Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Analysis
-
max time kernel
1801s -
max time network
1747s -
platform
windows11_x64 -
resource
win11 -
submitted
12-09-2021 18:05
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-jp
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7-fr
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win7-de
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-jp
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-fr
Behavioral task
behavioral9
Sample
setup_x86_x64_install.exe
Resource
win10-en
Behavioral task
behavioral10
Sample
setup_x86_x64_install.exe
Resource
win10-de
General
-
Target
setup_x86_x64_install.exe
-
Size
3.5MB
-
MD5
1b5154bc65145adba0a58e964265d5f2
-
SHA1
5a96fd55be61222b3e6438712979dc2a18a50b8c
-
SHA256
c48cd55efee57f0b7ff4547a0a20ebfbdf4188d059512b10a29879bf30c4fc19
-
SHA512
9465da97b0986fef660e3f7725b4d4c034bef677acbe36382d95a8052c54634f004162aa3f105156e503af1b26632e47e44234ef9825b388260a6bcd310a5026
Malware Config
Extracted
redline
129c4t2
185.215.113.104:18754
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6008 4952 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5960 4952 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1692 4952 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/5852-325-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05d60bc3b96248e5.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05d60bc3b96248e5.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 20 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeschtasks.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeservices64.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 5096 created 1704 5096 WerFault.exe Sun052bbd8bebd9.exe PID 2508 created 1156 2508 WerFault.exe Conhost.exe PID 3304 created 3868 3304 WerFault.exe Sun05fa3b4d2ae56e.exe PID 4580 created 1268 4580 WerFault.exe Sun05ac1b0207d3ff3b8.exe PID 5668 created 2136 5668 WerFault.exe 2.exe PID 6060 created 5316 6060 WerFault.exe 5885692.exe PID 6020 created 1172 6020 WerFault.exe Sun05d60bc3b96248e5.exe PID 2564 created 5228 2564 WerFault.exe setup.exe PID 5952 created 6000 5952 schtasks.exe 3226877.exe PID 5876 created 2392 5876 WerFault.exe rundll32.exe PID 1360 created 5332 1360 WerFault.exe udptest.exe PID 5300 created 5432 5300 WerFault.exe rundll32.exe PID 72 created 5660 72 WerFault.exe 7933844.exe PID 4528 created 1648 4528 services64.exe 8146730.exe PID 5376 created 5496 5376 WerFault.exe 3003335.exe PID 5740 created 4680 5740 WerFault.exe 1091956.exe PID 7776 created 6724 7776 WerFault.exe GcleanerEU.exe PID 5244 created 2372 5244 WerFault.exe gcleaner.exe PID 1568 created 5512 1568 WerFault.exe Vidboxinc.exe PID 5956 created 5540 5956 WerFault.exe rundll32.exe -
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral5/memory/1268-239-0x00000000035C0000-0x0000000003691000-memory.dmp family_vidar behavioral5/memory/5512-547-0x0000000003590000-0x0000000003661000-memory.dmp family_vidar -
XMRig Miner Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2260-573-0x0000000140000000-0x0000000140763000-memory.dmp xmrig -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurl.dll aspack_v212_v242 -
Blocklisted process makes network request 43 IoCs
Processes:
MsiExec.exeflow pid process 104 5716 MsiExec.exe 105 5716 MsiExec.exe 106 5716 MsiExec.exe 107 5716 MsiExec.exe 108 5716 MsiExec.exe 109 5716 MsiExec.exe 112 5716 MsiExec.exe 113 5716 MsiExec.exe 115 5716 MsiExec.exe 116 5716 MsiExec.exe 123 5716 MsiExec.exe 124 5716 MsiExec.exe 125 5716 MsiExec.exe 126 5716 MsiExec.exe 127 5716 MsiExec.exe 128 5716 MsiExec.exe 130 5716 MsiExec.exe 131 5716 MsiExec.exe 132 5716 MsiExec.exe 133 5716 MsiExec.exe 134 5716 MsiExec.exe 135 5716 MsiExec.exe 136 5716 MsiExec.exe 137 5716 MsiExec.exe 138 5716 MsiExec.exe 139 5716 MsiExec.exe 140 5716 MsiExec.exe 141 5716 MsiExec.exe 142 5716 MsiExec.exe 143 5716 MsiExec.exe 144 5716 MsiExec.exe 145 5716 MsiExec.exe 146 5716 MsiExec.exe 147 5716 MsiExec.exe 148 5716 MsiExec.exe 149 5716 MsiExec.exe 150 5716 MsiExec.exe 151 5716 MsiExec.exe 152 5716 MsiExec.exe 153 5716 MsiExec.exe 154 5716 MsiExec.exe 155 5716 MsiExec.exe 156 5716 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
Processes:
46807GHF____.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts 46807GHF____.exe -
Executes dropped EXE 51 IoCs
Processes:
setup_installer.exesetup_install.exeSun05532f7abc.exeSun059375dac544fc4a.exeSun05ac1b0207d3ff3b8.exeSun05640630a6aa.exeSun05d60bc3b96248e5.exeSun052bbd8bebd9.exeSun05899db881f67fb29.exeSun054fe19a12cb3.exeSun05fa3b4d2ae56e.exeSun050462125c7d35.exeSun054fe19a12cb3.tmpLzmwAqmV.exe8146730.exeChrome 5.exeDllHost.exePublicDwlBrowser1100.exe2.exesetup.exe5885692.exeudptest.exesetup_2.exe3003335.exe7933844.exe3002.exesetup_2.tmp6138621.exe5885692.exesetup_2.exejhuuee.exemsedge.exe3226877.exesetup_2.tmp1091956.exeWinHoster.exe3226877.exe3002.exepostback.exeultramediaburner.exeultramediaburner.tmpBewaewacaedi.exeUltraMediaBurner.exeXaewevebaeqo.exeservices64.exeGcleanerEU.exeinstaller.exeanyname.exeVidboxinc.exegcleaner.exesihost64.exepid process 3812 setup_installer.exe 5108 setup_install.exe 1156 Sun05532f7abc.exe 1180 Sun059375dac544fc4a.exe 1268 Sun05ac1b0207d3ff3b8.exe 1472 Sun05640630a6aa.exe 1172 Sun05d60bc3b96248e5.exe 1704 Sun052bbd8bebd9.exe 3224 Sun05899db881f67fb29.exe 3988 Sun054fe19a12cb3.exe 3868 Sun05fa3b4d2ae56e.exe 4924 Sun050462125c7d35.exe 3576 Sun054fe19a12cb3.tmp 3920 LzmwAqmV.exe 1648 8146730.exe 4020 Chrome 5.exe 404 DllHost.exe 1492 PublicDwlBrowser1100.exe 2136 2.exe 5228 setup.exe 5316 5885692.exe 5332 udptest.exe 5464 setup_2.exe 5496 3003335.exe 5660 7933844.exe 5760 3002.exe 5728 setup_2.tmp 5792 6138621.exe 5852 5885692.exe 5968 setup_2.exe 5928 jhuuee.exe 6120 msedge.exe 6000 3226877.exe 5148 setup_2.tmp 4680 1091956.exe 4120 WinHoster.exe 1452 3226877.exe 3776 3002.exe 5948 postback.exe 824 ultramediaburner.exe 2236 ultramediaburner.tmp 4280 Bewaewacaedi.exe 3700 UltraMediaBurner.exe 4208 Xaewevebaeqo.exe 4528 services64.exe 6724 GcleanerEU.exe 7548 installer.exe 5056 anyname.exe 5512 Vidboxinc.exe 2372 gcleaner.exe 6192 sihost64.exe -
Loads dropped DLL 32 IoCs
Processes:
setup_install.exesetup_2.tmpsetup_2.tmprundll32.exerundll32.exeinstaller.exeMsiExec.exerundll32.exeMsiExec.exeMsiExec.exepid process 5108 setup_install.exe 5108 setup_install.exe 5108 setup_install.exe 5108 setup_install.exe 5108 setup_install.exe 5108 setup_install.exe 5728 setup_2.tmp 5148 setup_2.tmp 2392 rundll32.exe 5432 rundll32.exe 7548 installer.exe 7548 installer.exe 7548 installer.exe 1384 MsiExec.exe 1384 MsiExec.exe 5540 rundll32.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 5716 MsiExec.exe 7548 installer.exe 5716 MsiExec.exe 5716 MsiExec.exe 6324 MsiExec.exe 6324 MsiExec.exe 5716 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
DllHost.exe46807GHF____.exemsedge.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" DllHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Photo Viewer\\Tybahihiwy.exe\"" 46807GHF____.exe Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exemsiexec.exeinstaller.exedescription ioc process File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\E: installer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 ip-api.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
