Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 12:11
Static task
static1
Behavioral task
behavioral1
Sample
FT20200504 104835457 EMIRATE.exe
Resource
win7-20220414-en
General
-
Target
FT20200504 104835457 EMIRATE.exe
-
Size
633KB
-
MD5
0b9fffb2575af254598a1921a40c155c
-
SHA1
bd80b6c6e9d6134a4be8e69cd8dd644bbc57dfcc
-
SHA256
7fc1a736c594f6932e35c60e99b984b93280b68a48989683839ac1f25fe17d97
-
SHA512
dc09f18b3d6743f19a4ac5a7b34f4ad001b5ea8b53cf809745ce0e7e4706f0bb0542f72c6f284f9e0156add00dc6e990fe96e189c97511555bf307e2068f5d53
Malware Config
Extracted
nanocore
1.2.2.0
chaya.ddns.net:1960
185.140.53.208:1960
d8052c0f-025c-473b-b040-53a55fb82415
-
activate_away_mode
true
-
backup_connection_host
185.140.53.208
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-01-23T08:36:54.150343836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
1960
-
default_group
Risen One
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
d8052c0f-025c-473b-b040-53a55fb82415
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
chaya.ddns.net
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
true
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Drops startup file 2 IoCs
Processes:
FT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe FT20200504 104835457 EMIRATE.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe FT20200504 104835457 EMIRATE.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
FT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exedescription pid process target process PID 1160 set thread context of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 set thread context of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 set thread context of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 set thread context of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 set thread context of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1640 set thread context of 908 1640 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 944 set thread context of 2032 944 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1760 set thread context of 1080 1760 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1504 set thread context of 1260 1504 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1132 set thread context of 1492 1132 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1548 set thread context of 1644 1548 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1776 set thread context of 2008 1776 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1556 set thread context of 776 1556 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2024 set thread context of 1200 2024 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 524 set thread context of 2000 524 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1240 set thread context of 1316 1240 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 820 set thread context of 668 820 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1696 set thread context of 1988 1696 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1256 set thread context of 1060 1256 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1044 set thread context of 2060 1044 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2104 set thread context of 2132 2104 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2172 set thread context of 2236 2172 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2276 set thread context of 2308 2276 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2376 set thread context of 2412 2376 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2468 set thread context of 2532 2468 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2596 set thread context of 2624 2596 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2688 set thread context of 2720 2688 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2788 set thread context of 2816 2788 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2892 set thread context of 2928 2892 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2996 set thread context of 3024 2996 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1888 set thread context of 2068 1888 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2180 set thread context of 2100 2180 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2120 set thread context of 2348 2120 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2288 set thread context of 1280 2288 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2300 set thread context of 2568 2300 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2516 set thread context of 2396 2516 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 968 set thread context of 2492 968 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 908 set thread context of 2612 908 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2032 set thread context of 2708 2032 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2956 set thread context of 2924 2956 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1632 set thread context of 1956 1632 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1684 set thread context of 1980 1684 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1916 set thread context of 1644 1916 