmp
-
memory/5004-276-0x000000001B370000-0x000000001B372000-memory.dmpFilesize
8KB
-
memory/5004-257-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/5004-250-0x00000000006C0000-0x00000000006C1000-memory.dmpFilesize
4KB
-
memory/5076-507-0x0000000000418E52-mapping.dmp
-
memory/5076-522-0x0000000005550000-0x0000000005B56000-memory.dmpFilesize
6.0MB
-
memory/5096-528-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/5096-516-0x0000000000000000-mapping.dmp
-
memory/5096-526-0x0000000004C42000-0x0000000004C43000-memory.dmpFilesize
4KB
-
memory/5112-211-0x000001E20B500000-0x000001E20B571000-memory.dmpFilesize
452KB
-
memory/5112-530-0x0000000000000000-mapping.dmp
-
memory/5112-190-0x00007FF635214060-mapping.dmp
-
memory/5144-555-0x0000000000000000-mapping.dmp
-
memory/5216-466-0x0000000000000000-mapping.dmp
-
memory/5244-291-0x0000000000000000-mapping.dmp
-
memory/5388-556-0x0000000000000000-mapping.dmp
-
memory/5420-308-0x0000027A7C620000-0x0000027A7C630000-memory.dmpFilesize
64KB
-
memory/5420-310-0x0000027A7C720000-0x0000027A7C730000-memory.dmpFilesize
64KB
-
memory/5484-440-0x0000000000000000-mapping.dmp
-
memory/5652-449-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/5652-437-0x0000000000000000-mapping.dmp
-
memory/5880-322-0x0000000000000000-mapping.dmp