5885692.exe3226877.exeservices64.exedescription pid process target process PID 5316 set thread context of 5852 5316 5885692.exe 5885692.exe PID 6000 set thread context of 1452 6000 3226877.exe 3226877.exe PID 4528 set thread context of 2260 4528 services64.exe explorer.exe -
Drops file in Program Files directory 10 IoCs
Processes:
ultramediaburner.tmpsetup_2.tmp46807GHF____.exedescription ioc process File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-M367U.tmp setup_2.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat setup_2.tmp File created C:\Program Files (x86)\Windows Photo Viewer\Tybahihiwy.exe 46807GHF____.exe File created C:\Program Files (x86)\Windows Photo Viewer\Tybahihiwy.exe.config 46807GHF____.exe File created C:\Program Files (x86)\UltraMediaBurner\is-IV27P.tmp ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-E4Q13.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp -
Drops file in Windows directory 28 IoCs
Processes:
msiexec.exeWerFault.exeMsiExec.exedescription ioc process File opened for modification C:\Windows\Installer\MSIA177.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA4CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA548.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA643.tmp msiexec.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Installer\MSI9E88.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA205.tmp msiexec.exe File created C:\Windows\SystemTemp\~DFB57DC14F26BBFB78.TMP msiexec.exe File created C:\Windows\Installer\f749967.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA1B6.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSIA47B.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File created C:\Windows\SystemTemp\~DFA688FBDF1BB07CC5.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA2D3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA673.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA868.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA915.tmp msiexec.exe File created C:\Windows\SystemTemp\~DF9436666B825321D4.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIA3FD.tmp msiexec.exe File opened for modification C:\Windows\Installer\f749967.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIA2B3.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF23120EA903789DF2.TMP msiexec.exe File created C:\Windows\Tasks\AdvancedWindowsManager #1.job MsiExec.exe File opened for modification C:\Windows\Installer\MSIA974.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA235.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 19 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4168 1156 WerFault.exe Sun05532f7abc.exe 4596 1704 WerFault.exe Sun052bbd8bebd9.exe 1452 3868 WerFault.exe Sun05fa3b4d2ae56e.exe 1108 1268 WerFault.exe Sun05ac1b0207d3ff3b8.exe 6112 2136 WerFault.exe 2.exe 5600 5316 WerFault.exe 5885692.exe 3020 1172 WerFault.exe Sun05d60bc3b96248e5.exe 2236 5228 WerFault.exe setup.exe 3164 2392 WerFault.exe rundll32.exe 5680 5332 WerFault.exe udptest.exe 4664 5432 WerFault.exe rundll32.exe 4792 1648 WerFault.exe 8146730.exe 1884 5660 WerFault.exe 7933844.exe 4540 5496 WerFault.exe 3003335.exe 2176 4680 WerFault.exe 1091956.exe 7964 6724 WerFault.exe GcleanerEU.exe 5552 2372 WerFault.exe gcleaner.exe 5568 5512 WerFault.exe Vidboxinc.exe 5600 5540 WerFault.exe rundll32.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe3226877.exeWerFault.exeultramediaburner.tmpWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 3226877.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 3226877.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier ultramediaburner.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 3226877.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 ultramediaburner.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision ultramediaburner.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 3226877.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 6260 schtasks.exe 5952 schtasks.exe -
Enumerates system info in registry 2 TTPs 39 IoCs
Processes:
msedge.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe3226877.exeultramediaburner.tmpWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 3226877.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS ultramediaburner.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 3226877.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU ultramediaburner.tmp Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1196 taskkill.exe -
Modifies data under HKEY_USERS 46 IoCs
Processes:
sihclient.exemsiexec.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust sihclient.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\7\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\8\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\8 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs sihclient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\7 msiexec.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs sihclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs sihclient.exe -
Processes:
installer.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeWerFault.exeWerFault.exeWerFault.exe3226877.exeWerFault.exeWerFault.exeWerFault.exesetup_2.tmpultramediaburner.tmpWerFault.exeWerFault.exe8146730.exe1091956.exe3003335.exe7933844.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe5885692.exeChrome 5.exeXaewevebaeqo.exepid process 916 powershell.exe 916 powershell.exe 916 powershell.exe 916 powershell.exe 4168 WerFault.exe 4168 WerFault.exe 1108 WerFault.exe 1108 WerFault.exe 4596 WerFault.exe 4596 WerFault.exe 1452 3226877.exe 1452 3226877.exe 6112 WerFault.exe 6112 WerFault.exe 5600 WerFault.exe 5600 WerFault.exe 3020 WerFault.exe 3020 WerFault.exe 5148 setup_2.tmp 5148 setup_2.tmp 2236 ultramediaburner.tmp 2236 ultramediaburner.tmp 3164 WerFault.exe 3164 WerFault.exe 5680 WerFault.exe 5680 WerFault.exe 1648 8146730.exe 1648 8146730.exe 4680 1091956.exe 4680 1091956.exe 5496 3003335.exe 5496 3003335.exe 5660 7933844.exe 5660 7933844.exe 4664 WerFault.exe 4664 WerFault.exe 4792 WerFault.exe 4792 WerFault.exe 1884 WerFault.exe 1884 WerFault.exe 4540 WerFault.exe 4540 WerFault.exe 2176 WerFault.exe 2176 WerFault.exe 2236 ultramediaburner.tmp 2236 ultramediaburner.tmp 5852 5885692.exe 5852 5885692.exe 1452 3226877.exe 1452 3226877.exe 4020 Chrome 5.exe 4020 Chrome 5.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe 4208 Xaewevebaeqo.exe -
Suspicious behavior: SetClipboardViewer 1 IoCs
Processes:
WinHoster.exepid process 4120 WinHoster.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
