Analysis
-
max time kernel
152s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 02:41
Static task
static1
Behavioral task
behavioral1
Sample
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe
Resource
win10v2004-20220901-en
General
-
Target
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe
-
Size
586KB
-
MD5
856401f79397ae093d5fd7795007d900
-
SHA1
c03525fe8d9222fcdc7a6efba2063b671c95b690
-
SHA256
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540
-
SHA512
d4d9dd5d6d650c2e42d4da859b3a93fe830faf31217a830df90a75e63c3cc243a62bc3cf0f0d847c260f386afe36cd4ff044121d1a8982bf80005e7e98abadd2
-
SSDEEP
12288:NdmNDwtZF4951xlMfa780coTAHp9/VjbyOogKN1:NwNDwKflMS8VoWp9djed
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 10 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\side = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\side.exe" 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedescription pid process target process PID 2044 set thread context of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1748 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1112 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4976 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1768 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 808 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4004 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4772 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4732 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4292 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4956 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3756 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2768 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3792 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2460 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3900 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 32 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2832 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1316 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1324 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 804 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4676 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2152 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1028 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2236 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4284 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2188 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3504 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3120 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4928 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1900 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2412 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3964 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 112 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1920 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 796 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1772 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2800 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4508 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4100 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4188 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2288 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4996 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4548 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3048 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 868 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 1628 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4876 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2428 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4036 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3188 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 64 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3516 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4528 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 2120 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 916 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3240 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3816 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 3436 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 set thread context of 4936 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe -
Drops file in Windows directory 1 IoCs
Processes:
dw20.exedescription ioc process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1952 984 WerFault.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
dw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe -
Enumerates system info in registry 2 TTPs 64 IoCs
Processes:
dw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exepid process 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exedescription pid process Token: SeDebugPrivilege 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Token: SeRestorePrivilege 3020 dw20.exe Token: SeBackupPrivilege 3020 dw20.exe Token: SeBackupPrivilege 3020 dw20.exe Token: SeBackupPrivilege 3020 dw20.exe Token: SeBackupPrivilege 3020 dw20.exe Token: SeBackupPrivilege 4224 dw20.exe Token: SeBackupPrivilege 4224 dw20.exe Token: SeBackupPrivilege 2812 dw20.exe Token: SeBackupPrivilege 2812 dw20.exe Token: SeBackupPrivilege 4484 dw20.exe Token: SeBackupPrivilege 4484 dw20.exe Token: SeBackupPrivilege 1224 dw20.exe Token: SeBackupPrivilege 1224 dw20.exe Token: SeBackupPrivilege 3728 dw20.exe Token: SeBackupPrivilege 3728 dw20.exe Token: SeDebugPrivilege 3124 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Token: SeBackupPrivilege 4520 dw20.exe Token: SeBackupPrivilege 4520 dw20.exe Token: SeBackupPrivilege 3316 dw20.exe Token: SeBackupPrivilege 3316 dw20.exe Token: SeBackupPrivilege 4528 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Token: SeBackupPrivilege 4528 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe Token: SeBackupPrivilege 2492 dw20.exe Token: SeBackupPrivilege 2492 dw20.exe Token: SeBackupPrivilege 5032 dw20.exe Token: SeBackupPrivilege 5032 dw20.exe Token: SeBackupPrivilege 1008 dw20.exe Token: SeBackupPrivilege 1008 dw20.exe Token: SeBackupPrivilege 3204 dw20.exe Token: SeBackupPrivilege 3204 dw20.exe Token: SeBackupPrivilege 1760 dw20.exe Token: SeBackupPrivilege 1760 dw20.exe Token: SeBackupPrivilege 2284 dw20.exe Token: SeBackupPrivilege 2284 dw20.exe Token: SeBackupPrivilege 3284 dw20.exe Token: SeBackupPrivilege 3284 