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2400 set thread context of 2448 2400 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 632 set thread context of 2184 632 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1416 set thread context of 2292 1416 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2488 set thread context of 860 2488 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2524 set thread context of 1856 2524 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2776 set thread context of 2940 2776 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2888 set thread context of 1520 2888 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2076 set thread context of 2060 2076 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1220 set thread context of 1492 1220 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2240 set thread context of 1068 2240 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2116 set thread context of 572 2116 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2404 set thread context of 776 2404 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2552 set thread context of 2532 2552 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1552 set thread context of 280 1552 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2696 set thread context of 2684 2696 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1988 set thread context of 2796 1988 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2752 set thread context of 2932 2752 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 3040 set thread context of 1756 3040 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2092 set thread context of 2080 2092 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2352 set thread context of 3016 2352 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 2320 set thread context of 2140 2320 FT20200504 104835457 EMIRATE.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
FT20200504 104835457 EMIRATE.exepid process 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe 1160 FT20200504 104835457 EMIRATE.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 960 RegAsm.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
FT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exepid process 1160 FT20200504 104835457 EMIRATE.exe 1960 FT20200504 104835457 EMIRATE.exe 1960 FT20200504 104835457 EMIRATE.exe 1364 FT20200504 104835457 EMIRATE.exe 368 FT20200504 104835457 EMIRATE.exe 1636 FT20200504 104835457 EMIRATE.exe 1640 FT20200504 104835457 EMIRATE.exe 1640 FT20200504 104835457 EMIRATE.exe 1640 FT20200504 104835457 EMIRATE.exe 944 FT20200504 104835457 EMIRATE.exe 1760 FT20200504 104835457 EMIRATE.exe 1504 FT20200504 104835457 EMIRATE.exe 1504 FT20200504 104835457 EMIRATE.exe 1132 FT20200504 104835457 EMIRATE.exe 1548 FT20200504 104835457 EMIRATE.exe 1548 FT20200504 104835457 EMIRATE.exe 1776 FT20200504 104835457 EMIRATE.exe 1556 FT20200504 104835457 EMIRATE.exe 2024 FT20200504 104835457 EMIRATE.exe 524 FT20200504 104835457 EMIRATE.exe 1240 FT20200504 104835457 EMIRATE.exe 820 FT20200504 104835457 EMIRATE.exe 820 FT20200504 104835457 EMIRATE.exe 820 FT20200504 104835457 EMIRATE.exe 1696 FT20200504 104835457 EMIRATE.exe 1696 FT20200504 104835457 EMIRATE.exe 1256 FT20200504 104835457 EMIRATE.exe 1256 FT20200504 104835457 EMIRATE.exe 1044 FT20200504 104835457 EMIRATE.exe 1044 FT20200504 104835457 EMIRATE.exe 1044 FT20200504 104835457 EMIRATE.exe 2104 FT20200504 104835457 EMIRATE.exe 2172 FT20200504 104835457 EMIRATE.exe 2172 FT20200504 104835457 EMIRATE.exe 2172 FT20200504 104835457 EMIRATE.exe 2172 FT20200504 104835457 EMIRATE.exe 2172 FT20200504 104835457 EMIRATE.exe 2276 FT20200504 104835457 EMIRATE.exe 2376 FT20200504 104835457 EMIRATE.exe 2376 FT20200504 104835457 EMIRATE.exe 2468 FT20200504 104835457 EMIRATE.exe 2468 FT20200504 104835457 EMIRATE.exe 2468 FT20200504 104835457 EMIRATE.exe 2468 FT20200504 104835457 EMIRATE.exe 2596 FT20200504 104835457 EMIRATE.exe 2688 FT20200504 104835457 EMIRATE.exe 2788 FT20200504 104835457 EMIRATE.exe 2892 FT20200504 104835457 EMIRATE.exe 2892 FT20200504 104835457 EMIRATE.exe 2996 FT20200504 104835457 EMIRATE.exe 1888 FT20200504 104835457 EMIRATE.exe 2180 FT20200504 104835457 EMIRATE.exe 2120 FT20200504 104835457 EMIRATE.exe 2120 FT20200504 104835457 EMIRATE.exe 2288 FT20200504 104835457 EMIRATE.exe 2300 FT20200504 104835457 EMIRATE.exe 2300 FT20200504 104835457 EMIRATE.exe 2516 FT20200504 104835457 EMIRATE.exe 968 FT20200504 104835457 EMIRATE.exe 908 FT20200504 104835457 EMIRATE.exe 2032 FT20200504 104835457 EMIRATE.exe 2956 FT20200504 104835457 EMIRATE.exe 1632 FT20200504 104835457 EMIRATE.exe 1684 FT20200504 104835457 EMIRATE.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