Sun05d60bc3b96248e5.exeSun059375dac544fc4a.exepowershell.exeSun050462125c7d35.exeWerFault.exe8146730.exe2.exePublicDwlBrowser1100.exe5885692.exe7933844.exe3003335.exemsedge.exe3226877.exe1091956.exepostback.exe46807GHF____.exedescription pid process Token: SeCreateTokenPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeAssignPrimaryTokenPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeLockMemoryPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeIncreaseQuotaPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeMachineAccountPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeTcbPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeSecurityPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeTakeOwnershipPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeLoadDriverPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeSystemProfilePrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeSystemtimePrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeProfSingleProcessPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeIncBasePriorityPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeCreatePagefilePrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeCreatePermanentPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeBackupPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeRestorePrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeShutdownPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeDebugPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeAuditPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeSystemEnvironmentPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeChangeNotifyPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeRemoteShutdownPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeUndockPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeSyncAgentPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeEnableDelegationPrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeManageVolumePrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeImpersonatePrivilege 1172 Sun05d60bc3b96248e5.exe Token: SeCreateGlobalPrivilege 1172 Sun05d60bc3b96248e5.exe Token: 31 1172 Sun05d60bc3b96248e5.exe Token: 32 1172 Sun05d60bc3b96248e5.exe Token: 33 1172 Sun05d60bc3b96248e5.exe Token: 34 1172 Sun05d60bc3b96248e5.exe Token: 35 1172 Sun05d60bc3b96248e5.exe Token: SeDebugPrivilege 1180 Sun059375dac544fc4a.exe Token: SeDebugPrivilege 916 powershell.exe Token: SeDebugPrivilege 4924 Sun050462125c7d35.exe Token: SeRestorePrivilege 4596 WerFault.exe Token: SeBackupPrivilege 4596 WerFault.exe Token: SeBackupPrivilege 4596 WerFault.exe Token: SeDebugPrivilege 1648 8146730.exe Token: SeDebugPrivilege 2136 2.exe Token: SeDebugPrivilege 1492 PublicDwlBrowser1100.exe Token: SeDebugPrivilege 5316 5885692.exe Token: SeDebugPrivilege 5660 7933844.exe Token: SeDebugPrivilege 5496 3003335.exe Token: SeDebugPrivilege 6120 msedge.exe Token: SeDebugPrivilege 6000 3226877.exe Token: SeDebugPrivilege 4680 1091956.exe Token: SeDebugPrivilege 5948 postback.exe Token: SeDebugPrivilege 1676 46807GHF____.exe Token: SeIncreaseQuotaPrivilege 916 powershell.exe Token: SeSecurityPrivilege 916 powershell.exe Token: SeTakeOwnershipPrivilege 916 powershell.exe Token: SeLoadDriverPrivilege 916 powershell.exe Token: SeSystemProfilePrivilege 916 powershell.exe Token: SeSystemtimePrivilege 916 powershell.exe Token: SeProfSingleProcessPrivilege 916 powershell.exe Token: SeIncBasePriorityPrivilege 916 powershell.exe Token: SeCreatePagefilePrivilege 916 powershell.exe Token: SeBackupPrivilege 916 powershell.exe Token: SeRestorePrivilege 916 powershell.exe Token: SeShutdownPrivilege 916 powershell.exe Token: SeDebugPrivilege 916 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
setup_2.tmpultramediaburner.tmpinstaller.exemsedge.exepid process 5148 setup_2.tmp 2236 ultramediaburner.tmp 7548 installer.exe 1176 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
cmd.exepid process 3232 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 5032 wrote to memory of 3812 5032 setup_x86_x64_install.exe setup_installer.exe PID 5032 wrote to memory of 3812 5032 setup_x86_x64_install.exe setup_installer.exe PID 5032 wrote to memory of 3812 5032 setup_x86_x64_install.exe setup_installer.exe PID 3812 wrote to memory of 5108 3812 setup_installer.exe setup_install.exe PID 3812 wrote to memory of 5108 3812 setup_installer.exe setup_install.exe PID 3812 wrote to memory of 5108 3812 setup_installer.exe setup_install.exe PID 5108 wrote to memory of 3036 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3036 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3036 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3060 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3060 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3060 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3220 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3220 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3220 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3524 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3524 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3524 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 1632 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 1632 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 1632 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 4944 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 4944 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 4944 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3540 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3540 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3540 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 4552 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 4552 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 4552 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3772 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3772 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 3772 5108 setup_install.exe cmd.exe PID 3036 wrote to memory of 916 3036 cmd.exe powershell.exe PID 3036 wrote to memory of 916 3036 cmd.exe powershell.exe PID 3036 wrote to memory of 916 3036 cmd.exe powershell.exe PID 5108 wrote to memory of 476 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 476 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 476 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 1036 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 1036 5108 setup_install.exe cmd.exe PID 5108 wrote to memory of 1036 5108 setup_install.exe cmd.exe PID 3524 wrote to memory of 1156 3524 cmd.exe Sun05532f7abc.exe PID 3524 wrote to memory of 1156 3524 cmd.exe Sun05532f7abc.exe PID 3524 wrote to memory of 1156 3524 cmd.exe Sun05532f7abc.exe PID 4944 wrote to memory of 1180 4944 cmd.exe Sun059375dac544fc4a.exe PID 4944 wrote to memory of 1180 4944 cmd.exe Sun059375dac544fc4a.exe PID 3060 wrote to memory of 1268 3060 cmd.exe Sun05ac1b0207d3ff3b8.exe PID 3060 wrote to memory of 1268 3060 cmd.exe Sun05ac1b0207d3ff3b8.exe PID 3060 wrote to memory of 1268 3060 cmd.exe Sun05ac1b0207d3ff3b8.exe PID 1632 wrote to memory of 1472 1632 cmd.exe Sun05640630a6aa.exe PID 1632 wrote to memory of 1472 1632 cmd.exe Sun05640630a6aa.exe PID 1632 wrote to memory of 1472 1632 cmd.exe Sun05640630a6aa.exe PID 3540 wrote to memory of 1172 3540 cmd.exe Sun05d60bc3b96248e5.exe PID 3540 wrote to memory of 1172 3540 cmd.exe Sun05d60bc3b96248e5.exe PID 3540 wrote to memory of 1172 3540 cmd.exe Sun05d60bc3b96248e5.exe PID 3220 wrote to memory of 1704 3220 cmd.exe Sun052bbd8bebd9.exe PID 3220 wrote to memory of 1704 3220 cmd.exe Sun052bbd8bebd9.exe PID 3220 wrote to memory of 1704 3220 cmd.exe Sun052bbd8bebd9.exe PID 1036 wrote to memory of 3868 1036 cmd.exe Sun05fa3b4d2ae56e.exe PID 1036 wrote to memory of 3868 1036 cmd.exe Sun05fa3b4d2ae56e.exe PID 1036 wrote to memory of 3868 1036 cmd.exe Sun05fa3b4d2ae56e.exe PID 3772 wrote to memory of 3224 3772 cmd.exe Sun05899db881f67fb29.exe PID 3772 wrote to memory of 3224 3772 cmd.exe Sun05899db881f67fb29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05ac1b0207d3ff3b8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05ac1b0207d3ff3b8.exeSun05ac1b0207d3ff3b8.