dw20.exe Token: SeBackupPrivilege 3268 dw20.exe Token: SeBackupPrivilege 3268 dw20.exe Token: SeBackupPrivilege 3652 dw20.exe Token: SeBackupPrivilege 3652 dw20.exe Token: SeBackupPrivilege 1116 dw20.exe Token: SeBackupPrivilege 1116 dw20.exe Token: SeBackupPrivilege 2248 dw20.exe Token: SeBackupPrivilege 2248 dw20.exe Token: SeBackupPrivilege 1844 dw20.exe Token: SeBackupPrivilege 1844 dw20.exe Token: SeBackupPrivilege 4440 dw20.exe Token: SeBackupPrivilege 4440 dw20.exe Token: SeBackupPrivilege 4520 dw20.exe Token: SeBackupPrivilege 4520 dw20.exe Token: SeBackupPrivilege 5100 dw20.exe Token: SeBackupPrivilege 5100 dw20.exe Token: SeBackupPrivilege 4256 dw20.exe Token: SeBackupPrivilege 4256 dw20.exe Token: SeBackupPrivilege 1632 dw20.exe Token: SeBackupPrivilege 1632 dw20.exe Token: SeBackupPrivilege 4696 dw20.exe Token: SeBackupPrivilege 4696 dw20.exe Token: SeBackupPrivilege 3456 dw20.exe Token: SeBackupPrivilege 3456 dw20.exe Token: SeBackupPrivilege 2008 dw20.exe Token: SeBackupPrivilege 2008 dw20.exe Token: SeBackupPrivilege 1280 dw20.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exedescription pid process target process PID 2044 wrote to memory of 3440 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe CMD.exe PID 2044 wrote to memory of 3440 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe CMD.exe PID 2044 wrote to memory of 3440 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe CMD.exe PID 2044 wrote to memory of 4908 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe CMD.exe PID 2044 wrote to memory of 4908 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe CMD.exe PID 2044 wrote to memory of 4908 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe CMD.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 1540 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4972 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4972 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4972 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4588 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4588 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4588 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3124 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 1540 wrote to memory of 3020 1540 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 1540 wrote to memory of 3020 1540 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 1540 wrote to memory of 3020 1540 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4556 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 4556 wrote to memory of 4224 4556 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 4556 wrote to memory of 4224 4556 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 4556 wrote to memory of 4224 4556 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 2044 wrote to memory of 220 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 220 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 220 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 4564 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 4564 wrote to memory of 2812 4564 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 4564 wrote to memory of 2812 4564 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 4564 wrote to memory of 2812 4564 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe dw20.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe PID 2044 wrote to memory of 3264 2044 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe 3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8043⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7523⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8163⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7763⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8163⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8043⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8323⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8283⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8323⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4243⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8323⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Enumerates system info in registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Checks processor information in registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Checks processor information in registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 4203⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Checks processor information in registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8163⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
- Checks computer location settings
- Enumerates system info in registry
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8163⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4243⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 4643⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8243⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8283⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 7523⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8243⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8323⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8203⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"C:\Users\Admin\AppData\Local\Temp\3a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8283⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 8201⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 984 -ip 9841⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\side.exeFilesize
586KB
MD5856401f79397ae093d5fd7795007d900
SHA1c03525fe8d9222fcdc7a6efba2063b671c95b690
SHA2563a78a6628941523d37bbad5ab0247b537636635a5be16aa680a550971918a540
SHA512d4d9dd5d6d650c2e42d4da859b3a93fe830faf31217a830df90a75e63c3cc243a62bc3cf0f0d847c260f386afe36cd4ff044121d1a8982bf80005e7e98abadd2
-
memory/32-237-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/32-294-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/32-233-0x0000000000000000-mapping.dmp
-
memory/112-290-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/112-289-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/220-151-0x0000000000000000-mapping.dmp
-
memory/796-295-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/804-253-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/804-250-0x0000000000000000-mapping.dmp
-
memory/808-180-0x0000000000000000-mapping.dmp
-
memory/808-183-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1008-195-0x0000000000000000-mapping.dmp
