Resubmissions
24-01-2022 18:12
220124-ws75xsgcf6 114-01-2022 15:34
220114-szqyfahceq 1008-01-2022 19:45
220108-ygvfssdbh9 1008-01-2022 19:45
220108-ygvfssdbh8 1008-01-2022 19:34
220108-x95xkadbh3 807-01-2022 14:28
220107-rsy5sscda4 1006-01-2022 19:07
220106-xszdfsbee2 10Analysis
-
max time kernel
265s -
max time network
274s -
platform
windows7_x64 -
resource
win7-ja-20211208 -
submitted
07-01-2022 14:28
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://youtube.com
Resource
win7-ja-20211208
General
-
Target
https://youtube.com
Malware Config
Signatures
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
Processes:
Win 10 Tweaker.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts Win 10 Tweaker.exe File created C:\Windows\system32\drivers\etc\hosts (Original) Win 10 Tweaker.exe File opened for modification C:\Windows\system32\drivers\etc\hosts (Original) Win 10 Tweaker.exe -
Executes dropped EXE 1 IoCs
Processes:
Win 10 Tweaker.exepid process 976 Win 10 Tweaker.exe -
Modifies Windows Firewall 1 TTPs
-
Sets file execution options in registry 2 TTPs
-
Processes:
Win 10 Tweaker.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Win 10 Tweaker.exe -
Drops file in System32 directory 5 IoCs
Processes:
Win 10 Tweaker.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy Win 10 Tweaker.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini Win 10 Tweaker.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol Win 10 Tweaker.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI Win 10 Tweaker.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol Win 10 Tweaker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Win 10 Tweaker.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Win 10 Tweaker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier Win 10 Tweaker.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Win 10 Tweaker.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2828 taskkill.exe -
Processes:
Win 10 Tweaker.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security\DisableSecuritySettingsCheck = "1" Win 10 Tweaker.exe -
Modifies registry class 6 IoCs
Processes:
Win 10 Tweaker.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w10t\shell\open Win 10 Tweaker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w10t\shell\open\command\ = "\"C:\\Users\\Admin\\Downloads\\Win 10 Tweaker.exe\" buyknow" Win 10 Tweaker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w10t Win 10 Tweaker.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\w10t\URL protocol Win 10 Tweaker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w10t\shell\open\command Win 10 Tweaker.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\w10t\shell Win 10 Tweaker.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exechrome.exepowershell.exeWin 10 Tweaker.exepid process 1760 chrome.exe 1836 chrome.exe 1836 chrome.exe 2368 chrome.exe 2104 chrome.exe 2452 chrome.exe 2676 chrome.exe 2044 chrome.exe 2716 chrome.exe 1836 chrome.exe 1836 chrome.exe 2712 chrome.exe 2500 powershell.exe 976 Win 10 Tweaker.exe 976 Win 10 Tweaker.exe 976 Win 10 Tweaker.exe 976 Win 10 Tweaker.exe -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
Win 10 Tweaker.exepowershell.exeAUDIODG.EXEtaskkill.exedescription pid process Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeDebugPrivilege 2500 powershell.exe Token: 33 992 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 992 AUDIODG.EXE Token: 33 992 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 992 AUDIODG.EXE Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeDebugPrivilege 976 Win 10 Tweaker.exe Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeRestorePrivilege 976 Win 10 Tweaker.exe Token: SeBackupPrivilege 976 Win 10 Tweaker.exe Token: SeTakeOwnershipPrivilege 976 Win 10 Tweaker.exe Token: SeDebugPrivilege 2828 taskkill.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
Processes:
chrome.exeWin 10 Tweaker.exepid process 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 976 Win 10 Tweaker.exe 1836 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