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 2966⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05532f7abc.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05532f7abc.exeSun05532f7abc.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1156 -s 3046⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun052bbd8bebd9.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun052bbd8bebd9.exeSun052bbd8bebd9.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 3126⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun050462125c7d35.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun050462125c7d35.exeSun050462125c7d35.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8146730.exe"C:\ProgramData\8146730.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1648 -s 23327⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\8797436.exe"C:\ProgramData\8797436.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: SetClipboardViewer
-
C:\ProgramData\5885692.exe"C:\ProgramData\5885692.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5885692.exe"C:\ProgramData\5885692.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5316 -s 10807⤵
- Program crash
-
C:\ProgramData\3003335.exe"C:\ProgramData\3003335.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5496 -s 24447⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05899db881f67fb29.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05899db881f67fb29.exeSun05899db881f67fb29.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun054fe19a12cb3.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun054fe19a12cb3.exeSun054fe19a12cb3.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-7AKHV.tmp\Sun054fe19a12cb3.tmp"C:\Users\Admin\AppData\Local\Temp\is-7AKHV.tmp\Sun054fe19a12cb3.tmp" /SL5="$2017C,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun054fe19a12cb3.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-DL2RP.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-DL2RP.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\YTTGTAQSDY\ultramediaburner.exe"C:\Users\Admin\AppData\Local\Temp\YTTGTAQSDY\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-EPJ15.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-EPJ15.tmp\ultramediaburner.tmp" /SL5="$30214,281924,62464,C:\Users\Admin\AppData\Local\Temp\YTTGTAQSDY\ultramediaburner.exe" /VERYSILENT9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a9-96579-10d-9f2b8-a99a25a12cb88\Bewaewacaedi.exe"C:\Users\Admin\AppData\Local\Temp\a9-96579-10d-9f2b8-a99a25a12cb88\Bewaewacaedi.exe"8⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:210⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:310⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4396 /prefetch:210⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1728 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1264 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3472 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3852 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4448 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1852 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2992 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5348 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5964 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5092 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=89 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=91 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=100 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6740 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=102 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=104 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7080 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=108 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=109 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=110 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=112 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=113 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4624249982639718405,11142097803859712740,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=114 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7112 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514839⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515139⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=20872159⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=42631199⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=12942319⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1492888&var=39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3f5746f8,0x7ffd3f574708,0x7ffd3f57471810⤵
-
C:\Users\Admin\AppData\Local\Temp\24-7fa0d-d90-ad598-73430ff05b5ad\Xaewevebaeqo.exe"C:\Users\Admin\AppData\Local\Temp\24-7fa0d-d90-ad598-73430ff05b5ad\Xaewevebaeqo.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\k5o00dvp.l3y\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\k5o00dvp.l3y\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\k5o00dvp.l3y\GcleanerEU.exe /eufive10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6724 -s 28411⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d4yor1ll.txz\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\d4yor1ll.txz\installer.exeC:\Users\Admin\AppData\Local\Temp\d4yor1ll.txz\installer.exe /qn CAMPAIGN="654"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\d4yor1ll.txz\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\d4yor1ll.txz\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631210722 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
- Enumerates connected drives