-
memory/1028-263-0x0000000000000000-mapping.dmp
-
memory/1028-266-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1112-171-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1112-170-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1112-167-0x0000000000000000-mapping.dmp
-
memory/1116-229-0x0000000000000000-mapping.dmp
-
memory/1224-165-0x0000000000000000-mapping.dmp
-
memory/1316-242-0x0000000000000000-mapping.dmp
-
memory/1316-245-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1324-249-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1324-246-0x0000000000000000-mapping.dmp
-
memory/1540-137-0x0000000000000000-mapping.dmp
-
memory/1540-146-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1540-138-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1540-141-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1632-261-0x0000000000000000-mapping.dmp
-
memory/1748-163-0x0000000000000000-mapping.dmp
-
memory/1748-166-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1760-205-0x0000000000000000-mapping.dmp
-
memory/1768-176-0x0000000000000000-mapping.dmp
-
memory/1768-256-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1768-179-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1772-297-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1844-240-0x0000000000000000-mapping.dmp
-
memory/1900-282-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1900-281-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/1920-292-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2044-136-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2044-132-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2152-262-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2152-259-0x0000000000000000-mapping.dmp
-
memory/2160-161-0x0000000000000000-mapping.dmp
-
memory/2188-272-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2236-269-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2248-235-0x0000000000000000-mapping.dmp
-
memory/2284-209-0x0000000000000000-mapping.dmp
-
memory/2412-284-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2444-212-0x0000000000000000-mapping.dmp
-
memory/2460-222-0x0000000000000000-mapping.dmp
-
memory/2460-226-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2492-186-0x0000000000000000-mapping.dmp
-
memory/2768-213-0x0000000000000000-mapping.dmp
-
memory/2768-217-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2768-216-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2800-299-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2812-154-0x0000000000000000-mapping.dmp
-
memory/2832-241-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/2832-238-0x0000000000000000-mapping.dmp
-
memory/3020-144-0x0000000000000000-mapping.dmp
-
memory/3120-276-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3120-277-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3124-225-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3124-143-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/3124-145-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3124-142-0x0000000000000000-mapping.dmp
-
memory/3204-200-0x0000000000000000-mapping.dmp
-
memory/3264-159-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3264-160-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3264-156-0x0000000000000000-mapping.dmp
-
memory/3268-220-0x0000000000000000-mapping.dmp
-
memory/3284-215-0x0000000000000000-mapping.dmp
-
memory/3316-178-0x0000000000000000-mapping.dmp
-
memory/3440-133-0x0000000000000000-mapping.dmp
-
memory/3504-274-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3652-224-0x0000000000000000-mapping.dmp
-
memory/3728-169-0x0000000000000000-mapping.dmp
-
memory/3756-211-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3756-207-0x0000000000000000-mapping.dmp
-
memory/3756-210-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3792-221-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3792-218-0x0000000000000000-mapping.dmp
-
memory/3900-227-0x0000000000000000-mapping.dmp
-
memory/3900-231-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3900-232-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3964-287-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/3964-286-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4000-236-0x0000000000000000-mapping.dmp
-
memory/4004-188-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4004-184-0x0000000000000000-mapping.dmp
-
memory/4004-187-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4100-303-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4188-305-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4224-149-0x0000000000000000-mapping.dmp
-
memory/4256-257-0x0000000000000000-mapping.dmp
-
memory/4284-270-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4292-202-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4292-201-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4292-198-0x0000000000000000-mapping.dmp
-
memory/4440-244-0x0000000000000000-mapping.dmp
-
memory/4484-158-0x0000000000000000-mapping.dmp
-
memory/4508-301-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4520-174-0x0000000000000000-mapping.dmp
-
memory/4520-248-0x0000000000000000-mapping.dmp
-
memory/4528-182-0x0000000000000000-mapping.dmp
-
memory/4556-230-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4556-147-0x0000000000000000-mapping.dmp
-
memory/4556-150-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4564-152-0x0000000000000000-mapping.dmp
-
memory/4564-155-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4588-140-0x0000000000000000-mapping.dmp
-
memory/4624-162-0x0000000000000000-mapping.dmp
-
memory/4676-258-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4676-254-0x0000000000000000-mapping.dmp
-
memory/4696-265-0x0000000000000000-mapping.dmp
-
memory/4732-196-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4732-193-0x0000000000000000-mapping.dmp
-
memory/4732-197-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4772-192-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4772-189-0x0000000000000000-mapping.dmp
-
memory/4908-134-0x0000000000000000-mapping.dmp
-
memory/4928-279-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4956-203-0x0000000000000000-mapping.dmp
-
memory/4956-206-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4972-139-0x0000000000000000-mapping.dmp
-
memory/4976-175-0x00000000754A0000-0x0000000075A51000-memory.dmpFilesize
5.7MB
-
memory/4976-172-0x0000000000000000-mapping.dmp
-
memory/5032-191-0x0000000000000000-mapping.dmp
-
memory/5100-252-0x0000000000000000-mapping.dmp