Processes:
chrome.exepid process 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe 1836 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
chrome.exedescription pid process target process PID 1836 wrote to memory of 1592 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 1592 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 1592 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 1760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 1760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 1760 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe PID 1836 wrote to memory of 288 1836 chrome.exe chrome.exe -
System policy modification 1 TTPs 8 IoCs
Processes:
Win 10 Tweaker.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" Win 10 Tweaker.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" Win 10 Tweaker.exe
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://youtube.com1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6f24f50,0x7fef6f24f60,0x7fef6f24f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1040 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1720 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2100 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2948 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1256 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4192 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2996 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2556 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3468 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3464 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3660 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3784 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3656 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3532 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3600 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2404 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1268 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3788 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1656 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2256 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4332 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4124 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=108 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5172 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5180 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=804 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3580 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Win 10 Tweaker.exe"C:\Users\Admin\Downloads\Win 10 Tweaker.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -command Get-PhysicalDisk | select FriendlyName,MediaType3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh interface teredo set state disabled &netsh interface isatap set state disabled &netsh int ipv6 isatap set state disabled &netsh int ipv6 6to4 set state disabled &netsh interface IPV6 set global randomizeidentifier=disabled &netsh interface IPV6 set privacy state=disabled3⤵
-
C:\Windows\system32\netsh.exenetsh interface teredo set state disabled4⤵
-
C:\Windows\system32\netsh.exenetsh interface isatap set state disabled4⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap set state disabled4⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 6to4 set state disabled4⤵
-
C:\Windows\system32\netsh.exenetsh interface IPV6 set global randomizeidentifier=disabled4⤵
-