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qfzs2lyy.aka\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\qfzs2lyy.aka\anyname.exeC:\Users\Admin\AppData\Local\Temp\qfzs2lyy.aka\anyname.exe10⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lfwo22wa.xbg\Vidboxinc.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\lfwo22wa.xbg\Vidboxinc.exeC:\Users\Admin\AppData\Local\Temp\lfwo22wa.xbg\Vidboxinc.exe10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5512 -s 29211⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wm4zm1n0.wfo\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\wm4zm1n0.wfo\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\wm4zm1n0.wfo\gcleaner.exe /mixfive10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 28411⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\rsaiop4h.lq4\autosubplayer.exe /S & exit9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05d60bc3b96248e5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05d60bc3b96248e5.exeSun05d60bc3b96248e5.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1172 -s 16046⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun059375dac544fc4a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun059375dac544fc4a.exeSun059375dac544fc4a.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
- Executes dropped EXE
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7933844.exe"C:\ProgramData\7933844.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5660 -s 23289⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\6138621.exe"C:\ProgramData\6138621.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\3226877.exe"C:\ProgramData\3226877.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\3226877.exe"C:\ProgramData\3226877.exe"9⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\1091956.exe"C:\ProgramData\1091956.exe"8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 23689⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2136 -s 17248⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5228 -s 6088⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5332 -s 3128⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NF9VA.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-NF9VA.tmp\setup_2.tmp" /SL5="$1021A,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NRK00.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-NRK00.tmp\setup_2.tmp" /SL5="$10226,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-A12KQ.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-A12KQ.tmp\postback.exe" ss111⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05640630a6aa.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05640630a6aa.exeSun05640630a6aa.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sun05fa3b4d2ae56e.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05fa3b4d2ae56e.exeSun05fa3b4d2ae56e.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 2406⤵
- Program crash
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv qZIHR0hrq02NvNbKVX1Y/g.0.21⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1156 -ip 11561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1704 -ip 17041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3868 -ip 38681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1268 -ip 12681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 660 -p 2136 -ip 21361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1172 -ip 11721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5316 -ip 53161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5228 -ip 52281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 4522⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 6000 -ip 60001⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2392 -ip 23921⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5332 -ip 53321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 5432 -ip 54321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 584 -p 5660 -ip 56601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 648 -p 1648 -ip 16481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5496 -ip 54961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4680 -ip 46801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6724 -ip 67241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D611BFD58FB36324D47D7622B04B2269 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 6D7917E6CD66A91AE446FB0BD113DE962⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BC82614D03EFE00298BDDB73B083F7C7 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 2372 -ip 23721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5512 -ip 55121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 4562⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 5540 -ip 55401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\3003335.exeMD5
a8db62010fc3ff8a86abdf3988646a8c
SHA1247577574d8f60a064b03d9f2a627d0bdbc6d2a6
SHA256cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d
SHA5128234d169c809f91658f88ccb80be1dbae587ff9e0a3e517f4b42ac0f2e4a3be73b77bba787b6ebc55422c2f081b9c07e44f1192d63c90d3837b55597f68b0e1d
-
C:\ProgramData\3003335.exeMD5
a8db62010fc3ff8a86abdf3988646a8c
SHA1247577574d8f60a064b03d9f2a627d0bdbc6d2a6
SHA256cb129cd67225cb40c544eab07466be9305132fc9607214174b48f4167e0b6b3d
SHA5128234d169c809f91658f88ccb80be1dbae587ff9e0a3e517f4b42ac0f2e4a3be73b77bba787b6ebc55422c2f081b9c07e44f1192d63c90d3837b55597f68b0e1d
-
C:\ProgramData\5885692.exeMD5
e4f8a44d85fea78bb9487e67a2527a64
SHA1384bd6fd735d8e69ba36daa0a7577db82a95e741
SHA2560f308bf054fb4aa75deede0f79cb55aa4f39d2122d6d0c0066e8001c5f9fa99f
SHA51246f38446426e84139529973b15f5bfe802dd853d8a967fba6fa253400f9aa42b16b7fae76984e120fef2359ee31b043cfeda2cc0b33e684265bfa1f6b8e9d50e
-
C:\ProgramData\5885692.exeMD5
e4f8a44d85fea78bb9487e67a2527a64
SHA1384bd6fd735d8e69ba36daa0a7577db82a95e741
SHA2560f308bf054fb4aa75deede0f79cb55aa4f39d2122d6d0c0066e8001c5f9fa99f
SHA51246f38446426e84139529973b15f5bfe802dd853d8a967fba6fa253400f9aa42b16b7fae76984e120fef2359ee31b043cfeda2cc0b33e684265bfa1f6b8e9d50e
-
C:\ProgramData\6138621.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
C:\ProgramData\7933844.exeMD5
bd827c05c19856bb5bc854a57e8e68bb
SHA102988078b7531b49f7ebb38d626159a67f7312b8
SHA256688b222c06972bdf623feb913c5bb58bda92f9053b1797a5b6a346b49ac0d5c3
SHA51203eb5f603cdb1b6b363ccc4d1ebac5d05da572f6077d1253a9482d1eea794035b6b2ef9ca03e637617fbf8195950cf7909f2dea6d7fd1d2077c0c63e0711aa12
-
C:\ProgramData\7933844.exeMD5
bd827c05c19856bb5bc854a57e8e68bb
SHA102988078b7531b49f7ebb38d626159a67f7312b8
SHA256688b222c06972bdf623feb913c5bb58bda92f9053b1797a5b6a346b49ac0d5c3
SHA51203eb5f603cdb1b6b363ccc4d1ebac5d05da572f6077d1253a9482d1eea794035b6b2ef9ca03e637617fbf8195950cf7909f2dea6d7fd1d2077c0c63e0711aa12
-
C:\ProgramData\8146730.exeMD5
90f5bdcf9c193dbc10a04fa7724b783b
SHA131b331fd83b599c8768cbfa319f55a1797f28cbd
SHA256d1960ff8dd0b31dda8b20226304f5f584b04264e35c4cc9041aff7611ea69082
SHA5125cc0de7f37f44b99a246e19e148e2226adb406ebdfecd65b47bb2cd82419d4f468279e2be87db6e5d4cd3cc79030d8093ce551da2c91b247a7ba74f55b4b3956
-
C:\ProgramData\8146730.exeMD5
90f5bdcf9c193dbc10a04fa7724b783b
SHA131b331fd83b599c8768cbfa319f55a1797f28cbd
SHA256d1960ff8dd0b31dda8b20226304f5f584b04264e35c4cc9041aff7611ea69082
SHA5125cc0de7f37f44b99a246e19e148e2226adb406ebdfecd65b47bb2cd82419d4f468279e2be87db6e5d4cd3cc79030d8093ce551da2c91b247a7ba74f55b4b3956
-
C:\ProgramData\8797436.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
C:\ProgramData\8797436.exeMD5
d4b87bd4f5956b855a27f0bcb1dde5f4
SHA1e3fa38a058b9d7b820fa89ad901417c9918778eb