FT20200504 104835457 EMIRATE.exeRegAsm.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exedescription pid process Token: SeDebugPrivilege 1160 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 960 RegAsm.exe Token: SeDebugPrivilege 1960 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1364 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 368 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1636 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1640 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 944 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1760 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1504 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1132 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1548 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1776 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1556 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2024 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 524 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1240 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 820 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1696 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1256 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1044 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2104 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2172 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2276 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2376 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2468 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2596 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2688 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2788 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2892 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2996 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1888 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2180 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2120 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2288 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2300 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2516 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 968 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 908 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2032 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2956 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1632 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1684 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1916 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2400 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 632 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1416 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2488 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2524 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2776 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2888 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2076 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1220 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2240 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2116 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2404 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2552 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1552 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2696 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 1988 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2752 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 3040 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2092 FT20200504 104835457 EMIRATE.exe Token: SeDebugPrivilege 2352 FT20200504 104835457 EMIRATE.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
FT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exeFT20200504 104835457 EMIRATE.exedescription pid process target process PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 960 1160 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1160 wrote to memory of 1960 1160 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1160 wrote to memory of 1960 1160 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1160 wrote to memory of 1960 1160 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1160 wrote to memory of 1960 1160 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 384 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1072 1960 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1960 wrote to memory of 1364 1960 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1960 wrote to memory of 1364 1960 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1960 wrote to memory of 1364 1960 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1960 wrote to memory of 1364 1960 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 868 1364 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1364 wrote to memory of 368 1364 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1364 wrote to memory of 368 1364 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1364 wrote to memory of 368 1364 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1364 wrote to memory of 368 1364 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1932 368 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 368 wrote to memory of 1636 368 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 368 wrote to memory of 1636 368 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 368 wrote to memory of 1636 368 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 368 wrote to memory of 1636 368 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 968 1636 FT20200504 104835457 EMIRATE.exe RegAsm.exe PID 1636 wrote to memory of 1640 1636 FT20200504 104835457 EMIRATE.exe FT20200504 104835457 EMIRATE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"40⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"50⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"63⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"C:\Users\Admin\AppData\Local\Temp\FT20200504 104835457 EMIRATE.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exeFilesize