C:\Windows\system32\netsh.exenetsh interface IPV6 set privacy state=disabled4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable &schtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable &schtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /change /tn \Microsoft\Windows\Maintenance\WinSAT /disable &schtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable &schtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable &schtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable &schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable &schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable &schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable &schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable &schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable &schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable &schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn \Microsoft\Windows\Maintenance\WinSAT /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall delete rule name="Win 10 Tweaker – Privacy rules 🕵"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name="Win 10 Tweaker – Privacy rules 🕵"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable &schtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable &schtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable &schtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable &schtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office ClickToRun Service Monitor" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\AgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetry\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn2016" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentFallBack" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\OfficeTelemetryAgentLogOn" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Office\Office 15 Subscription Heartbeat" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Device Information\Device User" /disable4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /change /tn \Microsoft\Windows\Maintenance\WinSAT /disable &schtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable &schtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable &schtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable &schtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable &schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable &schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable &schtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable &schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable &schtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable &schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable &schtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable3⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn \Microsoft\Windows\Maintenance\WinSAT /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Autochk\Proxy" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\PcaPatchDbTask" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\ProgramDataUpdater" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Application Experience\StartupAppTask" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\PI\Sqm-Tasks" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\NetTrace\GatherNetworkInfo" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\Consolidator" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Customer Experience Improvement Program\UsbCeip" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticResolver" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClient" /disable4⤵
-
C:\Windows\system32\schtasks.exeschtasks /change /tn "\Microsoft\Windows\Feedback\Siuf\DmClientOnScenarioDownload" /disable4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall delete rule name="Win 10 Tweaker – Privacy rules 🕵"3⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall delete rule name="Win 10 Tweaker – Privacy rules 🕵"4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="Win 10 Tweaker – Privacy rules 🕵" action=block dir=out