SHA256da45516c0c39189c7eea11160bed9cc69cea2623d43ed9093bf2b478b0d25807
SHA512a132313c57d45e616bd8c211db8244d901b84371e51324ba96a6729eee10dcefd8466b27196b91ad5490c29ccbe090b056b22d1df116330cc7395c7b0a85ef87
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
3bef291868337302198597f1e49e11cb
SHA1705a5efb3feddf5758c0ff3ff27f8dc2c78ccd64
SHA2567b8d7b971e0505f5ebfd9c726e8435878c6077ce2b235f2f647f7b5c21c2980b
SHA51285d96a08642d0ef59312c275c33dfdf5db3eb4b3fbfd48ec88d590cf28a2debe86b415d830fa8c3f87386ac788448887aef1b1911728e82a5b778d3f458730df
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
3bef291868337302198597f1e49e11cb
SHA1705a5efb3feddf5758c0ff3ff27f8dc2c78ccd64
SHA2567b8d7b971e0505f5ebfd9c726e8435878c6077ce2b235f2f647f7b5c21c2980b
SHA51285d96a08642d0ef59312c275c33dfdf5db3eb4b3fbfd48ec88d590cf28a2debe86b415d830fa8c3f87386ac788448887aef1b1911728e82a5b778d3f458730df
-
C:\Users\Admin\AppData\Local\Temp\3002.exeMD5
e511bb4cf31a2307b6f3445a869bcf31
SHA176f5c6e8df733ac13d205d426831ed7672a05349
SHA25656002017746f61eee8d8e9b5ad2f3cbb119dc99300c5b6d32c1be184d3e25137
SHA5129c81de34bf3b0eb75405c726d641ef6090054e9be8e0c0ab1bb2ed095e6477ce2fa8996868bf8a77a720b210a76b5f4e1b3b086d7f40449d79498681b367199c
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun050462125c7d35.exeMD5
33108cca657823deab88501eae9e0095
SHA1a3d2e7bd571c688a0c17d68af3c6d2c17c5fd4d8
SHA256484b4f0df638edfbf9bd548677c50b58c2ff0cf4da44965bdb17ca42cb5f095d
SHA512fc253ab995aa90b6e77d5149b5b6cde017684c477a7205d0c91f234ce516aac2f44fbc682a02005c82b320bd5f53358a2699654340325167b32765f4a710f5f5
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun050462125c7d35.exeMD5
33108cca657823deab88501eae9e0095
SHA1a3d2e7bd571c688a0c17d68af3c6d2c17c5fd4d8
SHA256484b4f0df638edfbf9bd548677c50b58c2ff0cf4da44965bdb17ca42cb5f095d
SHA512fc253ab995aa90b6e77d5149b5b6cde017684c477a7205d0c91f234ce516aac2f44fbc682a02005c82b320bd5f53358a2699654340325167b32765f4a710f5f5
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun052bbd8bebd9.exeMD5
17453605e54baa73884d6dce7d57d439
SHA10153451591fb1b7a5dadaf8206265c094b9f15ad
SHA256065d26691736150f3643cb4bd06e991f62160406936d9053a82af11b8d0272ff
SHA5128e0472691fdbd700fbc28ed4e66cdd11696df1fb70d22a35876c936484fe99acc8038683f938047493b71603012aebdd0b4fbb192e57d66d6b0e873a8d727de3
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun052bbd8bebd9.exeMD5
17453605e54baa73884d6dce7d57d439
SHA10153451591fb1b7a5dadaf8206265c094b9f15ad
SHA256065d26691736150f3643cb4bd06e991f62160406936d9053a82af11b8d0272ff
SHA5128e0472691fdbd700fbc28ed4e66cdd11696df1fb70d22a35876c936484fe99acc8038683f938047493b71603012aebdd0b4fbb192e57d66d6b0e873a8d727de3
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun054fe19a12cb3.exeMD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun054fe19a12cb3.exeMD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05532f7abc.exeMD5
101e921ef21015140b3bd69b454c26ab
SHA174df2a128a67847b95128adb7668a7a28c751cd9
SHA256e1d92bededb0009037f08075a765c2ec5d512e536a0563e4cf744e90d7883e17
SHA512e1fc38dce4852f1bccb81fd02d8005295311bd1c99fdef8524cbc997d425c070ad402ea0ed1dbf539a1d8ef34a4fb1bb15932233e79ff09a577b05f87211ecfd
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05532f7abc.exeMD5
101e921ef21015140b3bd69b454c26ab
SHA174df2a128a67847b95128adb7668a7a28c751cd9
SHA256e1d92bededb0009037f08075a765c2ec5d512e536a0563e4cf744e90d7883e17
SHA512e1fc38dce4852f1bccb81fd02d8005295311bd1c99fdef8524cbc997d425c070ad402ea0ed1dbf539a1d8ef34a4fb1bb15932233e79ff09a577b05f87211ecfd
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05640630a6aa.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05640630a6aa.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05899db881f67fb29.exeMD5
5af7bc821a1501b38c4b153fa0f5dade
SHA1467635cce64ae4e3ce41d1819d2ec6abdf5414f3
SHA256773f2e6660cc3a2b3bb55c0b88a74d24db0dfc5c0cef7c5b13ec9aac48f5d6b6
SHA51253fd58565d6ca16fc9ca7113cd90657ef8c09fa2efcc9603f6da5c2a3050aaeb1d8edfc46b2b40d80b44a8ccce27d9e4fc6bac62bac236fdc360ebdab3b5c146
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05899db881f67fb29.exeMD5
5af7bc821a1501b38c4b153fa0f5dade
SHA1467635cce64ae4e3ce41d1819d2ec6abdf5414f3
SHA256773f2e6660cc3a2b3bb55c0b88a74d24db0dfc5c0cef7c5b13ec9aac48f5d6b6
SHA51253fd58565d6ca16fc9ca7113cd90657ef8c09fa2efcc9603f6da5c2a3050aaeb1d8edfc46b2b40d80b44a8ccce27d9e4fc6bac62bac236fdc360ebdab3b5c146
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun059375dac544fc4a.exeMD5
6f4e3451cd8c385c87fd76feab15bb6e
SHA1861c46d7211a572b756df462eec43c58aeec85f4
SHA25621103f8445399fb1b3a5fe665cfd221d38066b09fa1e2a2d2ca59c09db95052a
SHA512d5cd2e08dd7edd58702ddc17bf68fa721e7c00b00b5f136b7134c4e38820cbca329cdff96fcb616879845689e279c725329b7de23a2fb833ed5808f3b819132e
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun059375dac544fc4a.exeMD5
6f4e3451cd8c385c87fd76feab15bb6e
SHA1861c46d7211a572b756df462eec43c58aeec85f4
SHA25621103f8445399fb1b3a5fe665cfd221d38066b09fa1e2a2d2ca59c09db95052a
SHA512d5cd2e08dd7edd58702ddc17bf68fa721e7c00b00b5f136b7134c4e38820cbca329cdff96fcb616879845689e279c725329b7de23a2fb833ed5808f3b819132e
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05ac1b0207d3ff3b8.exeMD5
5ed6eda9f17493593bb8896ede596829
SHA12542912944c4307462fe39fd49f738f2c38c51c8
SHA2561bcf2f400088193574d2078891eb05a882d622553ce98115425dbdc658d09c72
SHA5126d5b884d62b8ff24910bb7e993ad8bc34b2c39e9ef9be4fb4aa3f18d15be14615dc1e0d6d55ac4751b8d0a1920dff3a552ae60fc4b38678c2e9cd048a62d3ed6
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05ac1b0207d3ff3b8.exeMD5
5ed6eda9f17493593bb8896ede596829
SHA12542912944c4307462fe39fd49f738f2c38c51c8
SHA2561bcf2f400088193574d2078891eb05a882d622553ce98115425dbdc658d09c72
SHA5126d5b884d62b8ff24910bb7e993ad8bc34b2c39e9ef9be4fb4aa3f18d15be14615dc1e0d6d55ac4751b8d0a1920dff3a552ae60fc4b38678c2e9cd048a62d3ed6
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05d60bc3b96248e5.exeMD5
f1e2bb0a62bf371a71b62224b18a69b8
SHA1872738f6cac0e95a4a0625f9d6b6788cf0dbdfa2
SHA256aec3efab3db88776950250c0bdc2a3be0e8fdb9c07fbcef83549bfa3bedc34ab
SHA512ce257f0686c9552759f3d06d8218ac4c5c16350fb673843f06d188aeb8bb531fcf7f29a61c60ef52944e6f72ccfe91adff993c791959585c2fe7f1a1c1fe88f6
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05d60bc3b96248e5.exeMD5
f1e2bb0a62bf371a71b62224b18a69b8
SHA1872738f6cac0e95a4a0625f9d6b6788cf0dbdfa2
SHA256aec3efab3db88776950250c0bdc2a3be0e8fdb9c07fbcef83549bfa3bedc34ab
SHA512ce257f0686c9552759f3d06d8218ac4c5c16350fb673843f06d188aeb8bb531fcf7f29a61c60ef52944e6f72ccfe91adff993c791959585c2fe7f1a1c1fe88f6
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05fa3b4d2ae56e.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\Sun05fa3b4d2ae56e.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\setup_install.exeMD5
0794f412cd518ef0b9aa49e55e685b40
SHA148f44244960cc790c1cacdc794381c963819d6c9
SHA25659425f69b72747dccc467e7f24930a67b886728b9131879a439e1cdb56482faf
SHA512e54d43e3df3c5454735516f6865f3c0180c806bd9cbffbf304103a47ae836913d46f3e03fda8b5e1c44ba5e8ddb191968172bc1fc7d637f04a5b005b1dcbd47c
-
C:\Users\Admin\AppData\Local\Temp\7zS4EE54DF3\setup_install.exeMD5