636KB
MD5e9108c549e256d5ad0a1a937062a630b
SHA16a7d9eec7ef3561ac51f2b440af7ef2f647c6f49
SHA256754a51022eed720c942f3e8868d3d02c1f871955c9e07f19972c889270148728
SHA512ca365b8458af197c7b4d30ca10ab3437b0a862a9a4e17c8027fcb222406690ab1e558f63b4586e9c4c79fc667b7f86d8ee700aaf2ae1daffc7d38db063d32ec5
-
memory/368-82-0x0000000000000000-mapping.dmp
-
memory/524-126-0x0000000000000000-mapping.dmp
-
memory/668-136-0x000000000041E792-mapping.dmp
-
memory/776-120-0x000000000041E792-mapping.dmp
-
memory/820-134-0x0000000000000000-mapping.dmp
-
memory/868-80-0x000000000041E792-mapping.dmp
-
memory/908-92-0x000000000041E792-mapping.dmp
-
memory/944-94-0x0000000000000000-mapping.dmp
-
memory/960-67-0x0000000000860000-0x000000000086E000-memory.dmpFilesize
56KB
-
memory/960-71-0x0000000004370000-0x0000000004384000-memory.dmpFilesize
80KB
-
memory/960-66-0x0000000000850000-0x0000000000864000-memory.dmpFilesize
80KB
-
memory/960-59-0x000000000041E792-mapping.dmp
-
memory/960-68-0x0000000000870000-0x000000000088E000-memory.dmpFilesize
120KB
-
memory/960-69-0x0000000004310000-0x000000000431A000-memory.dmpFilesize
40KB
-
memory/960-70-0x0000000004460000-0x000000000448E000-memory.dmpFilesize
184KB
-
memory/960-65-0x0000000000800000-0x000000000080E000-memory.dmpFilesize
56KB
-
memory/960-61-0x0000000000400000-0x000000000047E000-memory.dmpFilesize
504KB
-
memory/960-74-0x00000000044B5000-0x00000000044C6000-memory.dmpFilesize
68KB
-
memory/960-64-0x0000000000750000-0x000000000076A000-memory.dmpFilesize
104KB
-
memory/960-63-0x0000000000740000-0x0000000000752000-memory.dmpFilesize
72KB
-
memory/960-62-0x00000000006F0000-0x00000000006FA000-memory.dmpFilesize
40KB
-
memory/968-88-0x000000000041E792-mapping.dmp
-
memory/1044-146-0x0000000000000000-mapping.dmp
-
memory/1060-144-0x000000000041E792-mapping.dmp
-
memory/1072-75-0x000000000041E792-mapping.dmp
-
memory/1080-100-0x000000000041E792-mapping.dmp
-
memory/1132-106-0x0000000000000000-mapping.dmp
-
memory/1160-55-0x0000000000550000-0x00000000005D6000-memory.dmpFilesize
536KB
-
memory/1160-56-0x0000000075581000-0x0000000075583000-memory.dmpFilesize
8KB
-
memory/1160-57-0x00000000003C0000-0x00000000003C3000-memory.dmpFilesize
12KB
-
memory/1160-58-0x00000000003E0000-0x00000000003E3000-memory.dmpFilesize
12KB
-
memory/1160-54-0x00000000013E0000-0x0000000001484000-memory.dmpFilesize
656KB
-
memory/1200-124-0x000000000041E792-mapping.dmp
-
memory/1240-130-0x0000000000000000-mapping.dmp
-
memory/1256-142-0x0000000000000000-mapping.dmp
-
memory/1260-104-0x000000000041E792-mapping.dmp
-
memory/1316-132-0x000000000041E792-mapping.dmp
-
memory/1364-77-0x0000000000000000-mapping.dmp
-
memory/1492-108-0x000000000041E792-mapping.dmp
-
memory/1504-102-0x0000000000000000-mapping.dmp
-
memory/1548-110-0x0000000000000000-mapping.dmp
-
memory/1556-118-0x0000000000000000-mapping.dmp
-
memory/1636-86-0x0000000000000000-mapping.dmp
-
memory/1640-90-0x0000000000000000-mapping.dmp
-
memory/1644-112-0x000000000041E792-mapping.dmp
-
memory/1696-138-0x0000000000000000-mapping.dmp
-
memory/1760-98-0x0000000000000000-mapping.dmp
-
memory/1776-114-0x0000000000000000-mapping.dmp
-
memory/1888-190-0x0000000000000000-mapping.dmp
-
memory/1932-84-0x000000000041E792-mapping.dmp
-
memory/1960-72-0x0000000000000000-mapping.dmp
-
memory/1988-140-0x000000000041E792-mapping.dmp
-
memory/2000-128-0x000000000041E792-mapping.dmp
-
memory/2008-116-0x000000000041E792-mapping.dmp
-
memory/2024-122-0x0000000000000000-mapping.dmp
-
memory/2032-96-0x000000000041E792-mapping.dmp
-
memory/2060-148-0x000000000041E792-mapping.dmp
-
memory/2068-192-0x000000000041E792-mapping.dmp
-
memory/2100-196-0x000000000041E792-mapping.dmp
-
memory/2104-150-0x0000000000000000-mapping.dmp
-
memory/2120-198-0x0000000000000000-mapping.dmp
-
memory/2132-152-0x000000000041E792-mapping.dmp
-
memory/2172-154-0x0000000000000000-mapping.dmp
-
memory/2180-194-0x0000000000000000-mapping.dmp
-
memory/2236-156-0x000000000041E792-mapping.dmp
-
memory/2276-158-0x0000000000000000-mapping.dmp
-
memory/2308-160-0x000000000041E792-mapping.dmp
-
memory/2376-162-0x0000000000000000-mapping.dmp
-
memory/2412-164-0x000000000041E792-mapping.dmp
-
memory/2468-166-0x0000000000000000-mapping.dmp
-
memory/2532-168-0x000000000041E792-mapping.dmp
-
memory/2596-170-0x0000000000000000-mapping.dmp
-
memory/2624-172-0x000000000041E792-mapping.dmp
-
memory/2688-174-0x0000000000000000-mapping.dmp
-
memory/2720-176-0x000000000041E792-mapping.dmp
-
memory/2788-178-0x0000000000000000-mapping.dmp
-
memory/2816-180-0x000000000041E792-mapping.dmp
-
memory/2892-182-0x0000000000000000-mapping.dmp
-
memory/2928-184-0x000000000041E792-mapping.dmp
-
memory/2996-186-0x0000000000000000-mapping.dmp
-
memory/3024-188-0x000000000041E792-mapping.dmp