remoteip=13.64.90.137,13.68.31.193,13.69.131.175,13.66.56.243,13.68.82.8,13.68.92.143,13.69.109.130,13.69.109.131,13.73.26.107,13.74.169.109,13.78.130.220,13.78.232.226,13.78.233.133,13.88.21.125,13.92.194.212,13.104.215.69,13.105.28.32,13.105.28.48,20.44.86.43,20.49.150.241,20.54.110.119,20.54.232.160,20.60.20.4,20.190.169.24,20.190.169.25,23.99.49.121,23.102.4.253,23.102.5.5,23.102.21.4,23.103.182.126,40.68.222.212,40.69.153.67,40.70.184.83,40.70.220.248,40.77.228.47,40.77.228.87,40.77.228.92,40.77.232.101,40.78.128.150,40.79.85.125,40.88.32.150,40.112.209.200,40.115.3.210,40.115.119.185,40.119.211.203,40.124.34.70,40.126.41.96,40.126.41.160,51.104.136.2,51.105.218.222,51.140.40.236,51.140.157.153,51.143.53.152,51.143.111.7,51.143.111.81,51.144.227.73,52.147.198.201,52.138.204.217,52.155.94.78,52.157.234.37,52.158.208.111,52.164.241.205,52.169.189.83,52.170.83.19,52.174.22.246,52.178.147.240,52.178.151.212,52.178.223.23,52.182.141.63,52.183.114.173,52.184.221.185,52.229.39.152,52.230.85.180,52.230.222.68,52.236.42.239,52.236.43.202,52.255.188.83,65.52.100.7,65.52.100.9,65.52.100.11,65.52.100.91,65.52.100.92,65.52.100.93,65.52.100.94,65.52.161.64,65.55.29.238,65.55.83.120,65.55.113.11,65.55.113.12,65.55.113.13,65.55.176.90,65.55.252.43,65.55.252.63,65.55.252.70,65.55.252.71,65.55.252.72,65.55.252.93,65.55.252.190,65.55.252.202,66.119.147.131,104.41.207.73,104.42.151.234,104.43.137.66,104.43.139.21,104.43.139.144,104.43.140.223,104.43.193.48,104.43.228.53,104.43.228.202,104.43.237.169,104.45.11.195,104.45.214.112,104.46.1.211,104.46.38.64,104.46.162.224,104.46.162.226,104.210.4.77,104.210.40.87,104.210.212.243,104.214.35.244,104.214.78.152,131.253.6.87,131.253.6.103,131.253.34.230,131.253.34.234,131.253.34.237,131.253.34.243,131.253.34.246,131.253.34.247,131.253.34.249,131.253.34.252,131.253.34.255,131.253.40.37,134.170.30.202,134.170.30.203,134.170.30.204,134.170.30.221,134.170.52.151,134.170.235.16,157.56.74.250,157.56.91.77,157.56.106.184,157.56.106.185,157.56.106.189,157.56.113.217,157.56.121.89,157.56.124.87,157.56.149.250,157.56.194.72,157.56.194.73,157.56.194.74,168.61.24.141,168.61.146.25,168.61.149.17,168.61.161.212,168.61.172.71,168.62.187.13,168.63.100.61,168.63.108.233,191.236.155.80,191.237.218.239,191.239.50.18,191.239.50.77,191.239.52.100,191.239.54.52,207.68.166.2543⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Win 10 Tweaker – Privacy rules 🕵" action=block dir=out remoteip=13.64.90.137,13.68.31.193,13.69.131.175,13.66.56.243,13.68.82.8,13.68.92.143,13.69.109.130,13.69.109.131,13.73.26.107,13.74.169.109,13.78.130.220,13.78.232.226,13.78.233.133,13.88.21.125,13.92.194.212,13.104.215.69,13.105.28.32,13.105.28.48,20.44.86.43,20.49.150.241,20.54.110.119,20.54.232.160,20.60.20.4,20.190.169.24,20.190.169.25,23.99.49.121,23.102.4.253,23.102.5.5,23.102.21.4,23.103.182.126,40.68.222.212,40.69.153.67,40.70.184.83,40.70.220.248,40.77.228.47,40.77.228.87,40.77.228.92,40.77.232.101,40.78.128.150,40.79.85.125,40.88.32.150,40.112.209.200,40.115.3.210,40.115.119.185,40.119.211.203,40.124.34.70,40.126.41.96,40.126.41.160,51.104.136.2,51.105.218.222,51.140.40.236,51.140.157.153,51.143.53.152,51.143.111.7,51.143.111.81,51.144.227.73,52.147.198.201,52.138.204.217,52.155.94.78,52.157.234.37,52.158.208.111,52.164.241.205,52.169.189.83,52.170.83.19,52.174.22.246,52.178.147.240,52.178.151.212,52.178.223.23,52.182.141.63,52.183.114.173,52.184.221.185,52.229.39.152,52.230.85.180,52.230.222.68,52.236.42.239,52.236.43.202,52.255.188.83,65.52.100.7,65.52.100.9,65.52.100.11,65.52.100.91,65.52.100.92,65.52.100.93,65.52.100.94,65.52.161.64,65.55.29.238,65.55.83.120,65.55.113.11,65.55.113.12,65.55.113.13,65.55.176.90,65.55.252.43,65.55.252.63,65.55.252.70,65.55.252.71,65.55.252.72,65.55.252.93,65.55.252.190,65.55.252.202,66.119.147.131,104.41.207.73,104.42.151.234,104.43.137.66,104.43.139.21,104.43.139.144,104.43.140.223,104.43.193.48,104.43.228.53,104.43.228.202,104.43.237.169,104.45.11.195,104.45.214.112,104.46.1.211,104.46.38.64,104.46.162.224,104.46.162.226,104.210.4.77,104.210.40.87,104.210.212.243,104.214.35.244,104.214.78.152,131.253.6.87,131.253.6.103,131.253.34.230,131.253.34.234,131.253.34.237,131.253.34.243,131.253.34.246,131.253.34.247,131.253.34.249,131.253.34.252,131.253.34.255,131.253.40.37,134.170.30.202,134.170.30.203,134.170.30.204,134.170.30.221,134.170.52.151,134.170.235.16,157.56.74.250,157.56.91.77,157.56.106.184,157.56.106.185,157.56.106.189,157.56.113.217,157.56.121.89,157.56.124.87,157.56.149.250,157.56.194.72,157.56.194.73,157.56.194.74,168.61.24.141,168.61.146.25,168.61.149.17,168.61.161.212,168.61.172.71,168.62.187.13,168.63.100.61,168.63.108.233,191.236.155.80,191.237.218.239,191.239.50.18,191.239.50.77,191.239.52.100,191.239.54.52,207.68.166.2544⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="Win 