0794f412cd518ef0b9aa49e55e685b40
SHA148f44244960cc790c1cacdc794381c963819d6c9
SHA25659425f69b72747dccc467e7f24930a67b886728b9131879a439e1cdb56482faf
SHA512e54d43e3df3c5454735516f6865f3c0180c806bd9cbffbf304103a47ae836913d46f3e03fda8b5e1c44ba5e8ddb191968172bc1fc7d637f04a5b005b1dcbd47c
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
d75734d85b59bdb7202e3c4b9def3631
SHA1e6f713d88cce2df494095342e6734ea3cf59df0d
SHA256600df54efe0bcdd1b2c7c8de1b821ff20d7ccc702479793324fc93ca7fd7a91c
SHA512270b14765e24afacf7328fa409b59d5102bdd13d18968845796eb31e487f45118d34244c2c1f737c539ba612fd0dba0d1d08488debe2b7859f2d4b3d45810311
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
d75734d85b59bdb7202e3c4b9def3631
SHA1e6f713d88cce2df494095342e6734ea3cf59df0d
SHA256600df54efe0bcdd1b2c7c8de1b821ff20d7ccc702479793324fc93ca7fd7a91c
SHA512270b14765e24afacf7328fa409b59d5102bdd13d18968845796eb31e487f45118d34244c2c1f737c539ba612fd0dba0d1d08488debe2b7859f2d4b3d45810311
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
926fbc9261cf783ea941891e0644c0c5
SHA1d90c0f8a499dcf2a7d5a92c316f2b736d999f7d3
SHA256bfc101337c0065cd9f844ce03b3db348940a28acd6cbb5e0c0adf230c2850805
SHA51291b4de74719f538dbe92eec6dcae0f4453adc2626adaee0d1ce705f97ed2fe9d47e6f25f7e692c0383a11a9c6812ca1bcd59274eb71b1de9584a3aefb10da49f
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
926fbc9261cf783ea941891e0644c0c5
SHA1d90c0f8a499dcf2a7d5a92c316f2b736d999f7d3
SHA256bfc101337c0065cd9f844ce03b3db348940a28acd6cbb5e0c0adf230c2850805
SHA51291b4de74719f538dbe92eec6dcae0f4453adc2626adaee0d1ce705f97ed2fe9d47e6f25f7e692c0383a11a9c6812ca1bcd59274eb71b1de9584a3aefb10da49f
-
C:\Users\Admin\AppData\Local\Temp\is-7AKHV.tmp\Sun054fe19a12cb3.tmpMD5
6020849fbca45bc0c69d4d4a0f4b62e7
SHA15be83881ec871c4b90b4bf6bb75ab8d50dbfefe9
SHA256c6c796f0d37e1a80632a295122db834499017b8d07728e0b5dfa6325ed3cab98
SHA512f4c359a9ebf362b943d10772efe9cfd0a0153c1ff866ffdf1223e16e544dfa2250f67e7a7682d2558761d36efe15c7de1a2c311bc67b162eb77394ef179924eb
-
C:\Users\Admin\AppData\Local\Temp\is-NF9VA.tmp\setup_2.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-NF9VA.tmp\setup_2.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exeMD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exeMD5
3f85c284c00d521faf86158691fd40c5
SHA1ee06d5057423f330141ecca668c5c6f9ccf526af
SHA25628915433217ce96922b912651ae21974beba3a35aab6c228d5e96e296c8925dc
SHA5120458856a88a11d259595c9c9ec105131c155fffb9c039b492e961b6aaf89ecec4e2d057fd6a2305f55303e777e08346a437dc22741ed288fb84d6d37b814d492
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
ac05ac0ba5b0d85ecd9e462158a3db58
SHA14ead955437b3c8c3b1e64b6d3af76b0edbe9623d
SHA25689818524bd880f26d06220ed9bee6da0c79948135d246a5508e3fbe17f16cbea
SHA512e685dfa20e17c6a9f33c6ec9c6ceaaaf8354c9a518bb4ffc2980f276f0b61bf7758d757cfc18fd8d252ae282e8da476bdb91edef7b9ae1fb0a142b120404d72e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
ac05ac0ba5b0d85ecd9e462158a3db58
SHA14ead955437b3c8c3b1e64b6d3af76b0edbe9623d
SHA25689818524bd880f26d06220ed9bee6da0c79948135d246a5508e3fbe17f16cbea
SHA512e685dfa20e17c6a9f33c6ec9c6ceaaaf8354c9a518bb4ffc2980f276f0b61bf7758d757cfc18fd8d252ae282e8da476bdb91edef7b9ae1fb0a142b120404d72e
-
C:\Users\Admin\AppData\Local\Temp\udptest.exeMD5
f1cd08ca29a2add76e5b0464750c645b
SHA1929de2a20f5d82b333f95213c955e90e2e0fc66c
SHA2560cb33bdee818c06cd3e34b8b3a2a0f4120bd91527ef87406f4086bd2841ef5ec
SHA5124ae6b8729b1ff8061839c0ba8f5a13ce50e5746fab4ed4fadd2e2aab1a9ad31198ca31d8748d64f7011a361e253b29ca2b4112ad201c670fb38f95b5068c6687
-
C:\Users\Admin\AppData\Local\Temp\udptest.exeMD5
f1cd08ca29a2add76e5b0464750c645b
SHA1929de2a20f5d82b333f95213c955e90e2e0fc66c
SHA2560cb33bdee818c06cd3e34b8b3a2a0f4120bd91527ef87406f4086bd2841ef5ec
SHA5124ae6b8729b1ff8061839c0ba8f5a13ce50e5746fab4ed4fadd2e2aab1a9ad31198ca31d8748d64f7011a361e253b29ca2b4112ad201c670fb38f95b5068c6687
-
memory/404-265-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/404-273-0x00000000058C0000-0x00000000058C4000-memory.dmpFilesize
16KB
-
memory/404-288-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/404-277-0x0000000008630000-0x0000000008631000-memory.dmpFilesize
4KB
-
memory/404-257-0x0000000000000000-mapping.dmp
-
memory/476-184-0x0000000000000000-mapping.dmp
-
memory/824-468-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/824-457-0x0000000000000000-mapping.dmp
-
memory/916-425-0x000000007F960000-0x000000007F961000-memory.dmpFilesize
4KB
-
memory/916-246-0x00000000084D0000-0x00000000084D1000-memory.dmpFilesize
4KB
-
memory/916-221-0x0000000006DA2000-0x0000000006DA3000-memory.dmpFilesize
4KB
-
memory/916-219-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/916-223-0x0000000006DA0000-0x0000000006DA1000-memory.dmpFilesize
4KB
-
memory/916-217-0x0000000006DB0000-0x0000000006DB1000-memory.dmpFilesize
4KB
-
memory/916-229-0x0000000007CE0000-0x0000000007CE1000-memory.dmpFilesize
4KB
-
memory/916-401-0x0000000006DA5000-0x0000000006DA7000-memory.dmpFilesize
8KB
-
memory/916-231-0x0000000007C40000-0x0000000007C41000-memory.dmpFilesize
4KB
-
memory/916-233-0x0000000007C70000-0x0000000007C71000-memory.dmpFilesize
4KB
-
memory/916-182-0x0000000000000000-mapping.dmp
-
memory/916-235-0x0000000007FE0000-0x0000000007FE1000-memory.dmpFilesize
4KB
-
memory/916-236-0x0000000008050000-0x0000000008051000-memory.dmpFilesize
4KB
-
memory/916-302-0x00000000086C0000-0x00000000086C1000-memory.dmpFilesize
4KB
-
memory/916-237-0x00000000080C0000-0x00000000080C1000-memory.dmpFilesize
4KB
-
memory/916-295-0x00000000084A0000-0x00000000084A1000-memory.dmpFilesize
4KB
-
memory/1036-187-0x0000000000000000-mapping.dmp
-
memory/1156-234-0x0000000001850000-0x0000000001859000-memory.dmpFilesize
36KB
-
memory/1156-190-0x0000000000000000-mapping.dmp
-
memory/1172-198-0x0000000000000000-mapping.dmp
-
memory/1176-490-0x0000000000000000-mapping.dmp
-
memory/1180-225-0x00000000031D0000-0x00000000031D2000-memory.dmpFilesize
8KB
-
memory/1180-191-0x0000000000000000-mapping.dmp
-
memory/1180-208-0x0000000000EC0000-0x0000000000EC1000-memory.dmpFilesize
4KB
-
memory/1268-239-0x00000000035C0000-0x0000000003691000-memory.dmpFilesize
836KB
-
memory/1268-193-0x0000000000000000-mapping.dmp
-
memory/1452-412-0x0000000004D40000-0x0000000005358000-memory.dmpFilesize
6.1MB
-
memory/1452-372-0x0000000000000000-mapping.dmp
-
memory/1472-196-0x0000000000000000-mapping.dmp
-
memory/1492-267-0x0000000000F60000-0x0000000000F61000-memory.dmpFilesize
4KB
-
memory/1492-303-0x000000001BD50000-0x000000001BD52000-memory.dmpFilesize
8KB
-
memory/1492-281-0x0000000001630000-0x000000000164B000-memory.dmpFilesize
108KB
-
memory/1492-258-0x0000000000000000-mapping.dmp
-
memory/1492-287-0x0000000001650000-0x0000000001651000-memory.dmpFilesize
4KB
-
memory/1492-274-0x0000000001620000-0x0000000001621000-memory.dmpFilesize
4KB
-
memory/1632-173-0x0000000000000000-mapping.dmp
-
memory/1648-254-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/1648-247-0x0000000000000000-mapping.dmp
-
memory/1648-264-0x0000000001660000-0x000000000167E000-memory.dmpFilesize
120KB
-
memory/1648-320-0x000000001CF90000-0x000000001CF91000-memory.dmpFilesize
4KB