10 Tweaker – Privacy rules 🕵" action=block dir=out remoteip=13.64.90.137,13.68.31.193,13.69.131.175,13.66.56.243,13.68.82.8,13.68.92.143,13.69.109.130,13.69.109.131,13.73.26.107,13.74.169.109,13.78.130.220,13.78.232.226,13.78.233.133,13.88.21.125,13.92.194.212,13.104.215.69,13.105.28.32,13.105.28.48,20.44.86.43,20.49.150.241,20.54.110.119,20.54.232.160,20.60.20.4,20.190.169.24,20.190.169.25,23.99.49.121,23.102.4.253,23.102.5.5,23.102.21.4,23.103.182.126,40.68.222.212,40.69.153.67,40.70.184.83,40.70.220.248,40.77.228.47,40.77.228.87,40.77.228.92,40.77.232.101,40.78.128.150,40.79.85.125,40.88.32.150,40.112.209.200,40.115.3.210,40.115.119.185,40.119.211.203,40.124.34.70,40.126.41.96,40.126.41.160,51.104.136.2,51.105.218.222,51.140.40.236,51.140.157.153,51.143.53.152,51.143.111.7,51.143.111.81,51.144.227.73,52.147.198.201,52.138.204.217,52.155.94.78,52.157.234.37,52.158.208.111,52.164.241.205,52.169.189.83,52.170.83.19,52.174.22.246,52.178.147.240,52.178.151.212,52.178.223.23,52.182.141.63,52.183.114.173,52.184.221.185,52.229.39.152,52.230.85.180,52.230.222.68,52.236.42.239,52.236.43.202,52.255.188.83,65.52.100.7,65.52.100.9,65.52.100.11,65.52.100.91,65.52.100.92,65.52.100.93,65.52.100.94,65.52.161.64,65.55.29.238,65.55.83.120,65.55.113.11,65.55.113.12,65.55.113.13,65.55.176.90,65.55.252.43,65.55.252.63,65.55.252.70,65.55.252.71,65.55.252.72,65.55.252.93,65.55.252.190,65.55.252.202,66.119.147.131,104.41.207.73,104.42.151.234,104.43.137.66,104.43.139.21,104.43.139.144,104.43.140.223,104.43.193.48,104.43.228.53,104.43.228.202,104.43.237.169,104.45.11.195,104.45.214.112,104.46.1.211,104.46.38.64,104.46.162.224,104.46.162.226,104.210.4.77,104.210.40.87,104.210.212.243,104.214.35.244,104.214.78.152,131.253.6.87,131.253.6.103,131.253.34.230,131.253.34.234,131.253.34.237,131.253.34.243,131.253.34.246,131.253.34.247,131.253.34.249,131.253.34.252,131.253.34.255,131.253.40.37,134.170.30.202,134.170.30.203,134.170.30.204,134.170.30.221,134.170.52.151,134.170.235.16,157.56.74.250,157.56.91.77,157.56.106.184,157.56.106.185,157.56.106.189,157.56.113.217,157.56.121.89,157.56.124.87,157.56.149.250,157.56.194.72,157.56.194.73,157.56.194.74,168.61.24.141,168.61.146.25,168.61.149.17,168.61.161.212,168.61.172.71,168.62.187.13,168.63.100.61,168.63.108.233,191.236.155.80,191.237.218.239,191.239.50.18,191.239.50.77,191.239.52.100,191.239.54.52,207.68.166.2543⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="Win 10 Tweaker – Privacy rules 🕵" action=block dir=out remoteip=13.64.90.137,13.68.31.193,13.69.131.175,13.66.56.243,13.68.82.8,13.68.92.143,13.69.109.130,13.69.109.131,13.73.26.107,13.74.169.109,13.78.130.220,13.78.232.226,13.78.233.133,13.88.21.125,13.92.194.212,13.104.215.69,13.105.28.32,13.105.28.48,20.44.86.43,20.49.150.241,20.54.110.119,20.54.232.160,20.60.20.4,20.190.169.24,20.190.169.25,23.99.49.121,23.102.4.253,23.102.5.5,23.102.21.4,23.103.182.126,40.68.222.212,40.69.153.67,40.70.184.83,40.70.220.248,40.77.228.47,40.77.228.87,40.77.228.92,40.77.232.101,40.78.128.150,40.79.85.125,40.88.32.150,40.112.209.200,40.115.3.210,40.115.119.185,40.119.211.203,40.124.34.70,40.126.41.96,40.126.41.160,51.104.136.2,51.105.218.222,51.140.40.236,51.140.157.153,51.143.53.152,51.143.111.7,51.143.111.81,51.144.227.73,52.147.198.201,52.138.204.217,52.155.94.78,52.157.234.37,52.158.208.111,52.164.241.205,52.169.189.83,52.170.83.19,52.174.22.246,52.178.147.240,52.178.151.212,52.178.223.23,52.182.141.63,52.183.114.173,52.184.221.185,52.229.39.152,52.230.85.180,52.230.222.68,52.236.42.239,52.236.43.202,52.255.188.83,65.52.100.7,65.52.100.9,65.52.100.11,65.52.100.91,65.52.100.92,65.52.100.93,65.52.100.94,65.52.161.64,65.55.29.238,65.55.83.120,65.55.113.11,65.55.113.12,65.55.113.13,65.55.176.90,65.55.252.43,65.55.252.63,65.55.252.70,65.55.252.71,65.55.252.72,65.55.252.93,65.55.252.190,65.55.252.202,66.119.147.131,104.41.207.73,104.42.151.234,104.43.137.66,104.43.139.21,104.43.139.144,104.43.140.223,104.43.193.48,104.43.228.53,104.43.228.202,104.43.237.169,104.45.11.195,104.45.214.112,104.46.1.211,104.46.38.64,104.46.162.224,104.46.162.226,104.210.4.77,104.210.40.87,104.210.212.243,104.214.35.244,104.214.78.152,131.253.6.87,131.253.6.103,131.253.34.230,131.253.34.234,131.253.34.237,131.253.34.243,131.253.34.246,131.253.34.247,131.253.34.249,131.253.34.252,131.253.34.255,131.253.40.37,134.170.30.202,134.170.30.203,134.170.30.204,134.170.30.221,134.170.52.151,134.170.235.16,157.56.74.250,157.56.91.77,157.56.106.184,157.56.106.185,157.56.106.189,157.56.113.217,157.56.121.89,157.56.124.87,157.56.149.250,157.56.194.72,157.56.194.73,157.56.194.74,168.61.24.141,168.61.146.25,168.61.149.17,168.61.161.212,168.61.172.71,168.62.187.13,168.63.100.61,168.63.108.233,191.236.155.80,191.237.218.239,191.239.50.18,191.239.50.77,191.239.52.100,191.239.54.52,207.68.166.2544⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c chcp 65001 & schtasks /TN \Microsoft\Windows\Maintenance\WinSAT3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\Maintenance\WinSAT4⤵
-
C:\Windows\system32\cmd.exe"cmd" /c chcp 65001 & schtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector3⤵
-
C:\Windows\system32\chcp.comchcp 650014⤵
-
C:\Windows\system32\schtasks.exeschtasks /TN \Microsoft\Windows\MemoryDiagnostic\CorruptionDetector4⤵
-
C:\Windows\system32\cmd.exe"cmd.exe" /c netsh int ipv6 isatap show state3⤵
-
C:\Windows\system32\netsh.exenetsh int ipv6 isatap show state4⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /f /pid "976"3⤵
-
C:\Windows\system32\taskkill.exetaskkill /f /pid "976"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3700 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1036,5130862384504375741,12585235601103556624,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1976 /prefetch:82⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1401⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-2095346207-783648974-765227491-395809131-185079848088697503617050044031853974660"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-23169072-161673680-16610357102096718242561736522-65701296012663596062052276162"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "19038129229240764654673728002100712476-21335635541726038725-578887363-1811350628"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Downloads\Win 10 Tweaker.exeMD5
7520c359a001097a907d1961c162c225
SHA1a8e2f731bb8302823ef8c82565a961a81da1751b
SHA256513cea9bee716d2c18c805dddd097928a1d68eeb5a9675658fdc7efba2e7658c
SHA5123908e611eee1d1050a406e3d20c49521f418f3449edf768491fe6d6f0b01bfaa71e7d82c336ffe182c19934c4ae51e37ea3b2e90fb1e5509880bfe26d3501f2e
-
C:\Users\Admin\Downloads\Win 10 Tweaker.exeMD5
7520c359a001097a907d1961c162c225
SHA1a8e2f731bb8302823ef8c82565a961a81da1751b
SHA256513cea9bee716d2c18c805dddd097928a1d68eeb5a9675658fdc7efba2e7658c
SHA5123908e611eee1d1050a406e3d20c49521f418f3449edf768491fe6d6f0b01bfaa71e7d82c336ffe182c19934c4ae51e37ea3b2e90fb1e5509880bfe26d3501f2e
-
\??\pipe\crashpad_1836_BGBXRLHBSBIZFSRAMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/308-98-0x0000000000000000-mapping.dmp
-
memory/436-141-0x0000000000000000-mapping.dmp
-
memory/472-138-0x0000000000000000-mapping.dmp
-
memory/876-124-0x0000000000000000-mapping.dmp
-
memory/904-148-0x0000000000000000-mapping.dmp
-
memory/908-121-0x0000000000000000-mapping.dmp
-
memory/976-67-0x000000001AEB7000-0x000000001AEB8000-memory.dmpFilesize
4KB
-
memory/976-59-0x000000001B170000-0x000000001B37C000-memory.dmpFilesize
2.0MB
-
memory/976-66-0x000000001AEB6000-0x000000001AEB7000-memory.dmpFilesize
4KB
-
memory/976-65-0x000000001AE97000-0x000000001AEB6000-memory.dmpFilesize
124KB
-
memory/976-58-0x0000000000FE0000-0x000000000116C000-memory.dmpFilesize
1.5MB
-