-
memory/1648-318-0x000000001C890000-0x000000001C891000-memory.dmpFilesize
4KB
-
memory/1648-276-0x000000001BD60000-0x000000001BD62000-memory.dmpFilesize
8KB
-
memory/1676-280-0x0000000001170000-0x0000000001172000-memory.dmpFilesize
8KB
-
memory/1704-238-0x0000000002D90000-0x0000000002DC0000-memory.dmpFilesize
192KB
-
memory/1704-200-0x0000000000000000-mapping.dmp
-
memory/2136-271-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/2136-263-0x0000000000000000-mapping.dmp
-
memory/2136-283-0x0000000002440000-0x0000000002442000-memory.dmpFilesize
8KB
-
memory/2236-461-0x0000000000000000-mapping.dmp
-
memory/2236-470-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/2260-580-0x0000000002970000-0x0000000002990000-memory.dmpFilesize
128KB
-
memory/2260-573-0x0000000140000000-0x0000000140763000-memory.dmpFilesize
7.4MB
-
memory/2260-581-0x0000000002990000-0x00000000029B0000-memory.dmpFilesize
128KB
-
memory/2392-393-0x0000000000000000-mapping.dmp
-
memory/3036-166-0x0000000000000000-mapping.dmp
-
memory/3060-167-0x0000000000000000-mapping.dmp
-
memory/3220-169-0x0000000000000000-mapping.dmp
-
memory/3224-205-0x0000000000000000-mapping.dmp
-
memory/3524-171-0x0000000000000000-mapping.dmp
-
memory/3540-177-0x0000000000000000-mapping.dmp
-
memory/3576-224-0x0000000000000000-mapping.dmp
-
memory/3700-476-0x0000000000C92000-0x0000000000C94000-memory.dmpFilesize
8KB
-
memory/3700-482-0x0000000000C95000-0x0000000000C97000-memory.dmpFilesize
8KB
-
memory/3700-467-0x0000000000000000-mapping.dmp
-
memory/3700-480-0x0000000000C94000-0x0000000000C95000-memory.dmpFilesize
4KB
-
memory/3700-473-0x0000000000C90000-0x0000000000C92000-memory.dmpFilesize
8KB
-
memory/3772-181-0x0000000000000000-mapping.dmp
-
memory/3776-377-0x0000000000000000-mapping.dmp
-
memory/3812-146-0x0000000000000000-mapping.dmp
-
memory/3868-240-0x0000000004740000-0x0000000004788000-memory.dmpFilesize
288KB
-
memory/3868-204-0x0000000000000000-mapping.dmp
-
memory/3920-244-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/3920-241-0x0000000000000000-mapping.dmp
-
memory/3988-218-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/3988-206-0x0000000000000000-mapping.dmp
-
memory/4020-253-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/4020-250-0x0000000000000000-mapping.dmp
-
memory/4020-481-0x0000000000B10000-0x0000000000B12000-memory.dmpFilesize
8KB
-
memory/4120-404-0x0000000004920000-0x0000000004921000-memory.dmpFilesize
4KB
-
memory/4120-371-0x0000000000000000-mapping.dmp
-
memory/4208-469-0x0000000000000000-mapping.dmp
-
memory/4208-477-0x0000000000DF4000-0x0000000000DF5000-memory.dmpFilesize
4KB
-
memory/4208-489-0x0000000000DF5000-0x0000000000DF6000-memory.dmpFilesize
4KB
-
memory/4208-484-0x0000000000DF6000-0x0000000000DF7000-memory.dmpFilesize
4KB
-
memory/4208-472-0x0000000000DF0000-0x0000000000DF2000-memory.dmpFilesize
8KB
-
memory/4280-465-0x0000000000000000-mapping.dmp
-
memory/4280-471-0x0000000000F40000-0x0000000000F42000-memory.dmpFilesize
8KB
-
memory/4528-486-0x0000000000000000-mapping.dmp
-
memory/4528-568-0x00000000027E0000-0x00000000027E2000-memory.dmpFilesize
8KB
-
memory/4552-179-0x0000000000000000-mapping.dmp
-
memory/4680-390-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/4680-359-0x0000000000000000-mapping.dmp
-
memory/4720-483-0x0000000000000000-mapping.dmp
-
memory/4924-209-0x0000000000000000-mapping.dmp
-
memory/4924-232-0x000000001B8C0000-0x000000001B8C2000-memory.dmpFilesize
8KB
-
memory/4924-230-0x0000000001300000-0x0000000001301000-memory.dmpFilesize
4KB
-
memory/4924-227-0x00000000010D0000-0x00000000010D1000-memory.dmpFilesize
4KB
-
memory/4924-220-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/4924-228-0x00000000012E0000-0x00000000012FA000-memory.dmpFilesize
104KB
-
memory/4944-175-0x0000000000000000-mapping.dmp
-
memory/5108-165-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/5108-149-0x0000000000000000-mapping.dmp
-
memory/5108-164-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/5108-185-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/5108-163-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/5108-188-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/5108-194-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/5108-192-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/5148-346-0x0000000000000000-mapping.dmp
-
memory/5148-366-0x00000000021B0000-0x00000000021B1000-memory.dmpFilesize
4KB
-
memory/5228-275-0x0000000000000000-mapping.dmp
-
memory/5228-382-0x0000000002DD0000-0x0000000002DFF000-memory.dmpFilesize
188KB
-
memory/5316-304-0x0000000004AB0000-0x0000000005056000-memory.dmpFilesize
5.6MB
-
memory/5316-296-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/5316-330-0x0000000004A90000-0x0000000004A93000-memory.dmpFilesize
12KB
-
memory/5316-290-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/5316-282-0x0000000000000000-mapping.dmp
-
memory/5316-307-0x0000000004B20000-0x0000000004B38000-memory.dmpFilesize
96KB
-
memory/5332-284-0x0000000000000000-mapping.dmp
-
memory/5332-427-0x0000000004860000-0x0000000004890000-memory.dmpFilesize
192KB
-
memory/5432-435-0x0000000000000000-mapping.dmp
-
memory/5464-305-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5464-292-0x0000000000000000-mapping.dmp
-
memory/5496-323-0x0000000005660000-0x000000000567B000-memory.dmpFilesize
108KB
-
memory/5496-309-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/5496-339-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/5496-294-0x0000000000000000-mapping.dmp
-
memory/5512-547-0x0000000003590000-0x0000000003661000-memory.dmpFilesize
836KB
-
memory/5660-306-0x0000000000000000-mapping.dmp
-
memory/5660-338-0x0000000000C00000-0x0000000000C1E000-memory.dmpFilesize
120KB
-
memory/5660-358-0x000000001B2D0000-0x000000001B2D2000-memory.dmpFilesize
8KB
-
memory/5660-322-0x0000000000550000-0x0000000000551000-memory.dmpFilesize
4KB
-
memory/5728-313-0x0000000000000000-mapping.dmp
-
memory/5728-335-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/5760-312-0x0000000000000000-mapping.dmp
-
memory/5792-360-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/5792-319-0x0000000000000000-mapping.dmp
-
memory/5852-325-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/5852-336-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/5852-321-0x0000000000000000-mapping.dmp
-
memory/5852-385-0x00000000053D0000-0x00000000059E8000-memory.dmpFilesize
6.1MB
-
memory/5928-326-0x0000000000000000-mapping.dmp
-
memory/5948-388-0x0000000000000000-mapping.dmp
-
memory/5952-485-0x0000000000000000-mapping.dmp
-
memory/5968-329-0x0000000000000000-mapping.dmp
-
memory/5968-343-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/6000-342-0x0000000000000000-mapping.dmp
-
memory/6000-368-0x00000000057D0000-0x0000000005D76000-memory.dmpFilesize
5.6MB
-
memory/6120-493-0x0000000000000000-mapping.dmp
-
memory/6120-337-0x0000000000000000-mapping.dmp
-
memory/6120-363-0x0000000004F60000-0x00000000051E6000-memory.dmpFilesize
2.5MB
-
memory/6192-571-0x000000001CC10000-0x000000001CC12000-memory.dmpFilesize
8KB
-
memory/6432-496-0x0000000000000000-mapping.dmp