memory/976-69-0x000000001AEB9000-0x000000001AEBA000-memory.dmpFilesize
4KB
-
memory/976-68-0x000000001AEB8000-0x000000001AEB9000-memory.dmpFilesize
4KB
-
memory/976-71-0x000000001AEBB000-0x000000001AEBC000-memory.dmpFilesize
4KB
-
memory/976-70-0x000000001AEBA000-0x000000001AEBB000-memory.dmpFilesize
4KB
-
memory/976-72-0x000000001AEBC000-0x000000001AEBD000-memory.dmpFilesize
4KB
-
memory/976-63-0x000000001B050000-0x000000001B072000-memory.dmpFilesize
136KB
-
memory/976-64-0x000000001AE80000-0x000000001AE86000-memory.dmpFilesize
24KB
-
memory/976-60-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB
-
memory/976-61-0x000000001AE90000-0x000000001AE92000-memory.dmpFilesize
8KB
-
memory/976-55-0x0000000000000000-mapping.dmp
-
memory/976-83-0x000000001B4F0000-0x000000001B4F6000-memory.dmpFilesize
24KB
-
memory/976-82-0x0000000000FD0000-0x0000000000FE8000-memory.dmpFilesize
96KB
-
memory/976-62-0x000000001AE92000-0x000000001AE93000-memory.dmpFilesize
4KB
-
memory/984-90-0x0000000000000000-mapping.dmp
-
memory/1004-102-0x0000000000000000-mapping.dmp
-
memory/1044-131-0x0000000000000000-mapping.dmp
-
memory/1164-115-0x0000000000000000-mapping.dmp
-
memory/1348-109-0x0000000000000000-mapping.dmp
-
memory/1416-146-0x0000000000000000-mapping.dmp
-
memory/1452-93-0x0000000000000000-mapping.dmp
-
memory/1460-120-0x0000000000000000-mapping.dmp
-
memory/1472-112-0x0000000000000000-mapping.dmp
-
memory/1600-117-0x0000000000000000-mapping.dmp
-
memory/1604-147-0x0000000000000000-mapping.dmp
-
memory/1636-101-0x0000000000000000-mapping.dmp
-
memory/1640-79-0x0000000000000000-mapping.dmp
-
memory/1652-125-0x0000000000000000-mapping.dmp
-
memory/1660-137-0x0000000000000000-mapping.dmp
-
memory/1704-111-0x0000000000000000-mapping.dmp
-
memory/1816-107-0x0000000000000000-mapping.dmp
-
memory/2036-122-0x0000000000000000-mapping.dmp
-
memory/2108-143-0x0000000000000000-mapping.dmp
-
memory/2120-123-0x0000000000000000-mapping.dmp
-
memory/2160-116-0x0000000000000000-mapping.dmp
-
memory/2176-97-0x0000000000000000-mapping.dmp
-
memory/2184-89-0x0000000000000000-mapping.dmp
-
memory/2232-78-0x0000000000000000-mapping.dmp
-
memory/2244-144-0x0000000000000000-mapping.dmp
-
memory/2272-136-0x0000000000000000-mapping.dmp
-
memory/2296-77-0x0000000000000000-mapping.dmp
-
memory/2296-128-0x0000000000000000-mapping.dmp
-
memory/2300-130-0x0000000000000000-mapping.dmp
-
memory/2308-81-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmpFilesize
8KB
-
memory/2308-80-0x0000000000000000-mapping.dmp
-
memory/2312-91-0x0000000000000000-mapping.dmp
-
memory/2344-114-0x0000000000000000-mapping.dmp
-
memory/2392-149-0x0000000000000000-mapping.dmp
-
memory/2400-76-0x0000000000000000-mapping.dmp
-
memory/2456-100-0x0000000000000000-mapping.dmp
-
memory/2500-86-0x000007FEE0A30000-0x000007FEE158D000-memory.dmpFilesize
11.4MB
-
memory/2500-88-0x000000001BD60000-0x000000001C05F000-memory.dmpFilesize
3.0MB
-
memory/2500-84-0x0000000000000000-mapping.dmp
-
memory/2500-87-0x0000000002800000-0x0000000002802000-memory.dmpFilesize
8KB
-
memory/2552-140-0x0000000000000000-mapping.dmp
-
memory/2576-134-0x0000000000000000-mapping.dmp
-
memory/2580-133-0x0000000000000000-mapping.dmp
-
memory/2608-105-0x0000000000000000-mapping.dmp
-
memory/2608-139-0x0000000000000000-mapping.dmp
-
memory/2632-73-0x0000000000000000-mapping.dmp
-
memory/2648-95-0x0000000000000000-mapping.dmp
-
memory/2748-135-0x0000000000000000-mapping.dmp
-
memory/2764-150-0x0000000000000000-mapping.dmp
-
memory/2780-92-0x0000000000000000-mapping.dmp
-
memory/2848-118-0x0000000000000000-mapping.dmp
-
memory/2912-145-0x0000000000000000-mapping.dmp
-
memory/2916-132-0x0000000000000000-mapping.dmp
-
memory/2936-126-0x0000000000000000-mapping.dmp
-
memory/2948-74-0x0000000000000000-mapping.dmp
-
memory/3020-127-0x0000000000000000-mapping.dmp
-
memory/3020-75-0x0000000000000000-mapping.dmp
-
memory/3020-96-0x0000000000000000-mapping.dmp
-
memory/3032-129-0x0000000000000000-mapping.dmp
-
memory/3048-113-0x0000000000000000-mapping.dmp
-
memory/3064-142-0x0000000000000000-mapping.dmp